/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2014-02-16 02:42:42 UTC
  • Revision ID: teddy@recompile.se-20140216024242-9wiw1nkxgt7ohovj
Fix running of self-tests.

* debian/control (Build-Depends): Add Python dependencies to
                                  successfully run self-tests.
* debian/copyright: GPLv3 now has its own license file - use it.
* debian/watch: Set PGP signature URL.
* mandos (main): Bug fix: When running self-tests, set exit code.
* mandos-ctl (main): Cosmetic fix; use os.EX_OK instead of plain 0.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python2.7
 
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2015 Teddy Hogeborn
15
 
# Copyright © 2008-2015 Björn Påhlsson
 
14
# Copyright © 2008-2014 Teddy Hogeborn
 
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
 
37
37
from future_builtins import *
38
38
 
39
 
try:
40
 
    import SocketServer as socketserver
41
 
except ImportError:
42
 
    import socketserver
 
39
import SocketServer as socketserver
43
40
import socket
44
41
import argparse
45
42
import datetime
50
47
import gnutls.library.functions
51
48
import gnutls.library.constants
52
49
import gnutls.library.types
53
 
try:
54
 
    import ConfigParser as configparser
55
 
except ImportError:
56
 
    import configparser
 
50
import ConfigParser as configparser
57
51
import sys
58
52
import re
59
53
import os
68
62
import struct
69
63
import fcntl
70
64
import functools
71
 
try:
72
 
    import cPickle as pickle
73
 
except ImportError:
74
 
    import pickle
 
65
import cPickle as pickle
75
66
import multiprocessing
76
67
import types
77
68
import binascii
78
69
import tempfile
79
70
import itertools
80
71
import collections
81
 
import codecs
82
72
 
83
73
import dbus
84
74
import dbus.service
85
 
try:
86
 
    import gobject
87
 
except ImportError:
88
 
    from gi.repository import GObject as gobject
 
75
import gobject
89
76
import avahi
90
77
from dbus.mainloop.glib import DBusGMainLoop
91
78
import ctypes
101
88
    except ImportError:
102
89
        SO_BINDTODEVICE = None
103
90
 
104
 
if sys.version_info.major == 2:
105
 
    str = unicode
106
 
 
107
 
version = "1.6.9"
 
91
version = "1.6.3"
108
92
stored_state_file = "clients.pickle"
109
93
 
110
94
logger = logging.getLogger()
111
 
syslogger = None
 
95
syslogger = (logging.handlers.SysLogHandler
 
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
97
              address = str("/dev/log")))
112
98
 
113
99
try:
114
 
    if_nametoindex = ctypes.cdll.LoadLibrary(
115
 
        ctypes.util.find_library("c")).if_nametoindex
 
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
101
                      (ctypes.util.find_library("c"))
 
102
                      .if_nametoindex)
116
103
except (OSError, AttributeError):
117
 
    
118
104
    def if_nametoindex(interface):
119
105
        "Get an interface index the hard way, i.e. using fcntl()"
120
106
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
121
107
        with contextlib.closing(socket.socket()) as s:
122
108
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
 
                                struct.pack(b"16s16x", interface))
124
 
        interface_index = struct.unpack("I", ifreq[16:20])[0]
 
109
                                struct.pack(str("16s16x"),
 
110
                                            interface))
 
111
        interface_index = struct.unpack(str("I"),
 
112
                                        ifreq[16:20])[0]
125
113
        return interface_index
126
114
 
127
115
 
128
116
def initlogger(debug, level=logging.WARNING):
129
117
    """init logger and add loglevel"""
130
118
    
131
 
    global syslogger
132
 
    syslogger = (logging.handlers.SysLogHandler(
133
 
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
 
        address = "/dev/log"))
135
119
    syslogger.setFormatter(logging.Formatter
136
120
                           ('Mandos [%(process)d]: %(levelname)s:'
137
121
                            ' %(message)s'))
154
138
 
155
139
class PGPEngine(object):
156
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
157
 
    
158
141
    def __init__(self):
159
142
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
143
        self.gnupgargs = ['--batch',
199
182
    
200
183
    def encrypt(self, data, password):
201
184
        passphrase = self.password_encode(password)
202
 
        with tempfile.NamedTemporaryFile(
203
 
                dir=self.tempdir) as passfile:
 
185
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
186
                                         ) as passfile:
204
187
            passfile.write(passphrase)
205
188
            passfile.flush()
206
189
            proc = subprocess.Popen(['gpg', '--symmetric',
217
200
    
218
201
    def decrypt(self, data, password):
219
202
        passphrase = self.password_encode(password)
220
 
        with tempfile.NamedTemporaryFile(
221
 
                dir = self.tempdir) as passfile:
 
203
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
204
                                         ) as passfile:
222
205
            passfile.write(passphrase)
223
206
            passfile.flush()
224
207
            proc = subprocess.Popen(['gpg', '--decrypt',
228
211
                                    stdin = subprocess.PIPE,
229
212
                                    stdout = subprocess.PIPE,
230
213
                                    stderr = subprocess.PIPE)
231
 
            decrypted_plaintext, err = proc.communicate(input = data)
 
214
            decrypted_plaintext, err = proc.communicate(input
 
215
                                                        = data)
232
216
        if proc.returncode != 0:
233
217
            raise PGPError(err)
234
218
        return decrypted_plaintext
237
221
class AvahiError(Exception):
238
222
    def __init__(self, value, *args, **kwargs):
239
223
        self.value = value
240
 
        return super(AvahiError, self).__init__(value, *args,
241
 
                                                **kwargs)
242
 
 
 
224
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
225
    def __unicode__(self):
 
226
        return unicode(repr(self.value))
243
227
 
244
228
class AvahiServiceError(AvahiError):
245
229
    pass
246
230
 
247
 
 
248
231
class AvahiGroupError(AvahiError):
249
232
    pass
250
233
 
270
253
    bus: dbus.SystemBus()
271
254
    """
272
255
    
273
 
    def __init__(self,
274
 
                 interface = avahi.IF_UNSPEC,
275
 
                 name = None,
276
 
                 servicetype = None,
277
 
                 port = None,
278
 
                 TXT = None,
279
 
                 domain = "",
280
 
                 host = "",
281
 
                 max_renames = 32768,
282
 
                 protocol = avahi.PROTO_UNSPEC,
283
 
                 bus = None):
 
256
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
257
                 servicetype = None, port = None, TXT = None,
 
258
                 domain = "", host = "", max_renames = 32768,
 
259
                 protocol = avahi.PROTO_UNSPEC, bus = None):
284
260
        self.interface = interface
285
261
        self.name = name
286
262
        self.type = servicetype
296
272
        self.bus = bus
297
273
        self.entry_group_state_changed_match = None
298
274
    
299
 
    def rename(self, remove=True):
 
275
    def rename(self):
300
276
        """Derived from the Avahi example code"""
301
277
        if self.rename_count >= self.max_renames:
302
278
            logger.critical("No suitable Zeroconf service name found"
303
279
                            " after %i retries, exiting.",
304
280
                            self.rename_count)
305
281
            raise AvahiServiceError("Too many renames")
306
 
        self.name = str(
307
 
            self.server.GetAlternativeServiceName(self.name))
308
 
        self.rename_count += 1
 
282
        self.name = unicode(self.server
 
283
                            .GetAlternativeServiceName(self.name))
309
284
        logger.info("Changing Zeroconf service name to %r ...",
310
285
                    self.name)
311
 
        if remove:
312
 
            self.remove()
 
286
        self.remove()
313
287
        try:
314
288
            self.add()
315
289
        except dbus.exceptions.DBusException as error:
316
 
            if (error.get_dbus_name()
317
 
                == "org.freedesktop.Avahi.CollisionError"):
318
 
                logger.info("Local Zeroconf service name collision.")
319
 
                return self.rename(remove=False)
320
 
            else:
321
 
                logger.critical("D-Bus Exception", exc_info=error)
322
 
                self.cleanup()
323
 
                os._exit(1)
 
290
            logger.critical("D-Bus Exception", exc_info=error)
 
291
            self.cleanup()
 
292
            os._exit(1)
 
293
        self.rename_count += 1
324
294
    
325
295
    def remove(self):
326
296
        """Derived from the Avahi example code"""
364
334
            self.rename()
365
335
        elif state == avahi.ENTRY_GROUP_FAILURE:
366
336
            logger.critical("Avahi: Error in group state changed %s",
367
 
                            str(error))
368
 
            raise AvahiGroupError("State changed: {!s}".format(error))
 
337
                            unicode(error))
 
338
            raise AvahiGroupError("State changed: {0!s}"
 
339
                                  .format(error))
369
340
    
370
341
    def cleanup(self):
371
342
        """Derived from the Avahi example code"""
381
352
    def server_state_changed(self, state, error=None):
382
353
        """Derived from the Avahi example code"""
383
354
        logger.debug("Avahi server state change: %i", state)
384
 
        bad_states = {
385
 
            avahi.SERVER_INVALID: "Zeroconf server invalid",
386
 
            avahi.SERVER_REGISTERING: None,
387
 
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
 
            avahi.SERVER_FAILURE: "Zeroconf server failure",
389
 
        }
 
355
        bad_states = { avahi.SERVER_INVALID:
 
356
                           "Zeroconf server invalid",
 
357
                       avahi.SERVER_REGISTERING: None,
 
358
                       avahi.SERVER_COLLISION:
 
359
                           "Zeroconf server name collision",
 
360
                       avahi.SERVER_FAILURE:
 
361
                           "Zeroconf server failure" }
390
362
        if state in bad_states:
391
363
            if bad_states[state] is not None:
392
364
                if error is None:
395
367
                    logger.error(bad_states[state] + ": %r", error)
396
368
            self.cleanup()
397
369
        elif state == avahi.SERVER_RUNNING:
398
 
            try:
399
 
                self.add()
400
 
            except dbus.exceptions.DBusException as error:
401
 
                if (error.get_dbus_name()
402
 
                    == "org.freedesktop.Avahi.CollisionError"):
403
 
                    logger.info("Local Zeroconf service name"
404
 
                                " collision.")
405
 
                    return self.rename(remove=False)
406
 
                else:
407
 
                    logger.critical("D-Bus Exception", exc_info=error)
408
 
                    self.cleanup()
409
 
                    os._exit(1)
 
370
            self.add()
410
371
        else:
411
372
            if error is None:
412
373
                logger.debug("Unknown state: %r", state)
422
383
                                    follow_name_owner_changes=True),
423
384
                avahi.DBUS_INTERFACE_SERVER)
424
385
        self.server.connect_to_signal("StateChanged",
425
 
                                      self.server_state_changed)
 
386
                                 self.server_state_changed)
426
387
        self.server_state_changed(self.server.GetState())
427
388
 
428
389
 
429
390
class AvahiServiceToSyslog(AvahiService):
430
 
    def rename(self, *args, **kwargs):
 
391
    def rename(self):
431
392
        """Add the new name to the syslog messages"""
432
 
        ret = AvahiService.rename(self, *args, **kwargs)
433
 
        syslogger.setFormatter(logging.Formatter(
434
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
 
            .format(self.name)))
 
393
        ret = AvahiService.rename(self)
 
394
        syslogger.setFormatter(logging.Formatter
 
395
                               ('Mandos ({0}) [%(process)d]:'
 
396
                                ' %(levelname)s: %(message)s'
 
397
                                .format(self.name)))
436
398
        return ret
437
399
 
438
 
def call_pipe(connection,       # : multiprocessing.Connection
439
 
              func, *args, **kwargs):
440
 
    """This function is meant to be called by multiprocessing.Process
441
 
    
442
 
    This function runs func(*args, **kwargs), and writes the resulting
443
 
    return value on the provided multiprocessing.Connection.
444
 
    """
445
 
    connection.send(func(*args, **kwargs))
446
 
    connection.close()
 
400
 
 
401
def timedelta_to_milliseconds(td):
 
402
    "Convert a datetime.timedelta() to milliseconds"
 
403
    return ((td.days * 24 * 60 * 60 * 1000)
 
404
            + (td.seconds * 1000)
 
405
            + (td.microseconds // 1000))
 
