/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2014-07-14 21:41:08 UTC
  • Revision ID: teddy@recompile.se-20140714214108-awg7u6gaiy7d40dz
mandos-monitor: New "verbose" mode to see less important log messages.

* mandos-monitor (MandosClientWidget.__init__): Log client creation.
  (MandosClientWidget.checker_completed): Log a successful checker.
  (MandosClientWidget.checker_started): Log starting of a checker.
  (UserInterface.__init__): New optional "log_level" argument.
  (UserInterface.log_message, UserInterface.log_message_raw): Take
                                                              optional
                                                              "level"
                                                              arg.
  (UserInterface.toggle_log_display): Log visibility change.
  (UserInterface.change_log_display): Log wrap mode change.
  (UserInterface.process_input): Show new "v" key in help message and
                                 process "v" key if pressed.
* mandos-monitor.xml (KEYS): Document new "v" key.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python2.7
 
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2015 Teddy Hogeborn
15
 
# Copyright © 2008-2015 Björn Påhlsson
 
14
# Copyright © 2008-2014 Teddy Hogeborn
 
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
 
37
37
from future_builtins import *
38
38
 
39
 
try:
40
 
    import SocketServer as socketserver
41
 
except ImportError:
42
 
    import socketserver
 
39
import SocketServer as socketserver
43
40
import socket
44
41
import argparse
45
42
import datetime
50
47
import gnutls.library.functions
51
48
import gnutls.library.constants
52
49
import gnutls.library.types
53
 
try:
54
 
    import ConfigParser as configparser
55
 
except ImportError:
56
 
    import configparser
 
50
import ConfigParser as configparser
57
51
import sys
58
52
import re
59
53
import os
68
62
import struct
69
63
import fcntl
70
64
import functools
71
 
try:
72
 
    import cPickle as pickle
73
 
except ImportError:
74
 
    import pickle
 
65
import cPickle as pickle
75
66
import multiprocessing
76
67
import types
77
68
import binascii
78
69
import tempfile
79
70
import itertools
80
71
import collections
81
 
import codecs
82
72
 
83
73
import dbus
84
74
import dbus.service
85
 
try:
86
 
    import gobject
87
 
except ImportError:
88
 
    from gi.repository import GObject as gobject
 
75
import gobject
89
76
import avahi
90
77
from dbus.mainloop.glib import DBusGMainLoop
91
78
import ctypes
101
88
    except ImportError:
102
89
        SO_BINDTODEVICE = None
103
90
 
104
 
if sys.version_info.major == 2:
105
 
    str = unicode
106
 
 
107
 
version = "1.6.9"
 
91
version = "1.6.6"
108
92
stored_state_file = "clients.pickle"
109
93
 
110
94
logger = logging.getLogger()
111
95
syslogger = None
112
96
 
113
97
try:
114
 
    if_nametoindex = ctypes.cdll.LoadLibrary(
115
 
        ctypes.util.find_library("c")).if_nametoindex
 
98
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
99
                      (ctypes.util.find_library("c"))
 
100
                      .if_nametoindex)
116
101
except (OSError, AttributeError):
117
 
    
118
102
    def if_nametoindex(interface):
119
103
        "Get an interface index the hard way, i.e. using fcntl()"
120
104
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
121
105
        with contextlib.closing(socket.socket()) as s:
122
106
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
 
                                struct.pack(b"16s16x", interface))
124
 
        interface_index = struct.unpack("I", ifreq[16:20])[0]
 
107
                                struct.pack(str("16s16x"),
 
108
                                            interface))
 
109
        interface_index = struct.unpack(str("I"),
 
110
                                        ifreq[16:20])[0]
125
111
        return interface_index
126
112
 
127
113
 
129
115
    """init logger and add loglevel"""
130
116
    
131
117
    global syslogger
132
 
    syslogger = (logging.handlers.SysLogHandler(
133
 
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
 
        address = "/dev/log"))
 