406
 
447
407
 
448
408
class Client(object):
449
409
    """A representation of a client host served by this server.
476
436
    last_checker_status: integer between 0 and 255 reflecting exit
477
437
                         status of last checker. -1 reflects crashed
478
438
                         checker, -2 means no checker completed yet.
479
 
    last_checker_signal: The signal which killed the last checker, if
480
 
                         last_checker_status is -1
481
439
    last_enabled: datetime.datetime(); (UTC) or None
482
440
    name:       string; from the config file, used in log messages and
483
441
                        D-Bus identifiers
496
454
                          "fingerprint", "host", "interval",
497
455
                          "last_approval_request", "last_checked_ok",
498
456
                          "last_enabled", "name", "timeout")
499
 
    client_defaults = {
500
 
        "timeout": "PT5M",
501
 
        "extended_timeout": "PT15M",
502
 
        "interval": "PT2M",
503
 
        "checker": "fping -q -- %%(host)s",
504
 
        "host": "",
505
 
        "approval_delay": "PT0S",
506
 
        "approval_duration": "PT1S",
507
 
        "approved_by_default": "True",
508
 
        "enabled": "True",
509
 
    }
 
457
    client_defaults = { "timeout": "PT5M",
 
458
                        "extended_timeout": "PT15M",
 
459
                        "interval": "PT2M",
 
460
                        "checker": "fping -q -- %%(host)s",
 
461
                        "host": "",
 
462
                        "approval_delay": "PT0S",
 
463
                        "approval_duration": "PT1S",
 
464
                        "approved_by_default": "True",
 
465
                        "enabled": "True",
 
466
                        }
 
467
    
 
468
    def timeout_milliseconds(self):
 
469
        "Return the 'timeout' attribute in milliseconds"
 
470
        return timedelta_to_milliseconds(self.timeout)
 
471
    
 
472
    def extended_timeout_milliseconds(self):
 
473
        "Return the 'extended_timeout' attribute in milliseconds"
 
474
        return timedelta_to_milliseconds(self.extended_timeout)
 
475
    
 
476
    def interval_milliseconds(self):
 
477
        "Return the 'interval' attribute in milliseconds"
 
478
        return timedelta_to_milliseconds(self.interval)
 
479
    
 
480
    def approval_delay_milliseconds(self):
 
481
        return timedelta_to_milliseconds(self.approval_delay)
510
482
    
511
483
    @staticmethod
512
484
    def config_parser(config):
528
500
            client["enabled"] = config.getboolean(client_name,
529
501
                                                  "enabled")
530
502
            
531
 
            # Uppercase and remove spaces from fingerprint for later
532
 
            # comparison purposes with return value from the
533
 
            # fingerprint() function
534
503
            client["fingerprint"] = (section["fingerprint"].upper()
535
504
                                     .replace(" ", ""))
536
505
            if "secret" in section:
541
510
                          "rb") as secfile:
542
511
                    client["secret"] = secfile.read()
543
512
            else:
544
 
                raise TypeError("No secret or secfile for section {}"
 
513
                raise TypeError("No secret or secfile for section {0}"
545
514
                                .format(section))
546
515
            client["timeout"] = string_to_delta(section["timeout"])
547
516
            client["extended_timeout"] = string_to_delta(
564
533
            server_settings = {}
565
534
        self.server_settings = server_settings
566
535
        # adding all client settings
567
 
        for setting, value in settings.items():
 
536
        for setting, value in settings.iteritems():
568
537
            setattr(self, setting, value)
569
538
        
570
539
        if self.enabled:
578
547
            self.expires = None
579
548
        
580
549
        logger.debug("Creating client %r", self.name)
 
550
        # Uppercase and remove spaces from fingerprint for later
 
551
        # comparison purposes with return value from the fingerprint()
 
552
        # function
581
553
        logger.debug("  Fingerprint: %s", self.fingerprint)
582
554
        self.created = settings.get("created",
583
555
                                    datetime.datetime.utcnow())
590
562
        self.current_checker_command = None
591
563
        self.approved = None
592
564
        self.approvals_pending = 0
593
 
        self.changedstate = multiprocessing_manager.Condition(
594
 
            multiprocessing_manager.Lock())
595
 
        self.client_structure = [attr
596
 
                                 for attr in self.__dict__.iterkeys()
 
565
        self.changedstate = (multiprocessing_manager
 
566
                             .Condition(multiprocessing_manager
 
567
                                        .Lock()))
 
568
        self.client_structure = [attr for attr in
 
569
                                 self.__dict__.iterkeys()
597
570
                                 if not attr.startswith("_")]
598
571
        self.client_structure.append("client_structure")
599
572
        
600
 
        for name, t in inspect.getmembers(
601
 
                type(self), lambda obj: isinstance(obj, property)):
 
573
        for name, t in inspect.getmembers(type(self),
 
574
                                          lambda obj:
 
575
                                              isinstance(obj,
 
576
                                                         property)):
602
577
            if not name.startswith("_"):
603
578
                self.client_structure.append(name)
604
579
    
646
621
        # and every interval from then on.
647
622
        if self.checker_initiator_tag is not None:
648
623
            gobject.source_remove(self.checker_initiator_tag)
649
 
        self.checker_initiator_tag = gobject.timeout_add(
650
 
            int(self.interval.total_seconds() * 1000),
651
 
            self.start_checker)
 
624
        self.checker_initiator_tag = (gobject.timeout_add
 
625
                                      (self.interval_milliseconds(),
 
626
                                       self.start_checker))
652
627
        # Schedule a disable() when 'timeout' has passed
653
628
        if self.disable_initiator_tag is not None:
654
629
            gobject.source_remove(self.disable_initiator_tag)
655
 
        self.disable_initiator_tag = gobject.timeout_add(
656
 
            int(self.timeout.total_seconds() * 1000), self.disable)
 
630
        self.disable_initiator_tag = (gobject.timeout_add
 
631
                                   (self.timeout_milliseconds(),
 
632
                                    self.disable))
657
633
        # Also start a new checker *right now*.
658
634
        self.start_checker()
659
635
    
660
 
    def checker_callback(self, source, condition, connection,
661
 
                         command):
 
636
    def checker_callback(self, pid, condition, command):
662
637
        """The checker has completed, so take appropriate actions."""
663
638
        self.checker_callback_tag = None
664
639
        self.checker = None
665
 
        # Read return code from connection (see call_pipe)
666
 
        returncode = connection.recv()
667
 
        connection.close()
668
 
        
669
 
        if returncode >= 0:
670
 
            self.last_checker_status = returncode
671
 
            self.last_checker_signal = None
 
640
        if os.WIFEXITED(condition):
 
641
            self.last_checker_status = os.WEXITSTATUS(condition)
672
642
            if self.last_checker_status == 0:
673
643
                logger.info("Checker for %(name)s succeeded",
674
644
                            vars(self))
675
645
                self.checked_ok()
676
646
            else:
677
 
                logger.info("Checker for %(name)s failed", vars(self))
 
647
                logger.info("Checker for %(name)s failed",
 
648
                            vars(self))
678
649
        else:
679
650
            self.last_checker_status = -1
680
 
            self.last_checker_signal = -returncode
681
651
            logger.warning("Checker for %(name)s crashed?",
682
652
                           vars(self))
683
 
        return False
684
653
    
685
654
    def checked_ok(self):
686
655
        """Assert that the client has been seen, alive and well."""
687
656
        self.last_checked_ok = datetime.datetime.utcnow()
688
657
        self.last_checker_status = 0
689
 
        self.last_checker_signal = None
690
658
        self.bump_timeout()
691
659
    
692
660
    def bump_timeout(self, timeout=None):
697
665
            gobject.source_remove(self.disable_initiator_tag)
698
666
            self.disable_initiator_tag = None
699
667
        if getattr(self, "enabled", False):
700
 
            self.disable_initiator_tag = gobject.timeout_add(
701
 
                int(timeout.total_seconds() * 1000), self.disable)
 
668
            self.disable_initiator_tag = (gobject.timeout_add
 
669
                                          (timedelta_to_milliseconds
 
670
                                           (timeout), self.disable))
702
671
            self.expires = datetime.datetime.utcnow() + timeout
703
672
    
704
673
    def need_approval(self):
718
687
        # than 'timeout' for the client to be disabled, which is as it
719
688
        # should be.
720
689
        
721
 
        if self.checker is not None and not self.checker.is_alive():
722
 
            logger.warning("Checker was not alive; joining")
723
 
            self.checker.join()
724
 
            self.checker = None
 
690
        # If a checker exists, make sure it is not a zombie
 
691
        try:
 
692
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
693
        except AttributeError:
 
694
            pass
 
695
        except OSError as error:
 
696
            if error.errno != errno.ECHILD:
 
697
                raise
 
698
        else:
 
699
            if pid:
 
700
                logger.warning("Checker was a zombie")
 
701
                gobject.source_remove(self.checker_callback_tag)
 
702
                self.checker_callback(pid, status,
 
703
                                      self.current_checker_command)
725
704
        # Start a new checker if needed
726
705
        if self.checker is None:
727
706
            # Escape attributes for the shell
728
 
            escaped_attrs = {
729
 
                attr: re.escape(str(getattr(self, attr)))
730
 
                for attr in self.runtime_expansions }
 
707
            escaped_attrs = dict(
 
708
                (attr, re.escape(unicode(getattr(self, attr))))
 
709
                for attr in
 
710
                self.runtime_expansions)
731
711
            try:
732
712
                command = self.checker_command % escaped_attrs
733
713
            except TypeError as error:
734
714
                logger.error('Could not format string "%s"',
735
 
                             self.checker_command,
 
715
                             self.checker_command, exc_info=error)
 
716
                return True # Try again later
 
717
            self.current_checker_command = command
 
718
            try:
 
719
                logger.info("Starting checker %r for %s",
 
720
                            command, self.name)
 
721
                # We don't need to redirect stdout and stderr, since
 
722
                # in normal mode, that is already done by daemon(),
 
723
                # and in debug mode we don't want to.  (Stdin is
 
724
                # always replaced by /dev/null.)
 
725
                # The exception is when not debugging but nevertheless
 
726
                # running in the foreground; use the previously
 
727
                # created wnull.
 
728
                popen_args = {}
 
729
                if (not self.server_settings["debug"]
 
730
                    and self.server_settings["foreground"]):
 
731
                    popen_args.update({"stdout": wnull,
 
732
                                       "stderr": wnull })
 
733
                self.checker = subprocess.Popen(command,
 
734
                                                close_fds=True,
 
735
                                                shell=True, cwd="/",
 
736
                                                **popen_args)
 
737
            except OSError as error:
 
738
                logger.error("Failed to start subprocess",
736
739
                             exc_info=error)
737
 
                return True     # Try again later
738
 
            self.current_checker_command = command
739
 
            logger.info("Starting checker %r for %s", command,
740
 
                        self.name)
741
 
            # We don't need to redirect stdout and stderr, since
742
 
            # in normal mode, that is already done by daemon(),
743
 
            # and in debug mode we don't want to.  (Stdin is
744
 
            # always replaced by /dev/null.)
745
 
            # The exception is when not debugging but nevertheless
746
 
            # running in the foreground; use the previously
747
 
            # created wnull.
748
 
            popen_args = { "close_fds": True,
749
 
                           "shell": True,
750
 
                           "cwd": "/" }
751
 
            if (not self.server_settings["debug"]
752
 
                and self.server_settings["foreground"]):
753
 
                popen_args.update({"stdout": wnull,
754
 
                                   "stderr": wnull })
755
 
            pipe = multiprocessing.Pipe(duplex = False)
756
 
            self.checker = multiprocessing.Process(
757
 
                target = call_pipe,
758
 
                args = (pipe[1], subprocess.call, command),
759
 
                kwargs = popen_args)
760
 
            self.checker.start()
761
 
            self.checker_callback_tag = gobject.io_add_watch(
762
 
                pipe[0].fileno(), gobject.IO_IN,
763
 
                self.checker_callback, pipe[0], command)
 
740
                return True
 
741
            self.checker_callback_tag = (gobject.child_watch_add
 
742
                                         (self.checker.pid,
 
743
                                          self.checker_callback,
 
744
                                          data=command))
 
745
            # The checker may have completed before the gobject
 
746
            # watch was added.  Check for this.
 
747
            try:
 
748
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
749
            except OSError as error:
 
750
                if error.errno == errno.ECHILD:
 
751
                    # This should never happen
 
752
                    logger.error("Child process vanished",
 
753
                                 exc_info=error)
 
754
                    return True
 
755
                raise
 
756
            if pid:
 
757
                gobject.source_remove(self.checker_callback_tag)
 
758
                self.checker_callback(pid, status, command)
764
759
        # Re-run this periodically if run by gobject.timeout_add
765
760
        return True
766
761
    
772
767
        if getattr(self, "checker", None) is None:
773
768
            return
774
769
        logger.debug("Stopping checker for %(name)s", vars(self))
775
 
        self.checker.terminate()
 
770
        try:
 
771
            self.checker.terminate()
 
772
            #time.sleep(0.5)
 
773
            #if self.checker.poll() is None:
 
774
            #    self.checker.kill()
 
775
        except OSError as error:
 
776
            if error.errno != errno.ESRCH: # No such process
 
777
                raise
776
778
        self.checker = None
777
779
 
778
780
 
779
 
def dbus_service_property(dbus_interface,
780
 
                          signature="v",
781
 
                          access="readwrite",
782
 
                          byte_arrays=False):
 
781
def dbus_service_property(dbus_interface, signature="v",
 
782
                          access="readwrite", byte_arrays=False):
783
783
    """Decorators for marking methods of a DBusObjectWithProperties to
784
784
    become properties on the D-Bus.
785
785
    
794
794
    # "Set" method, so we fail early here:
795
795
    if byte_arrays and signature != "ay":
796
796
        raise ValueError("Byte arrays not supported for non-'ay'"
797
 
                         " signature {!r}".format(signature))
798
 
    
 
797
                         " signature {0!r}".format(signature))
799
798
    def decorator(func):
800
799
        func._dbus_is_property = True
801
800
        func._dbus_interface = dbus_interface
806
805
            func._dbus_name = func._dbus_name[:-14]
807
806
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
808
807
        return func
809
 
    
810
808
    return decorator
811
809
 
812
810
 
821
819
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
822
820
                    "false"}
823
821
    """
824
 
    
825
822
    def decorator(func):
826
823
        func._dbus_is_interface = True
827
824
        func._dbus_interface = dbus_interface
828
825
        func._dbus_name = dbus_interface
829
826
        return func
830
 
    
831
827
    return decorator
832
828
 
833
829
 
835
831
    """Decorator to annotate D-Bus methods, signals or properties
836
832
    Usage:
837
833
    
838
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
 
                       "org.freedesktop.DBus.Property."
840
 
                       "EmitsChangedSignal": "false"})
841
834
    @dbus_service_property("org.example.Interface", signature="b",
842
835
                           access="r")
 
836
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
837
                        "org.freedesktop.DBus.Property."
 
838
                        "EmitsChangedSignal": "false"})
843
839
    def Property_dbus_property(self):
844
840
        return dbus.Boolean(False)
845
841
    """
846
 
    
847
842
    def decorator(func):
848
843
        func._dbus_annotations = annotations
849
844
        return func
850
 
    
851
845
    return decorator
852
846
 
853
847
 
854
848
class DBusPropertyException(dbus.exceptions.DBusException):
855
849
    """A base class for D-Bus property-related exceptions
856
850
    """
857
 
    pass
 
851
    def __unicode__(self):
 
852
        return unicode(str(self))
858
853
 
859
854
 
860
855
class DBusPropertyAccessException(DBusPropertyException):
884
879
        If called like _is_dbus_thing("method") it returns a function
885
880
        suitable for use as predicate to inspect.getmembers().
886
881
        """
887
 
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
 
882
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
888
883
                                   False)
889
884
    
890
885
    def _get_all_dbus_things(self, thing):
891
886
        """Returns a generator of (name, attribute) pairs
892
887
        """
893
 
        return ((getattr(athing.__get__(self), "_dbus_name", name),
 
888
        return ((getattr(athing.__get__(self), "_dbus_name",
 
889
                         name),
894
890
                 athing.__get__(self))
895
891
                for cls in self.__class__.__mro__
896
892
                for name, athing in
897
 
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
893
                inspect.getmembers(cls,
 
894
                                   self._is_dbus_thing(thing)))
898
895
    
899
896
    def _get_dbus_property(self, interface_name, property_name):
900
897
        """Returns a bound method if one exists which is a D-Bus
901
898
        property with the specified name and interface.
902
899
        """
903
 
        for cls in self.__class__.__mro__:
904
 
            for name, value in inspect.getmembers(
905
 
                    cls, self._is_dbus_thing("property")):
 
900
        for cls in  self.__class__.__mro__:
 
901
            for name, value in (inspect.getmembers
 
902
                                (cls,
 
903
                                 self._is_dbus_thing("property"))):
906
904
                if (value._dbus_name == property_name
907
905
                    and value._dbus_interface == interface_name):
908
906
                    return value.__get__(self)
909
907
        
910
908
        # No such property
911
 
        raise DBusPropertyNotFound("{}:{}.{}".format(
912
 
            self.dbus_object_path, interface_name, property_name))
 
909
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
910
                                   + interface_name + "."
 
911
                                   + property_name)
913
912
    
914
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
915
 
                         in_signature="ss",
 
913
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
916
914
                         out_signature="v")
917
915
    def Get(self, interface_name, property_name):
918
916
        """Standard D-Bus property Get() method, see D-Bus standard.
937
935
            # signatures other than "ay".
938
936
            if prop._dbus_signature != "ay":
939
937
                raise ValueError("Byte arrays not supported for non-"
940
 
                                 "'ay' signature {!r}"
 
938
                                 "'ay' signature {0!r}"
941
939
                                 .format(prop._dbus_signature))
942
940
            value = dbus.ByteArray(b''.join(chr(byte)
943
941
                                            for byte in value))
944
942
        prop(value)
945
943
    
946
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
947
 
                         in_signature="s",
 
944
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
948
945
                         out_signature="a{sv}")
949
946
    def GetAll(self, interface_name):
950
947
        """Standard D-Bus property GetAll() method, see D-Bus
965
962
            if not hasattr(value, "variant_level"):
966
963
                properties[name] = value
967
964
                continue
968
 
            properties[name] = type(value)(
969
 
                value, variant_level = value.variant_level + 1)
 
965
            properties[name] = type(value)(value, variant_level=
 
966
                                           value.variant_level+1)
970
967
        return dbus.Dictionary(properties, signature="sv")
971
968
    
972
 
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
 
    def PropertiesChanged(self, interface_name, changed_properties,
974
 
                          invalidated_properties):
975
 
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
976
 
        standard.
977
 
        """
978
 
        pass
979
 
    
980
969
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
981
970
                         out_signature="s",
982
971
                         path_keyword='object_path',
990
979
                                                   connection)
991
980
        try:
992
981
            document = xml.dom.minidom.parseString(xmlstring)
993
 
            
994
982
            def make_tag(document, name, prop):
995
983
                e = document.createElement("property")
996
984
                e.setAttribute("name", name)
997
985
                e.setAttribute("type", prop._dbus_signature)
998
986
                e.setAttribute("access", prop._dbus_access)
999
987
                return e
1000
 
            
1001
988
            for if_tag in document.getElementsByTagName("interface"):
1002
989
                # Add property tags
1003
990
                for tag in (make_tag(document, name, prop)
1015
1002
                            if (name == tag.getAttribute("name")
1016
1003
                                and prop._dbus_interface
1017
1004
                                == if_tag.getAttribute("name")):
1018
 
                                annots.update(getattr(
1019
 
                                    prop, "_dbus_annotations", {}))
1020
 
                        for name, value in annots.items():
 
1005
                                annots.update(getattr
 
1006
                                              (prop,
 
1007
                                               "_dbus_annotations",
 
1008
                                               {}))
 
1009
                        for name, value in annots.iteritems():
1021
1010
                            ann_tag = document.createElement(
1022
1011
                                "annotation")
1023
1012
                            ann_tag.setAttribute("name", name)
1026
1015
                # Add interface annotation tags
1027
1016
                for annotation, value in dict(
1028
1017
                    itertools.chain.from_iterable(
1029
 
                        annotations().items()
1030
 
                        for name, annotations
1031
 
                        in self._get_all_dbus_things("interface")
 
1018
                        annotations().iteritems()
 
1019
                        for name, annotations in
 
1020
                        self._get_all_dbus_things("interface")
1032
1021
                        if name == if_tag.getAttribute("name")
1033
 
                        )).items():
 
1022
                        )).iteritems():
1034
1023
                    ann_tag = document.createElement("annotation")
1035
1024
                    ann_tag.setAttribute("name", annotation)
1036
1025
                    ann_tag.setAttribute("value", value)
1063
1052
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1064
1053
    if dt is None:
1065
1054
        return dbus.String("", variant_level = variant_level)
1066
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
 
1055
    return dbus.String(dt.isoformat(),
 
1056
                       variant_level=variant_level)
1067
1057
 
1068
1058
 
1069
1059
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1089
1079
    (from DBusObjectWithProperties) and interfaces (from the
1090
1080
    dbus_interface_annotations decorator).
1091
1081
    """
1092
 
    
1093
1082
    def wrapper(cls):
1094
1083
        for orig_interface_name, alt_interface_name in (
1095
 
                alt_interface_names.items()):
 
1084
            alt_interface_names.iteritems()):
1096
1085
            attr = {}
1097
1086
            interface_names = set()
1098
1087
            # Go though all attributes of the class
1100
1089
                # Ignore non-D-Bus attributes, and D-Bus attributes
1101
1090
                # with the wrong interface name
1102
1091
                if (not hasattr(attribute, "_dbus_interface")
1103
 
                    or not attribute._dbus_interface.startswith(
1104
 
                        orig_interface_name)):
 
1092
                    or not attribute._dbus_interface
 
1093
                    .startswith(orig_interface_name)):
1105
1094
                    continue
1106
1095
                # Create an alternate D-Bus interface name based on
1107
1096
                # the current name
1108
 
                alt_interface = attribute._dbus_interface.replace(
1109
 
                    orig_interface_name, alt_interface_name)
 
1097
                alt_interface = (attribute._dbus_interface
 
1098
                                 .replace(orig_interface_name,
 
1099
                                          alt_interface_name))
1110
1100
                interface_names.add(alt_interface)
1111
1101
                # Is this a D-Bus signal?
1112
1102
                if getattr(attribute, "_dbus_is_signal", False):
1113
 
                    if sys.version_info.major == 2:
1114
 
                        # Extract the original non-method undecorated
1115
 
                        # function by black magic
1116
 
                        nonmethod_func = (dict(
 
1103
                    # Extract the original non-method undecorated
 
1104
                    # function by black magic
 
1105
                    nonmethod_func = (dict(
1117
1106
                            zip(attribute.func_code.co_freevars,
1118
 
                                attribute.__closure__))
1119
 
                                          ["func"].cell_contents)
1120
 
                    else:
1121
 
                        nonmethod_func = attribute
 
1107
                                attribute.__closure__))["func"]
 
1108
                                      .cell_contents)
1122
1109
                    # Create a new, but exactly alike, function
1123
1110
                    # object, and decorate it to be a new D-Bus signal
1124
1111
                    # with the alternate D-Bus interface name
1125
 
                    if sys.version_info.major == 2:
1126
 
                        new_function = types.FunctionType(
1127
 
                            nonmethod_func.func_code,
1128
 
                            nonmethod_func.func_globals,
1129
 
                            nonmethod_func.func_name,
1130
 
                            nonmethod_func.func_defaults,
1131
 
                            nonmethod_func.func_closure)
1132
 
                    else:
1133
 
                        new_function = types.FunctionType(
1134
 
                            nonmethod_func.__code__,
1135
 
                            nonmethod_func.__globals__,
1136
 
                            nonmethod_func.__name__,
1137
 
                            nonmethod_func.__defaults__,
1138
 
                            nonmethod_func.__closure__)
1139
 
                    new_function = (dbus.service.signal(
1140
 
                        alt_interface,
1141
 
                        attribute._dbus_signature)(new_function))
 
1112
                    new_function = (dbus.service.signal
 
1113
                                    (alt_interface,
 
1114
                                     attribute._dbus_signature)
 