118
    syslogger = (logging.handlers.SysLogHandler
 
119
                 (facility =
 
120
                  logging.handlers.SysLogHandler.LOG_DAEMON,
 
121
                  address = str("/dev/log")))
135
122
    syslogger.setFormatter(logging.Formatter
136
123
                           ('Mandos [%(process)d]: %(levelname)s:'
137
124
                            ' %(message)s'))
154
141
 
155
142
class PGPEngine(object):
156
143
    """A simple class for OpenPGP symmetric encryption & decryption"""
157
 
    
158
144
    def __init__(self):
159
145
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
146
        self.gnupgargs = ['--batch',
199
185
    
200
186
    def encrypt(self, data, password):
201
187
        passphrase = self.password_encode(password)
202
 
        with tempfile.NamedTemporaryFile(
203
 
                dir=self.tempdir) as passfile:
 
188
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
189
                                         ) as passfile:
204
190
            passfile.write(passphrase)
205
191
            passfile.flush()
206
192
            proc = subprocess.Popen(['gpg', '--symmetric',
217
203
    
218
204
    def decrypt(self, data, password):
219
205
        passphrase = self.password_encode(password)
220
 
        with tempfile.NamedTemporaryFile(
221
 
                dir = self.tempdir) as passfile:
 
206
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
207
                                         ) as passfile:
222
208
            passfile.write(passphrase)
223
209
            passfile.flush()
224
210
            proc = subprocess.Popen(['gpg', '--decrypt',
228
214
                                    stdin = subprocess.PIPE,
229
215
                                    stdout = subprocess.PIPE,
230
216
                                    stderr = subprocess.PIPE)
231
 
            decrypted_plaintext, err = proc.communicate(input = data)
 
217
            decrypted_plaintext, err = proc.communicate(input
 
218
                                                        = data)
232
219
        if proc.returncode != 0:
233
220
            raise PGPError(err)
234
221
        return decrypted_plaintext
237
224
class AvahiError(Exception):
238
225
    def __init__(self, value, *args, **kwargs):
239
226
        self.value = value
240
 
        return super(AvahiError, self).__init__(value, *args,
241
 
                                                **kwargs)
242
 
 
 
227
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
228
    def __unicode__(self):
 
229
        return unicode(repr(self.value))
243
230
 
244
231
class AvahiServiceError(AvahiError):
245
232
    pass
246
233
 
247
 
 
248
234
class AvahiGroupError(AvahiError):
249
235
    pass
250
236
 
270
256
    bus: dbus.SystemBus()
271
257
    """
272
258
    
273
 
    def __init__(self,
274
 
                 interface = avahi.IF_UNSPEC,
275
 
                 name = None,
276
 
                 servicetype = None,
277
 
                 port = None,
278
 
                 TXT = None,
279
 
                 domain = "",
280
 
                 host = "",
281
 
                 max_renames = 32768,
282
 
                 protocol = avahi.PROTO_UNSPEC,
283
 
                 bus = None):
 
259
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
260
                 servicetype = None, port = None, TXT = None,
 
261
                 domain = "", host = "", max_renames = 32768,
 
262
                 protocol = avahi.PROTO_UNSPEC, bus = None):
284
263
        self.interface = interface
285
264
        self.name = name
286
265
        self.type = servicetype
296
275
        self.bus = bus
297
276
        self.entry_group_state_changed_match = None
298
277
    
299
 
    def rename(self, remove=True):
 
278
    def rename(self):
300
279
        """Derived from the Avahi example code"""
301
280
        if self.rename_count >= self.max_renames:
302
281
            logger.critical("No suitable Zeroconf service name found"
303
282
                            " after %i retries, exiting.",
304
283
                            self.rename_count)
305
284
            raise AvahiServiceError("Too many renames")
306
 
        self.name = str(
307
 
            self.server.GetAlternativeServiceName(self.name))
308
 
        self.rename_count += 1
 
285
        self.name = unicode(self.server
 
286
                            .GetAlternativeServiceName(self.name))
309
287
        logger.info("Changing Zeroconf service name to %r ...",
310
288
                    self.name)
311
 
        if remove:
312
 
            self.remove()
 