1115
                                    (types.FunctionType(
 
1116
                                nonmethod_func.func_code,
 
1117
                                nonmethod_func.func_globals,
 
1118
                                nonmethod_func.func_name,
 
1119
                                nonmethod_func.func_defaults,
 
1120
                                nonmethod_func.func_closure)))
1142
1121
                    # Copy annotations, if any
1143
1122
                    try:
1144
 
                        new_function._dbus_annotations = dict(
1145
 
                            attribute._dbus_annotations)
 
1123
                        new_function._dbus_annotations = (
 
1124
                            dict(attribute._dbus_annotations))
1146
1125
                    except AttributeError:
1147
1126
                        pass
1148
1127
                    # Define a creator of a function to call both the
1153
1132
                        """This function is a scope container to pass
1154
1133
                        func1 and func2 to the "call_both" function
1155
1134
                        outside of its arguments"""
1156
 
                        
1157
1135
                        def call_both(*args, **kwargs):
1158
1136
                            """This function will emit two D-Bus
1159
1137
                            signals by calling func1 and func2"""
1160
1138
                            func1(*args, **kwargs)
1161
1139
                            func2(*args, **kwargs)
1162
 
                        
1163
1140
                        return call_both
1164
1141
                    # Create the "call_both" function and add it to
1165
1142
                    # the class
1170
1147
                    # object.  Decorate it to be a new D-Bus method
1171
1148
                    # with the alternate D-Bus interface name.  Add it
1172
1149
                    # to the class.
1173
 
                    attr[attrname] = (
1174
 
                        dbus.service.method(
1175
 
                            alt_interface,
1176
 
                            attribute._dbus_in_signature,
1177
 
                            attribute._dbus_out_signature)
1178
 
                        (types.FunctionType(attribute.func_code,
1179
 
                                            attribute.func_globals,
1180
 
                                            attribute.func_name,
1181
 
                                            attribute.func_defaults,
1182
 
                                            attribute.func_closure)))
 
1150
                    attr[attrname] = (dbus.service.method
 
1151
                                      (alt_interface,
 
1152
                                       attribute._dbus_in_signature,
 
1153
                                       attribute._dbus_out_signature)
 
1154
                                      (types.FunctionType
 
1155
                                       (attribute.func_code,
 
1156
                                        attribute.func_globals,
 
1157
                                        attribute.func_name,
 
1158
                                        attribute.func_defaults,
 
1159
                                        attribute.func_closure)))
1183
1160
                    # Copy annotations, if any
1184
1161
                    try:
1185
 
                        attr[attrname]._dbus_annotations = dict(
1186
 
                            attribute._dbus_annotations)
 
1162
                        attr[attrname]._dbus_annotations = (
 
1163
                            dict(attribute._dbus_annotations))
1187
1164
                    except AttributeError:
1188
1165
                        pass
1189
1166
                # Is this a D-Bus property?
1192
1169
                    # object, and decorate it to be a new D-Bus
1193
1170
                    # property with the alternate D-Bus interface
1194
1171
                    # name.  Add it to the class.
1195
 
                    attr[attrname] = (dbus_service_property(
1196
 
                        alt_interface, attribute._dbus_signature,
1197
 
                        attribute._dbus_access,
1198
 
                        attribute._dbus_get_args_options
1199
 
                        ["byte_arrays"])
1200
 
                                      (types.FunctionType(
1201
 
                                          attribute.func_code,
1202
 
                                          attribute.func_globals,
1203
 
                                          attribute.func_name,
1204
 
                                          attribute.func_defaults,
1205
 
                                          attribute.func_closure)))
 
1172
                    attr[attrname] = (dbus_service_property
 
1173
                                      (alt_interface,
 
1174
                                       attribute._dbus_signature,
 
1175
                                       attribute._dbus_access,
 
1176
                                       attribute
 
1177
                                       ._dbus_get_args_options
 
1178
                                       ["byte_arrays"])
 
1179
                                      (types.FunctionType
 
1180
                                       (attribute.func_code,
 
1181
                                        attribute.func_globals,
 
1182
                                        attribute.func_name,
 
1183
                                        attribute.func_defaults,
 
1184
                                        attribute.func_closure)))
1206
1185
                    # Copy annotations, if any
1207
1186
                    try:
1208
 
                        attr[attrname]._dbus_annotations = dict(
1209
 
                            attribute._dbus_annotations)
 
1187
                        attr[attrname]._dbus_annotations = (
 
1188
                            dict(attribute._dbus_annotations))
1210
1189
                    except AttributeError:
1211
1190
                        pass
1212
1191
                # Is this a D-Bus interface?
1215
1194
                    # object.  Decorate it to be a new D-Bus interface
1216
1195
                    # with the alternate D-Bus interface name.  Add it
1217
1196
                    # to the class.
1218
 
                    attr[attrname] = (
1219
 
                        dbus_interface_annotations(alt_interface)
1220
 
                        (types.FunctionType(attribute.func_code,
1221
 
                                            attribute.func_globals,
1222
 
                                            attribute.func_name,
1223
 
                                            attribute.func_defaults,
1224
 
                                            attribute.func_closure)))
 
1197
                    attr[attrname] = (dbus_interface_annotations
 
1198
                                      (alt_interface)
 
1199
                                      (types.FunctionType
 
1200
                                       (attribute.func_code,
 
1201
                                        attribute.func_globals,
 
1202
                                        attribute.func_name,
 
1203
                                        attribute.func_defaults,
 
1204
                                        attribute.func_closure)))
1225
1205
            if deprecate:
1226
1206
                # Deprecate all alternate interfaces
1227
 
                iname="_AlternateDBusNames_interface_annotation{}"
 
1207
                iname="_AlternateDBusNames_interface_annotation{0}"
1228
1208
                for interface_name in interface_names:
1229
 
                    
1230
1209
                    @dbus_interface_annotations(interface_name)
1231
1210
                    def func(self):
1232
1211
                        return { "org.freedesktop.DBus.Deprecated":
1233
 
                                 "true" }
 
1212
                                     "true" }
1234
1213
                    # Find an unused name
1235
1214
                    for aname in (iname.format(i)
1236
1215
                                  for i in itertools.count()):
1240
1219
            if interface_names:
1241
1220
                # Replace the class with a new subclass of it with
1242
1221
                # methods, signals, etc. as created above.
1243
 
                cls = type(b"{}Alternate".format(cls.__name__),
1244
 
                           (cls, ), attr)
 
1222
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1223
                           (cls,), attr)
1245
1224
        return cls
1246
 
    
1247
1225
    return wrapper
1248
1226
 
1249
1227
 
1250
1228
@alternate_dbus_interfaces({"se.recompile.Mandos":
1251
 
                            "se.bsnet.fukt.Mandos"})
 
1229
                                "se.bsnet.fukt.Mandos"})
1252
1230
class ClientDBus(Client, DBusObjectWithProperties):
1253
1231
    """A Client class using D-Bus
1254
1232
    
1258
1236
    """
1259
1237
    
1260
1238
    runtime_expansions = (Client.runtime_expansions
1261
 
                          + ("dbus_object_path", ))
1262
 
    
1263
 
    _interface = "se.recompile.Mandos.Client"
 
1239
                          + ("dbus_object_path",))
1264
1240
    
1265
1241
    # dbus.service.Object doesn't use super(), so we can't either.
1266
1242
    
1269
1245
        Client.__init__(self, *args, **kwargs)
1270
1246
        # Only now, when this client is initialized, can it show up on
1271
1247
        # the D-Bus
1272
 
        client_object_name = str(self.name).translate(
 
1248
        client_object_name = unicode(self.name).translate(
1273
1249
            {ord("."): ord("_"),
1274
1250
             ord("-"): ord("_")})
1275
 
        self.dbus_object_path = dbus.ObjectPath(
1276
 
            "/clients/" + client_object_name)
 
1251
        self.dbus_object_path = (dbus.ObjectPath
 
1252
                                 ("/clients/" + client_object_name))
1277
1253
        DBusObjectWithProperties.__init__(self, self.bus,
1278
1254
                                          self.dbus_object_path)
1279
1255
    
1280
 
    def notifychangeproperty(transform_func, dbus_name,
1281
 
                             type_func=lambda x: x,
1282
 
                             variant_level=1,
1283
 
                             invalidate_only=False,
1284
 
                             _interface=_interface):
 
1256
    def notifychangeproperty(transform_func,
 
1257
                             dbus_name, type_func=lambda x: x,
 
1258
                             variant_level=1):
1285
1259
        """ Modify a variable so that it's a property which announces
1286
1260
        its changes to DBus.
1287
1261
        
1292
1266
                   to the D-Bus.  Default: no transform
1293
1267
        variant_level: D-Bus variant level.  Default: 1
1294
1268
        """
1295
 
        attrname = "_{}".format(dbus_name)
1296
 
        
 
1269
        attrname = "_{0}".format(dbus_name)
1297
1270
        def setter(self, value):
1298
1271
            if hasattr(self, "dbus_object_path"):
1299
1272
                if (not hasattr(self, attrname) or
1300
1273
                    type_func(getattr(self, attrname, None))
1301
1274
                    != type_func(value)):
1302
 
                    if invalidate_only:
1303
 
                        self.PropertiesChanged(
1304
 
                            _interface, dbus.Dictionary(),
1305
 
                            dbus.Array((dbus_name, )))
1306
 
                    else:
1307
 
                        dbus_value = transform_func(
1308
 
                            type_func(value),
1309
 
                            variant_level = variant_level)
1310
 
                        self.PropertyChanged(dbus.String(dbus_name),
1311
 
                                             dbus_value)
1312
 
                        self.PropertiesChanged(
1313
 
                            _interface,
1314
 
                            dbus.Dictionary({ dbus.String(dbus_name):
1315
 
                                              dbus_value }),
1316
 
                            dbus.Array())
 
1275
                    dbus_value = transform_func(type_func(value),
 
1276
                                                variant_level
 
1277
                                                =variant_level)
 
1278
                    self.PropertyChanged(dbus.String(dbus_name),
 
1279
                                         dbus_value)
1317
1280
            setattr(self, attrname, value)
1318
1281
        
1319
1282
        return property(lambda self: getattr(self, attrname), setter)
1325
1288
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1326
1289
    last_enabled = notifychangeproperty(datetime_to_dbus,
1327
1290
                                        "LastEnabled")
1328
 
    checker = notifychangeproperty(
1329
 
        dbus.Boolean, "CheckerRunning",
1330
 
        type_func = lambda checker: checker is not None)
 
1291
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1292
                                   type_func = lambda checker:
 
1293
                                       checker is not None)
1331
1294
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1332
1295
                                           "LastCheckedOK")
1333
1296
    last_checker_status = notifychangeproperty(dbus.Int16,
1336
1299
        datetime_to_dbus, "LastApprovalRequest")
1337
1300
    approved_by_default = notifychangeproperty(dbus.Boolean,
1338
1301
                                               "ApprovedByDefault")
1339
 
    approval_delay = notifychangeproperty(
1340
 
        dbus.UInt64, "ApprovalDelay",
1341
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1302
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1303
                                          "ApprovalDelay",
 
1304
                                          type_func =
 
1305
                                          timedelta_to_milliseconds)
1342
1306
    approval_duration = notifychangeproperty(
1343
1307
        dbus.UInt64, "ApprovalDuration",
1344
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1308
        type_func = timedelta_to_milliseconds)
1345
1309
    host = notifychangeproperty(dbus.String, "Host")
1346
 
    timeout = notifychangeproperty(
1347
 
        dbus.UInt64, "Timeout",
1348
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1310
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1311
                                   type_func =
 
1312
                                   timedelta_to_milliseconds)
1349
1313
    extended_timeout = notifychangeproperty(
1350
1314
        dbus.UInt64, "ExtendedTimeout",
1351
 
        type_func = lambda td: td.total_seconds() * 1000)
1352
 
    interval = notifychangeproperty(
1353
 
        dbus.UInt64, "Interval",
1354
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1315
        type_func = timedelta_to_milliseconds)
 
1316
    interval = notifychangeproperty(dbus.UInt64,
 
1317
                                    "Interval",
 
1318
                                    type_func =
 
1319
                                    timedelta_to_milliseconds)
1355
1320
    checker_command = notifychangeproperty(dbus.String, "Checker")
1356
 
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1357
 
                                  invalidate_only=True)
1358
1321
    
1359
1322
    del notifychangeproperty
1360
1323
    
1367
1330
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1368
1331
        Client.__del__(self, *args, **kwargs)
1369
1332
    
1370
 
    def checker_callback(self, source, condition,
1371
 
                         connection, command, *args, **kwargs):
1372
 
        ret = Client.checker_callback(self, source, condition,
1373
 
                                      connection, command, *args,
1374
 
                                      **kwargs)
1375
 
        exitstatus = self.last_checker_status
1376
 
        if exitstatus >= 0:
 
1333
    def checker_callback(self, pid, condition, command,
 
1334
                         *args, **kwargs):
 
1335
        self.checker_callback_tag = None
 
1336
        self.checker = None
 
1337
        if os.WIFEXITED(condition):
 
1338
            exitstatus = os.WEXITSTATUS(condition)
1377
1339
            # Emit D-Bus signal
1378
1340
            self.CheckerCompleted(dbus.Int16(exitstatus),
1379
 
                                  dbus.Int64(0),
 
1341
                                  dbus.Int64(condition),
1380
1342
                                  dbus.String(command))
1381
1343
        else:
1382
1344
            # Emit D-Bus signal
1383
1345
            self.CheckerCompleted(dbus.Int16(-1),
1384
 
                                  dbus.Int64(
1385
 
                                      self.last_checker_signal),
 
1346
                                  dbus.Int64(condition),
1386
1347
                                  dbus.String(command))
1387
 
        return ret
 
1348
        
 
1349
        return Client.checker_callback(self, pid, condition, command,
 
1350
                                       *args, **kwargs)
1388
1351
    
1389
1352
    def start_checker(self, *args, **kwargs):
1390
 
        old_checker_pid = getattr(self.checker, "pid", None)
 
1353
        old_checker = self.checker
 
1354
        if self.checker is not None:
 
1355
            old_checker_pid = self.checker.pid
 
1356
        else:
 
1357
            old_checker_pid = None
1391
1358
        r = Client.start_checker(self, *args, **kwargs)
1392
1359
        # Only if new checker process was started
1393
1360
        if (self.checker is not None
1402
1369
    
1403
1370
    def approve(self, value=True):
1404
1371
        self.approved = value
1405
 
        gobject.timeout_add(int(self.approval_duration.total_seconds()
1406
 
                                * 1000), self._reset_approved)
 
1372
        gobject.timeout_add(timedelta_to_milliseconds
 
1373
                            (self.approval_duration),
 
1374
                            self._reset_approved)
1407
1375
        self.send_changedstate()
1408
1376
    
1409
1377
    ## D-Bus methods, signals & properties
 
1378
    _interface = "se.recompile.Mandos.Client"
1410
1379
    
1411
1380
    ## Interfaces
1412
1381
    
 
1382
    @dbus_interface_annotations(_interface)
 
1383
    def _foo(self):
 
1384
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1385
                     "false"}
 
1386
    
1413
1387
    ## Signals
1414
1388
    
1415
1389
    # CheckerCompleted - signal
1425
1399
        pass
1426
1400
    
1427
1401
    # PropertyChanged - signal
1428
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1429
1402
    @dbus.service.signal(_interface, signature="sv")
1430
1403
    def PropertyChanged(self, property, value):
1431
1404
        "D-Bus signal"
1495
1468
        return dbus.Boolean(bool(self.approvals_pending))
1496
1469
    
1497
1470
    # ApprovedByDefault - property
1498
 
    @dbus_service_property(_interface,
1499
 
                           signature="b",
 
1471
    @dbus_service_property(_interface, signature="b",
1500
1472
                           access="readwrite")
1501
1473
    def ApprovedByDefault_dbus_property(self, value=None):
1502
1474
        if value is None:       # get
1504
1476
        self.approved_by_default = bool(value)
1505
1477
    
1506
1478
    # ApprovalDelay - property
1507
 
    @dbus_service_property(_interface,
1508
 
                           signature="t",
 
1479
    @dbus_service_property(_interface, signature="t",
1509
1480
                           access="readwrite")
1510
1481
    def ApprovalDelay_dbus_property(self, value=None):
1511
1482
        if value is None:       # get
1512
 
            return dbus.UInt64(self.approval_delay.total_seconds()
1513
 
                               * 1000)
 
1483
            return dbus.UInt64(self.approval_delay_milliseconds())
1514
1484
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1515
1485
    
1516
1486
    # ApprovalDuration - property
1517
 
    @dbus_service_property(_interface,
1518
 
                           signature="t",
 
1487
    @dbus_service_property(_interface, signature="t",
1519
1488
                           access="readwrite")
1520
1489
    def ApprovalDuration_dbus_property(self, value=None):
1521
1490
        if value is None:       # get
1522
 
            return dbus.UInt64(self.approval_duration.total_seconds()
1523
 
                               * 1000)
 
1491
            return dbus.UInt64(timedelta_to_milliseconds(
 
1492
                    self.approval_duration))
1524
1493
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1525
1494
    
1526
1495
    # Name - property
1534
1503
        return dbus.String(self.fingerprint)
1535
1504
    
1536
1505
    # Host - property
1537
 
    @dbus_service_property(_interface,
1538
 
                           signature="s",
 
1506
    @dbus_service_property(_interface, signature="s",
1539
1507
                           access="readwrite")
1540
1508
    def Host_dbus_property(self, value=None):
1541
1509
        if value is None:       # get
1542
1510
            return dbus.String(self.host)
1543
 
        self.host = str(value)
 
1511
        self.host = unicode(value)
1544
1512
    
1545
1513
    # Created - property
1546
1514
    @dbus_service_property(_interface, signature="s", access="read")
1553
1521
        return datetime_to_dbus(self.last_enabled)
1554
1522
    
1555
1523
    # Enabled - property
1556
 
    @dbus_service_property(_interface,
1557
 
                           signature="b",
 
1524
    @dbus_service_property(_interface, signature="b",
1558
1525
                           access="readwrite")
1559
1526
    def Enabled_dbus_property(self, value=None):
1560
1527
        if value is None:       # get
1565
1532
            self.disable()
1566
1533
    
1567
1534
    # LastCheckedOK - property
1568
 
    @dbus_service_property(_interface,
1569
 
                           signature="s",
 
1535
    @dbus_service_property(_interface, signature="s",
1570
1536
                           access="readwrite")
1571
1537
    def LastCheckedOK_dbus_property(self, value=None):
1572
1538
        if value is not None:
1575
1541
        return datetime_to_dbus(self.last_checked_ok)
1576
1542
    
1577
1543
    # LastCheckerStatus - property
1578
 
    @dbus_service_property(_interface, signature="n", access="read")
 
1544
    @dbus_service_property(_interface, signature="n",
 
1545
                           access="read")
1579
1546
    def LastCheckerStatus_dbus_property(self):
1580
1547
        return dbus.Int16(self.last_checker_status)
1581
1548
    
1590
1557
        return datetime_to_dbus(self.last_approval_request)
1591
1558
    
1592
1559
    # Timeout - property
1593
 
    @dbus_service_property(_interface,
1594
 
                           signature="t",
 
1560
    @dbus_service_property(_interface, signature="t",
1595
1561
                           access="readwrite")
1596
1562
    def Timeout_dbus_property(self, value=None):
1597
1563
        if value is None:       # get
1598
 
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
 
1564
            return dbus.UInt64(self.timeout_milliseconds())
1599
1565
        old_timeout = self.timeout
1600
1566
        self.timeout = datetime.timedelta(0, 0, 0, value)
1601
1567
        # Reschedule disabling
1610
1576
                    is None):
1611
1577
                    return
1612
1578
                gobject.source_remove(self.disable_initiator_tag)
1613
 
                self.disable_initiator_tag = gobject.timeout_add(
1614
 
                    int((self.expires - now).total_seconds() * 1000),
1615
 
                    self.disable)
 
1579
                self.disable_initiator_tag = (
 
1580
                    gobject.timeout_add(
 
1581
                        timedelta_to_milliseconds(self.expires - now),
 
1582
                        self.disable))
1616
1583
    
1617
1584
    # ExtendedTimeout - property
1618
 
    @dbus_service_property(_interface,
1619
 
                           signature="t",
 
1585
    @dbus_service_property(_interface, signature="t",
1620
1586
                           access="readwrite")
1621
1587
    def ExtendedTimeout_dbus_property(self, value=None):
1622
1588
        if value is None:       # get
1623
 
            return dbus.UInt64(self.extended_timeout.total_seconds()
1624
 
                               * 1000)
 
1589
            return dbus.UInt64(self.extended_timeout_milliseconds())
1625
1590
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1626
1591
    
1627
1592
    # Interval - property
1628
 
    @dbus_service_property(_interface,
1629
 
                           signature="t",
 
1593
    @dbus_service_property(_interface, signature="t",
1630
1594
                           access="readwrite")
1631
1595
    def Interval_dbus_property(self, value=None):
1632
1596
        if value is None:       # get
1633
 
            return dbus.UInt64(self.interval.total_seconds() * 1000)
 
1597
            return dbus.UInt64(self.interval_milliseconds())
1634
1598
        self.interval = datetime.timedelta(0, 0, 0, value)
1635
1599
        if getattr(self, "checker_initiator_tag", None) is None:
1636
1600
            return
1637
1601
        if self.enabled:
1638
1602
            # Reschedule checker run
1639
1603
            gobject.source_remove(self.checker_initiator_tag)
1640
 
            self.checker_initiator_tag = gobject.timeout_add(
1641
 
                value, self.start_checker)
1642
 
            self.start_checker() # Start one now, too
 
1604
            self.checker_initiator_tag = (gobject.timeout_add
 
1605
                                          (value, self.start_checker))
 
1606
            self.start_checker()    # Start one now, too
1643
1607
    
1644
1608
    # Checker - property
1645
 
    @dbus_service_property(_interface,
1646
 
                           signature="s",
 
1609
    @dbus_service_property(_interface, signature="s",
1647
1610
                           access="readwrite")
1648
1611
    def Checker_dbus_property(self, value=None):
1649
1612
        if value is None:       # get
1650
1613
            return dbus.String(self.checker_command)
1651
 
        self.checker_command = str(value)
 
1614
        self.checker_command = unicode(value)
1652
1615
    
1653
1616
    # CheckerRunning - property
1654
 
    @dbus_service_property(_interface,
1655
 
                           signature="b",
 
1617
    @dbus_service_property(_interface, signature="b",
1656
1618
                           access="readwrite")
1657
1619
    def CheckerRunning_dbus_property(self, value=None):
1658
1620
        if value is None:       # get
1668
1630
        return self.dbus_object_path # is already a dbus.ObjectPath
1669
1631
    
1670
1632
    # Secret = property
1671
 
    @dbus_service_property(_interface,
1672
 
                           signature="ay",
1673
 
                           access="write",
1674
 
                           byte_arrays=True)
 
1633
    @dbus_service_property(_interface, signature="ay",
 
1634
                           access="write", byte_arrays=True)
1675
1635
    def Secret_dbus_property(self, value):
1676
 
        self.secret = bytes(value)
 
1636
        self.secret = str(value)
1677
1637
    
1678
1638
    del _interface
1679
1639
 
1683
1643
        self._pipe = child_pipe
1684
1644
        self._pipe.send(('init', fpr, address))
1685
1645
        if not self._pipe.recv():
1686
 
            raise KeyError(fpr)
 
1646
            raise KeyError()
1687
1647
    
1688
1648
    def __getattribute__(self, name):
1689
1649
        if name == '_pipe':
1693
1653
        if data[0] == 'data':
1694
1654
            return data[1]
1695
1655
        if data[0] == 'function':
1696
 
            
1697
1656
            def func(*args, **kwargs):
1698
1657
                self._pipe.send(('funcall', name, args, kwargs))
1699
1658
                return self._pipe.recv()[1]
1700
 
            
1701
1659
            return func
1702
1660
    
1703
1661
    def __setattr__(self, name, value):
1715
1673
    def handle(self):
1716
1674
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1717
1675
            logger.info("TCP connection from: %s",
1718
 
                        str(self.client_address))
 
1676
                        unicode(self.client_address))
1719
1677
            logger.debug("Pipe FD: %d",
1720
1678
                         self.server.child_pipe.fileno())
1721
1679
            
1722
 
            session = gnutls.connection.ClientSession(
1723
 
                self.request, gnutls.connection .X509Credentials())
 
1680
            session = (gnutls.connection
 
1681
                       .ClientSession(self.request,
 
1682
                                      gnutls.connection
 
1683
                                      .X509Credentials()))
1724
1684
            
1725
1685
            # Note: gnutls.connection.X509Credentials is really a
1726
1686
            # generic GnuTLS certificate credentials object so long as
1735
1695
            priority = self.server.gnutls_priority
1736
1696
            if priority is None:
1737
1697
                priority = "NORMAL"
1738
 
            gnutls.library.functions.gnutls_priority_set_direct(
1739
 
                session._c_object, priority, None)
 
1698
            (gnutls.library.functions
 
1699
             .gnutls_priority_set_direct(session._c_object,
 
1700
                                         priority, None))
1740
1701
            
1741
1702
            # Start communication using the Mandos protocol
1742
1703
            # Get protocol number
1762
1723
            approval_required = False
1763
1724
            try:
1764
1725
                try:
1765
 
                    fpr = self.fingerprint(
1766
 
                        self.peer_certificate(session))
 
1726
                    fpr = self.fingerprint(self.peer_certificate
 
1727
                                           (session))
1767
1728
                except (TypeError,
1768
1729
                        gnutls.errors.GNUTLSError) as error:
1769
1730
                    logger.warning("Bad certificate: %s", error)
1784
1745
                while True:
1785
1746
                    if not client.enabled:
1786
1747
                        logger.info("Client %s is disabled",
1787
 
                                    client.name)
 
1748
                                       client.name)
1788
1749
                        if self.server.use_dbus:
1789
1750
                            # Emit D-Bus signal
1790
1751
                            client.Rejected("Disabled")
1799
1760
                        if self.server.use_dbus:
1800
1761
                            # Emit D-Bus signal
1801
1762
                            client.NeedApproval(
1802
 
                                client.approval_delay.total_seconds()
1803
 
                                * 1000, client.approved_by_default)
 
1763
                                client.approval_delay_milliseconds(),
 
1764
                                client.approved_by_default)
1804
1765
                    else:
1805
1766
                        logger.warning("Client %s was not approved",
1806
1767
                                       client.name)
1812
1773
                    #wait until timeout or approved
1813
1774
                    time = datetime.datetime.now()
1814
1775
                    client.changedstate.acquire()
1815
 
                    client.changedstate.wait(delay.total_seconds())
 
1776
                    client.changedstate.wait(
 
1777
                        float(timedelta_to_milliseconds(delay)
 
1778
                              / 1000))
1816
1779
                    client.changedstate.release()
1817
1780
                    time2 = datetime.datetime.now()
1818
1781
                    if (time2 - time) >= delay:
1837
1800
                        logger.warning("gnutls send failed",
1838
1801
                                       exc_info=error)
1839
1802
                        return
1840
 
                    logger.debug("Sent: %d, remaining: %d", sent,
1841
 
                                 len(client.secret) - (sent_size
1842
 
                                                       + sent))
 
1803
                    logger.debug("Sent: %d, remaining: %d",
 
1804
                                 sent, len(client.secret)
 
1805
                                 - (sent_size + sent))
1843
1806
                    sent_size += sent
1844
1807
                
1845
1808
                logger.info("Sending secret to %s", client.name)
1862
1825
    def peer_certificate(session):
1863
1826
        "Return the peer's OpenPGP certificate as a bytestring"
1864
1827
        # If not an OpenPGP certificate...
1865
 
        if (gnutls.library.functions.gnutls_certificate_type_get(
1866
 
                session._c_object)
 
1828
        if (gnutls.library.functions
 
1829
            .gnutls_certificate_type_get(session._c_object)
1867
1830
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1868
1831
            # ...do the normal thing
1869
1832
            return session.peer_certificate
1883
1846
    def fingerprint(openpgp):
1884
1847
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1885
1848
        # New GnuTLS "datum" with the OpenPGP public key
1886
 
        datum = gnutls.library.types.gnutls_datum_t(
1887
 
            ctypes.cast(ctypes.c_char_p(openpgp),
1888
 
                        ctypes.POINTER(ctypes.c_ubyte)),
1889
 
            ctypes.c_uint(len(openpgp)))
 
1849
        datum = (gnutls.library.types
 
1850
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1851
                                             ctypes.POINTER
 
1852
                                             (ctypes.c_ubyte)),
 
1853
                                 ctypes.c_uint(len(openpgp))))
1890
1854
        # New empty GnuTLS certificate
1891
1855
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1892
 
        gnutls.library.functions.gnutls_openpgp_crt_init(
1893
 
            ctypes.byref(crt))
 
1856
        (gnutls.library.functions
 
1857
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1894
1858
        # Import the OpenPGP public key into the certificate
1895
 
        gnutls.library.functions.gnutls_openpgp_crt_import(
1896
 
            crt, ctypes.byref(datum),
1897
 
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
1859
        (gnutls.library.functions
 
1860
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1861
                                    gnutls.library.constants
 
1862
                                    .GNUTLS_OPENPGP_FMT_RAW))
1898
1863
        # Verify the self signature in the key
1899
1864
        crtverify = ctypes.c_uint()
1900
 
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1901
 
            crt, 0, ctypes.byref(crtverify))
 
1865
        (gnutls.library.functions
 
1866
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1867
                                         ctypes.byref(crtverify)))
1902
1868
        if crtverify.value != 0:
1903
1869
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1904
 
            raise gnutls.errors.CertificateSecurityError(
1905
 
                "Verify failed")
 
1870
            raise (gnutls.errors.CertificateSecurityError
 
1871
                   ("Verify failed"))
1906
1872
        # New buffer for the fingerprint
1907
1873
        buf = ctypes.create_string_buffer(20)
1908
1874
        buf_len = ctypes.c_size_t()
1909
1875
        # Get the fingerprint from the certificate into the buffer
1910
 
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1911
 
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
 
1876
        (gnutls.library.functions
 
1877
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1878
                                             ctypes.byref(buf_len)))
1912
1879
        # Deinit the certificate
1913
1880
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1914
1881
        # Convert the buffer to a Python bytestring
1920
1887
 
1921
1888
class MultiprocessingMixIn(object):
1922
1889
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1923
 
    
1924
1890
    def sub_process_main(self, request, address):
1925
1891
        try:
1926
1892
            self.finish_request(request, address)
1938
1904
 
1939
1905
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1940
1906
    """ adds a pipe to the MixIn """
1941
 
    
1942
1907
    def process_request(self, request, client_address):
1943
1908
        """Overrides and wraps the original process_request().
1944
1909
        
1965
1930
        interface:      None or a network interface name (string)
1966
1931
        use_ipv6:       Boolean; to use IPv6 or not
1967
1932
    """
1968
 
    
1969
1933
    def __init__(self, server_address, RequestHandlerClass,
1970
 
                 interface=None,
1971
 
                 use_ipv6=True,
1972
 
                 socketfd=None):
 
1934
                 interface=None, use_ipv6=True, socketfd=None):
1973
1935
        """If socketfd is set, use that file descriptor instead of
1974
1936
        creating a new one with socket.socket().
1975
1937
        """
2016
1978
                             self.interface)
2017
1979
            else:
2018
1980
                try:
2019
 
                    self.socket.setsockopt(
2020
 
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
2021
 
                        (self.interface + "\0").encode("utf-8"))
 
1981
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1982
                                           SO_BINDTODEVICE,
 
1983
                                           str(self.interface + '\0'))
2022
1984
                except socket.error as error:
2023
1985
                    if error.errno == errno.EPERM:
2024
1986
                        logger.error("No permission to bind to"
2042
2004
                self.server_address = (any_address,
2043
2005
                                       self.server_address[1])
2044
2006
            elif not self.server_address[1]:
2045
 
                self.server_address = (self.server_address[0], 0)
 
2007
                self.server_address = (self.server_address[0],
 
2008
                                       0)
2046
2009
#                 if self.interface:
2047
2010
#                     self.server_address = (self.server_address[0],
2048
2011
#                                            0, # port
2062
2025
    
2063
2026
    Assumes a gobject.MainLoop event loop.
2064
2027
    """
2065
 
    
2066
2028
    def __init__(self, server_address, RequestHandlerClass,
2067
 
                 interface=None,
2068
 
                 use_ipv6=True,
2069
 
                 clients=None,
2070
 
                 gnutls_priority=None,
2071
 
                 use_dbus=True,
2072
 
                 socketfd=None):
 
2029
                 interface=None, use_ipv6=True, clients=None,
 
2030
                 gnutls_priority=None, use_dbus=True, socketfd=None):
2073
2031
        self.enabled = False
2074
2032
        self.clients = clients
2075
2033
        if self.clients is None:
2081
2039
                                interface = interface,
2082
2040
                                use_ipv6 = use_ipv6,
2083
2041
                                socketfd = socketfd)
2084
 
    
2085
2042
    def server_activate(self):
2086
2043
        if self.enabled:
2087
2044
            return socketserver.TCPServer.server_activate(self)
2091
2048
    
2092
2049
    def add_pipe(self, parent_pipe, proc):
2093
2050
        # Call "handle_ipc" for both data and EOF events
2094
 
        gobject.io_add_watch(
2095
 
            parent_pipe.fileno(),
2096
 
            gobject.IO_IN | gobject.IO_HUP,
2097
 
            functools.partial(self.handle_ipc,
2098
 
                              parent_pipe = parent_pipe,
2099
 
                              proc = proc))
 
2051
        gobject.io_add_watch(parent_pipe.fileno(),
 
2052
                             gobject.IO_IN | gobject.IO_HUP,
 
2053
                             functools.partial(self.handle_ipc,
 
2054
                                               parent_pipe =
 
2055
                                               parent_pipe,
 
2056
                                               proc = proc))
2100
2057
    
2101
 
    def handle_ipc(self, source, condition,
2102
 
                   parent_pipe=None,
2103
 
                   proc = None,
2104
 
                   client_object=None):
 
2058
    def handle_ipc(self, source, condition, parent_pipe=None,
 
2059
                   proc = None, client_object=None):
2105
2060
        # error, or the other end of multiprocessing.Pipe has closed
2106
2061
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
2107
2062
            # Wait for other process to exit
2130
2085
                parent_pipe.send(False)
2131
2086
                return False
2132
2087
            
2133
 
            gobject.io_add_watch(
2134
 
                parent_pipe.fileno(),
2135
 
                gobject.IO_IN | gobject.IO_HUP,
2136
 
                functools.partial(self.handle_ipc,
2137
 
                                  parent_pipe = parent_pipe,
2138
 
                                  proc = proc,
2139
 
                                  client_object = client))
 
2088
            gobject.io_add_watch(parent_pipe.fileno(),
 
2089
                                 gobject.IO_IN | gobject.IO_HUP,
 
2090
                                 functools.partial(self.handle_ipc,
 
2091
                                                   parent_pipe =
 
2092
                                                   parent_pipe,
 
2093
                                                   proc = proc,
 
2094
                                                   client_object =
 
2095
                                                   client))
2140
2096
            parent_pipe.send(True)
2141
2097
            # remove the old hook in favor of the new above hook on
2142
2098
            # same fileno
2148
2104
            
2149
2105
            parent_pipe.send(('data', getattr(client_object,
2150
2106
                                              funcname)(*args,
2151
 
                                                        **kwargs)))
 
2107
                                                         **kwargs)))
2152
2108
        
2153
2109
        if command == 'getattr':
2154
2110
            attrname = request[1]
2155
 
            if isinstance(client_object.__getattribute__(attrname),
2156
 
                          collections.Callable):
2157
 
                parent_pipe.send(('function', ))
 
2111
            if callable(client_object.__getattribute__(attrname)):
 
2112
                parent_pipe.send(('function',))
2158
2113
            else:
2159
 
                parent_pipe.send((
2160
 
                    'data', client_object.__getattribute__(attrname)))
 
2114
                parent_pipe.send(('data', client_object
 
2115
                                  .__getattribute__(attrname)))
2161
2116
        
2162
2117
        if command == 'setattr':
2163
2118
            attrname = request[1]
2194
2149
    # avoid excessive use of external libraries.
2195
2150
    
2196
2151
    # New type for defining tokens, syntax, and semantics all-in-one
2197
 
    Token = collections.namedtuple("Token", (
2198
 
        "regexp",  # To match token; if "value" is not None, must have
2199
 
                   # a "group" containing digits
2200
 
        "value",   # datetime.timedelta or None
2201
 
        "followers"))           # Tokens valid after this token
 
2152
    Token = collections.namedtuple("Token",
 
2153
                                   ("regexp", # To match token; if
 
2154
                                              # "value" is not None,
 
2155
                                              # must have a "group"
 
2156
                                              # containing digits
 
2157
                                    "value",  # datetime.timedelta or
 
2158
                                              # None
 
2159
                                    "followers")) # Tokens valid after
 
2160
                                                  # this token
2202
2161
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2203
2162
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2204
2163
    token_end = Token(re.compile(r"$"), None, frozenset())
2205
2164
    token_second = Token(re.compile(r"(\d+)S"),
2206
2165
                         datetime.timedelta(seconds=1),
2207
 
                         frozenset((token_end, )))
 
2166
                         frozenset((token_end,)))
2208
2167
    token_minute = Token(re.compile(r"(\d+)M"),
2209
2168
                         datetime.timedelta(minutes=1),
2210
2169
                         frozenset((token_second, token_end)))
2226
2185
                       frozenset((token_month, token_end)))
2227
2186
    token_week = Token(re.compile(r"(\d+)W"),
2228
2187
                       datetime.timedelta(weeks=1),
2229
 
                       frozenset((token_end, )))
 
2188
                       frozenset((token_end,)))
2230
2189
    token_duration = Token(re.compile(r"P"), None,
2231
2190
                           frozenset((token_year, token_month,
2232
2191
                                      token_day, token_time,
2233
 
                                      token_week)))
 
2192
                                      token_week))),
2234
2193
    # Define starting values
2235
2194
    value = datetime.timedelta() # Value so far
2236
2195
    found_token = None
2237
 
    followers = frozenset((token_duration, )) # Following valid tokens
 
2196
    followers = frozenset(token_duration,) # Following valid tokens
2238
2197
    s = duration                # String left to parse
2239
2198
    # Loop until end token is found
2240
2199
    while found_token is not token_end:
2257
2216
                break
2258
2217
        else:
2259
2218
            # No currently valid tokens were found
2260
 
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2261
 
                             .format(duration))
 
2219
            raise ValueError("Invalid RFC 3339 duration")
2262
2220
    # End token found
2263
2221
    return value
2264
2222
 
2288
2246
    timevalue = datetime.timedelta(0)
2289
2247
    for s in interval.split():
2290
2248
        try:
2291
 
            suffix = s[-1]
 
2249
            suffix = unicode(s[-1])
2292
2250
            value = int(s[:-1])
2293
2251
            if suffix == "d":
2294
2252
                delta = datetime.timedelta(value)
2301
2259
            elif suffix == "w":
2302
2260
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2303
2261
            else:
2304
 
                raise ValueError("Unknown suffix {!r}".format(suffix))
 
2262
                raise ValueError("Unknown suffix {0!r}"
 
2263
                                 .format(suffix))
2305
2264
        except IndexError as e:
2306
2265
            raise ValueError(*(e.args))
2307
2266
        timevalue += delta
2324
2283
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2325
2284
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2326
2285
            raise OSError(errno.ENODEV,
2327
 
                          "{} not a character device"
 
2286
                          "{0} not a character device"
2328
2287
                          .format(os.devnull))
2329
2288
        os.dup2(null, sys.stdin.fileno())
2330
2289
        os.dup2(null, sys.stdout.fileno())
2340
2299
    
2341
2300
    parser = argparse.ArgumentParser()
2342
2301
    parser.add_argument("-v", "--version", action="version",
2343
 
                        version = "%(prog)s {}".format(version),
 
2302
                        version = "%(prog)s {0}".format(version),
2344
2303
                        help="show version number and exit")
2345
2304
    parser.add_argument("-i", "--interface", metavar="IF",
2346
2305
                        help="Bind to interface IF")
2379
2338
                        help="Directory to save/restore state in")
2380
2339
    parser.add_argument("--foreground", action="store_true",
2381
2340
                        help="Run in foreground", default=None)
2382
 
    parser.add_argument("--no-zeroconf", action="store_false",
2383
 
                        dest="zeroconf", help="Do not use Zeroconf",
2384
 
                        default=None)
2385
2341
    
2386
2342
    options = parser.parse_args()
2387
2343
    
2396
2352
                        "port": "",
2397
2353
                        "debug": "False",
2398
2354
                        "priority":
2399
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2400
 
                        ":+SIGN-DSA-SHA256",
 
2355
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2401
2356
                        "servicename": "Mandos",
2402
2357
                        "use_dbus": "True",
2403
2358
                        "use_ipv6": "True",
2406
2361
                        "socket": "",
2407
2362
                        "statedir": "/var/lib/mandos",
2408
2363
                        "foreground": "False",
2409
 
                        "zeroconf": "True",
2410
 
                    }
 
2364
                        }
2411
2365
    
2412
2366
    # Parse config file for server-global settings
2413
2367
    server_config = configparser.SafeConfigParser(server_defaults)
2414
2368
    del server_defaults
2415
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
2369
    server_config.read(os.path.join(options.configdir,
 
2370
                                    "mandos.conf"))
2416
2371
    # Convert the SafeConfigParser object to a dict
2417
2372
    server_settings = server_config.defaults()
2418
2373
    # Use the appropriate methods on the non-string config options
2436
2391
    # Override the settings from the config file with command line
2437
2392
    # options, if set.
2438
2393
    for option in ("interface", "address", "port", "debug",
2439
 
                   "priority", "servicename", "configdir", "use_dbus",
2440
 
                   "use_ipv6", "debuglevel", "restore", "statedir",
2441
 
                   "socket", "foreground", "zeroconf"):
 
2394
                   "priority", "servicename", "configdir",
 
2395
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2396
                   "statedir", "socket", "foreground"):
2442
2397
        value = getattr(options, option)
2443
2398
        if value is not None:
2444
2399
            server_settings[option] = value
2445
2400
    del options
2446
2401
    # Force all strings to be unicode
2447
2402
    for option in server_settings.keys():
2448
 
        if isinstance(server_settings[option], bytes):
2449
 
            server_settings[option] = (server_settings[option]
2450
 
                                       .decode("utf-8"))
 
2403
        if type(server_settings[option]) is str:
 
2404
            server_settings[option] = unicode(server_settings[option])
2451
2405
    # Force all boolean options to be boolean
2452
2406
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2453
 
                   "foreground", "zeroconf"):
 
2407
                   "foreground"):
2454
2408
        server_settings[option] = bool(server_settings[option])
2455
2409
    # Debug implies foreground
2456
2410
    if server_settings["debug"]:
2459
2413
    
2460
2414
    ##################################################################
2461
2415
    
2462
 
    if (not server_settings["zeroconf"]
2463
 
        and not (server_settings["port"]
2464
 
                 or server_settings["socket"] != "")):
2465
 
        parser.error("Needs port or socket to work without Zeroconf")
2466
 
    
2467
2416
    # For convenience
2468
2417
    debug = server_settings["debug"]
2469
2418
    debuglevel = server_settings["debuglevel"]
2472
2421
    stored_state_path = os.path.join(server_settings["statedir"],
2473
2422
                                     stored_state_file)
2474
2423
    foreground = server_settings["foreground"]
2475
 
    zeroconf = server_settings["zeroconf"]
2476
2424
    
2477
2425
    if debug:
2478
2426
        initlogger(debug, logging.DEBUG)
2484
2432
            initlogger(debug, level)
2485
2433
    
2486
2434
    if server_settings["servicename"] != "Mandos":
2487
 
        syslogger.setFormatter(
2488
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
2489
 
                              ' %(levelname)s: %(message)s'.format(
2490
 
                                  server_settings["servicename"])))
 
2435
        syslogger.setFormatter(logging.Formatter
 
2436
                               ('Mandos ({0}) [%(process)d]:'
 
2437
                                ' %(levelname)s: %(message)s'
 
2438
                                .format(server_settings
 
2439
                                        ["servicename"])))
2491
2440
    
2492
2441
    # Parse config file with clients
2493
2442
    client_config = configparser.SafeConfigParser(Client
2498
2447
    global mandos_dbus_service
2499
2448
    mandos_dbus_service = None
2500
2449
    
2501
 
    socketfd = None
2502
 
    if server_settings["socket"] != "":
2503
 
        socketfd = server_settings["socket"]
2504
 
    tcp_server = MandosServer(
2505
 
        (server_settings["address"], server_settings["port"]),
2506
 
        ClientHandler,
2507
 
        interface=(server_settings["interface"] or None),
2508
 
        use_ipv6=use_ipv6,
2509
 
        gnutls_priority=server_settings["priority"],
2510
 
        use_dbus=use_dbus,
2511
 
        socketfd=socketfd)
 
2450
    tcp_server = MandosServer((server_settings["address"],
 
2451
                               server_settings["port"]),
 
2452
                              ClientHandler,
 
2453
                              interface=(server_settings["interface"]
 
2454
                                         or None),
 
2455
                              use_ipv6=use_ipv6,
 
2456
                              gnutls_priority=
 
2457
                              server_settings["priority"],
 
2458
                              use_dbus=use_dbus,
 
2459
                              socketfd=(server_settings["socket"]
 
2460
                                        or None))
2512
2461
    if not foreground:
2513
2462
        pidfilename = "/run/mandos.pid"
2514
2463
        if not os.path.isdir("/run/."):
2515
2464
            pidfilename = "/var/run/mandos.pid"
2516
2465
        pidfile = None
2517
2466
        try:
2518
 
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
 
2467
            pidfile = open(pidfilename, "w")
2519
2468
        except IOError as e:
2520
2469
            logger.error("Could not open file %r", pidfilename,
2521
2470
                         exc_info=e)
2548
2497
        def debug_gnutls(level, string):
2549
2498
            logger.debug("GnuTLS: %s", string[:-1])
2550
2499
        
2551
 
        gnutls.library.functions.gnutls_global_set_log_function(
2552
 
            debug_gnutls)
 
2500
        (gnutls.library.functions
 
2501
         .gnutls_global_set_log_function(debug_gnutls))
2553
2502
        
2554
2503
        # Redirect stdin so all checkers get /dev/null
2555
2504
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2575
2524
    if use_dbus:
2576
2525
        try:
2577
2526
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2578
 
                                            bus,
2579
 
                                            do_not_queue=True)
2580
 
            old_bus_name = dbus.service.BusName(
2581
 
                "se.bsnet.fukt.Mandos", bus,
2582
 
                do_not_queue=True)
2583
 
        except dbus.exceptions.DBusException as e:
 
2527
                                            bus, do_not_queue=True)
 
2528
            old_bus_name = (dbus.service.BusName
 
2529
                            ("se.bsnet.fukt.Mandos", bus,
 
2530
                             do_not_queue=True))
 
2531
        except dbus.exceptions.NameExistsException as e:
2584
2532
            logger.error("Disabling D-Bus:", exc_info=e)
2585
2533
            use_dbus = False
2586
2534
            server_settings["use_dbus"] = False
2587
2535
            tcp_server.use_dbus = False
2588
 
    if zeroconf:
2589
 
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2590
 
        service = AvahiServiceToSyslog(
2591
 
            name = server_settings["servicename"],
2592
 
            servicetype = "_mandos._tcp",
2593
 
            protocol = protocol,
2594
 
            bus = bus)
2595
 
        if server_settings["interface"]:
2596
 
            service.interface = if_nametoindex(
2597
 
                server_settings["interface"].encode("utf-8"))
 
2536
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2537
    service = AvahiServiceToSyslog(name =
 
2538
                                   server_settings["servicename"],
 
2539
                                   servicetype = "_mandos._tcp",
 
2540
                                   protocol = protocol, bus = bus)
 
2541
    if server_settings["interface"]:
 
2542
        service.interface = (if_nametoindex
 
2543
                             (str(server_settings["interface"])))
2598
2544
    
2599
2545
    global multiprocessing_manager
2600
2546
    multiprocessing_manager = multiprocessing.Manager()
2619
2565
    if server_settings["restore"]:
2620
2566
        try:
2621
2567
            with open(stored_state_path, "rb") as stored_state:
2622
 
                clients_data, old_client_settings = pickle.load(
2623
 
                    stored_state)
 
2568
                clients_data, old_client_settings = (pickle.load
 
2569
                                                     (stored_state))
2624
2570
            os.remove(stored_state_path)
2625
2571
        except IOError as e:
2626
2572
            if e.errno == errno.ENOENT:
2627
 
                logger.warning("Could not load persistent state:"
2628
 
                               " {}".format(os.strerror(e.errno)))
 
2573
                logger.warning("Could not load persistent state: {0}"
 
2574
                                .format(os.strerror(e.errno)))
2629
2575
            else:
2630
2576
                logger.critical("Could not load persistent state:",
2631
2577
                                exc_info=e)
2632
2578
                raise
2633
2579
        except EOFError as e:
2634
2580
            logger.warning("Could not load persistent state: "
2635
 
                           "EOFError:",
2636
 
                           exc_info=e)
 
2581
                           "EOFError:", exc_info=e)
2637
2582
    
2638
2583
    with PGPEngine() as pgp:
2639
 
        for client_name, client in clients_data.items():
 
2584
        for client_name, client in clients_data.iteritems():
2640
2585
            # Skip removed clients
2641
2586
            if client_name not in client_settings:
2642
2587
                continue
2651
2596
                    # For each value in new config, check if it
2652
2597
                    # differs from the old config value (Except for
2653
2598
                    # the "secret" attribute)
2654
 
                    if (name != "secret"
2655
 
                        and (value !=
2656
 
                             old_client_settings[client_name][name])):
 
2599
                    if (name != "secret" and
 
2600
                        value != old_client_settings[client_name]
 
2601
                        [name]):
2657
2602
                        client[name] = value
2658
2603
                except KeyError:
2659
2604
                    pass
2660
2605
            
2661
2606
            # Clients who has passed its expire date can still be
2662
 
            # enabled if its last checker was successful.  A Client
 
2607
            # enabled if its last checker was successful.  Clients
2663
2608
            # whose checker succeeded before we stored its state is
2664
2609
            # assumed to have successfully run all checkers during
2665
2610
            # downtime.
2667
2612
                if datetime.datetime.utcnow() >= client["expires"]:
2668
2613
                    if not client["last_checked_ok"]:
2669
2614
                        logger.warning(
2670
 
                            "disabling client {} - Client never "
2671
 
                            "performed a successful checker".format(
2672
 
                                client_name))
 
2615
                            "disabling client {0} - Client never "
 
2616
                            "performed a successful checker"
 
2617
                            .format(client_name))
2673
2618
                        client["enabled"] = False
2674
2619
                    elif client["last_checker_status"] != 0:
2675
2620
                        logger.warning(
2676
 
                            "disabling client {} - Client last"
2677
 
                            " checker failed with error code"
2678
 
                            " {}".format(
2679
 
                                client_name,
2680
 
                                client["last_checker_status"]))
 
2621
                            "disabling client {0} - Client "
 
2622
                            "last checker failed with error code {1}"
 
2623
                            .format(client_name,
 
2624
                                    client["last_checker_status"]))
2681
2625
                        client["enabled"] = False
2682
2626
                    else:
2683
 
                        client["expires"] = (
2684
 
                            datetime.datetime.utcnow()
2685
 
                            + client["timeout"])
 
2627
                        client["expires"] = (datetime.datetime
 
2628
                                             .utcnow()
 
2629
                                             + client["timeout"])
2686
2630
                        logger.debug("Last checker succeeded,"
2687
 
                                     " keeping {} enabled".format(
2688
 
                                         client_name))
 
2631
                                     " keeping {0} enabled"
 
2632
                                     .format(client_name))
2689
2633
            try:
2690
 
                client["secret"] = pgp.decrypt(
2691
 
                    client["encrypted_secret"],
2692
 
                    client_settings[client_name]["secret"])
 
2634
                client["secret"] = (
 
2635
                    pgp.decrypt(client["encrypted_secret"],
 
2636
                                client_settings[client_name]
 
2637
                                ["secret"]))
2693
2638
            except PGPError:
2694
2639
                # If decryption fails, we use secret from new settings
2695
 
                logger.debug("Failed to decrypt {} old secret".format(
2696
 
                    client_name))
2697
 
                client["secret"] = (client_settings[client_name]
2698
 
                                    ["secret"])
 
2640
                logger.debug("Failed to decrypt {0} old secret"
 
2641
                             .format(client_name))
 
2642
                client["secret"] = (
 
2643
                    client_settings[client_name]["secret"])
2699
2644
    
2700
2645
    # Add/remove clients based on new changes made to config
2701
2646
    for client_name in (set(old_client_settings)
2706
2651
        clients_data[client_name] = client_settings[client_name]
2707
2652
    
2708
2653
    # Create all client objects
2709
 
    for client_name, client in clients_data.items():
 
2654
    for client_name, client in clients_data.iteritems():
2710
2655
        tcp_server.clients[client_name] = client_class(
2711
 
            name = client_name,
2712
 
            settings = client,
 
2656
            name = client_name, settings = client,
2713
2657
            server_settings = server_settings)
2714
2658
    
2715
2659
    if not tcp_server.clients:
2717
2661
    
2718
2662
    if not foreground:
2719
2663
        if pidfile is not None:
2720
 
            pid = os.getpid()
2721
2664
            try:
2722
2665
                with pidfile:
2723
 
                    print(pid, file=pidfile)
 
2666
                    pid = os.getpid()
 
2667
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
2724
2668
            except IOError:
2725
2669
                logger.error("Could not write to file %r with PID %d",
2726
2670
                             pidfilename, pid)
2731
2675
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2732
2676
    
2733
2677
    if use_dbus:
2734
 
        
2735
 
        @alternate_dbus_interfaces(
2736
 
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
 
2678
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2679
                                        "se.bsnet.fukt.Mandos"})
2737
2680
        class MandosDBusService(DBusObjectWithProperties):
2738
2681
            """A D-Bus proxy object"""
2739
 
            
2740
2682
            def __init__(self):
2741
2683
                dbus.service.Object.__init__(self, bus, "/")
2742
 
            
2743
2684
            _interface = "se.recompile.Mandos"
2744
2685
            
2745
2686
            @dbus_interface_annotations(_interface)
2746
2687
            def _foo(self):
2747
 
                return {
2748
 
                    "org.freedesktop.DBus.Property.EmitsChangedSignal":
2749
 
                    "false" }
 
2688
                return { "org.freedesktop.DBus.Property"
 
2689
                         ".EmitsChangedSignal":
 
2690
                             "false"}
2750
2691
            
2751
2692
            @dbus.service.signal(_interface, signature="o")
2752
2693
            def ClientAdded(self, objpath):
2766
2707
            @dbus.service.method(_interface, out_signature="ao")
2767
2708
            def GetAllClients(self):
2768
2709
                "D-Bus method"
2769
 
                return dbus.Array(c.dbus_object_path for c in
 
2710
                return dbus.Array(c.dbus_object_path
 
2711
                                  for c in
2770
2712
                                  tcp_server.clients.itervalues())
2771
2713
            
2772
2714
            @dbus.service.method(_interface,
2774
2716
            def GetAllClientsWithProperties(self):
2775
2717
                "D-Bus method"
2776
2718
                return dbus.Dictionary(
2777
 
                    { c.dbus_object_path: c.GetAll("")
2778
 
                      for c in tcp_server.clients.itervalues() },
 
2719
                    ((c.dbus_object_path, c.GetAll(""))
 
2720
                     for c in tcp_server.clients.itervalues()),
2779
2721
                    signature="oa{sv}")
2780
2722
            
2781
2723
            @dbus.service.method(_interface, in_signature="o")
2798
2740
    
2799
2741
    def cleanup():
2800
2742
        "Cleanup function; run on exit"
2801
 
        if zeroconf:
2802
 
            service.cleanup()
 
2743
        service.cleanup()
2803
2744
        
2804
2745
        multiprocessing.active_children()
2805
2746
        wnull.close()
2819
2760
                
2820
2761
                # A list of attributes that can not be pickled
2821
2762
                # + secret.
2822
 
                exclude = { "bus", "changedstate", "secret",
2823
 
                            "checker", "server_settings" }
2824
 
                for name, typ in inspect.getmembers(dbus.service
2825
 
                                                    .Object):
 
2763
                exclude = set(("bus", "changedstate", "secret",
 
2764
                               "checker", "server_settings"))
 
2765
                for name, typ in (inspect.getmembers
 
2766
                                  (dbus.service.Object)):
2826
2767
                    exclude.add(name)
2827
2768
                
2828
2769
                client_dict["encrypted_secret"] = (client
2835
2776
                del client_settings[client.name]["secret"]
2836
2777
        
2837
2778
        try:
2838
 
            with tempfile.NamedTemporaryFile(
2839
 
                    mode='wb',
2840
 
                    suffix=".pickle",
2841
 
                    prefix='clients-',
2842
 
                    dir=os.path.dirname(stored_state_path),
2843
 
                    delete=False) as stored_state:
 
2779
            with (tempfile.NamedTemporaryFile
 
2780
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2781
                   dir=os.path.dirname(stored_state_path),
 
2782
                   delete=False)) as stored_state:
2844
2783
                pickle.dump((clients, client_settings), stored_state)
2845
 
                tempname = stored_state.name
 
2784
                tempname=stored_state.name
2846
2785
            os.rename(tempname, stored_state_path)
2847
2786
        except (IOError, OSError) as e:
2848
2787
            if not debug:
2851
2790
                except NameError:
2852
2791
                    pass
2853
2792
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2854
 
                logger.warning("Could not save persistent state: {}"
 
2793
                logger.warning("Could not save persistent state: {0}"
2855
2794
                               .format(os.strerror(e.errno)))
2856
2795
            else:
2857
2796
                logger.warning("Could not save persistent state:",
2867
2806
            client.disable(quiet=True)
2868
2807
            if use_dbus:
2869
2808
                # Emit D-Bus signal
2870
 
                mandos_dbus_service.ClientRemoved(
2871
 
                    client.dbus_object_path, client.name)
 
2809
                mandos_dbus_service.ClientRemoved(client
 
2810
                                                  .dbus_object_path,
 
2811
                                                  client.name)
2872
2812
        client_settings.clear()
2873
2813
    
2874
2814
    atexit.register(cleanup)
2885
2825
    tcp_server.server_activate()
2886
2826
    
2887
2827
    # Find out what port we got
2888
 
    if zeroconf:
2889
 
        service.port = tcp_server.socket.getsockname()[1]
 
2828
    service.port = tcp_server.socket.getsockname()[1]
2890
2829
    if use_ipv6:
2891
2830
        logger.info("Now listening on address %r, port %d,"
2892
2831
                    " flowinfo %d, scope_id %d",
2898
2837
    #service.interface = tcp_server.socket.getsockname()[3]
2899
2838
    
2900
2839
    try:
2901
 
        if zeroconf:
2902
 
            # From the Avahi example code
2903
 
            try:
2904
 
                service.activate()
2905
 
            except dbus.exceptions.DBusException as error:
2906
 
                logger.critical("D-Bus Exception", exc_info=error)
2907
 
                cleanup()
2908
 
                sys.exit(1)
2909
 
            # End of Avahi example code
 
2840
        # From the Avahi example code
 
2841
        try:
 
2842
            service.activate()
 
2843
        except dbus.exceptions.DBusException as error:
 
2844
            logger.critical("D-Bus Exception", exc_info=error)
 
2845
            cleanup()
 
2846
            sys.exit(1)
 
2847
        # End of Avahi example code
2910
2848
        
2911
2849
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2912
2850
                             lambda *args, **kwargs:
2927
2865
    # Must run before the D-Bus bus name gets deregistered
2928
2866
    cleanup()
2929
2867
 
2930
 
 
2931
2868
if __name__ == '__main__':
2932
2869
    main()