289
        self.remove()
313
290
        try:
314
291
            self.add()
315
292
        except dbus.exceptions.DBusException as error:
316
 
            if (error.get_dbus_name()
317
 
                == "org.freedesktop.Avahi.CollisionError"):
318
 
                logger.info("Local Zeroconf service name collision.")
319
 
                return self.rename(remove=False)
320
 
            else:
321
 
                logger.critical("D-Bus Exception", exc_info=error)
322
 
                self.cleanup()
323
 
                os._exit(1)
 
293
            logger.critical("D-Bus Exception", exc_info=error)
 
294
            self.cleanup()
 
295
            os._exit(1)
 
296
        self.rename_count += 1
324
297
    
325
298
    def remove(self):
326
299
        """Derived from the Avahi example code"""
364
337
            self.rename()
365
338
        elif state == avahi.ENTRY_GROUP_FAILURE:
366
339
            logger.critical("Avahi: Error in group state changed %s",
367
 
                            str(error))
368
 
            raise AvahiGroupError("State changed: {!s}".format(error))
 
340
                            unicode(error))
 
341
            raise AvahiGroupError("State changed: {0!s}"
 
342
                                  .format(error))
369
343
    
370
344
    def cleanup(self):
371
345
        """Derived from the Avahi example code"""
381
355
    def server_state_changed(self, state, error=None):
382
356
        """Derived from the Avahi example code"""
383
357
        logger.debug("Avahi server state change: %i", state)
384
 
        bad_states = {
385
 
            avahi.SERVER_INVALID: "Zeroconf server invalid",
386
 
            avahi.SERVER_REGISTERING: None,
387
 
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
 
            avahi.SERVER_FAILURE: "Zeroconf server failure",
389
 
        }
 
358
        bad_states = { avahi.SERVER_INVALID:
 
359
                           "Zeroconf server invalid",
 
360
                       avahi.SERVER_REGISTERING: None,
 
361
                       avahi.SERVER_COLLISION:
 
362
                           "Zeroconf server name collision",
 
363
                       avahi.SERVER_FAILURE:
 
364
                           "Zeroconf server failure" }
390
365
        if state in bad_states:
391
366
            if bad_states[state] is not None:
392
367
                if error is None:
411
386
                                    follow_name_owner_changes=True),
412
387
                avahi.DBUS_INTERFACE_SERVER)
413
388
        self.server.connect_to_signal("StateChanged",
414
 
                                      self.server_state_changed)
 
389
                                 self.server_state_changed)
415
390
        self.server_state_changed(self.server.GetState())
416
391
 
417
392
 
418
393
class AvahiServiceToSyslog(AvahiService):
419
 
    def rename(self, *args, **kwargs):
 
394
    def rename(self):
420
395
        """Add the new name to the syslog messages"""
421
 
        ret = AvahiService.rename(self, *args, **kwargs)
422
 
        syslogger.setFormatter(logging.Formatter(
423
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
424
 
            .format(self.name)))
 
396
        ret = AvahiService.rename(self)
 
397
        syslogger.setFormatter(logging.Formatter
 
398
                               ('Mandos ({0}) [%(process)d]:'
 
399
                                ' %(levelname)s: %(message)s'
 
400
                                .format(self.name)))
425
401
        return ret
426
402
 
427
 
def call_pipe(connection,       # : multiprocessing.Connection
428
 
              func, *args, **kwargs):
429
 
    """This function is meant to be called by multiprocessing.Process
430
 
    
431
 
    This function runs func(*args, **kwargs), and writes the resulting
432
 
    return value on the provided multiprocessing.Connection.
433
 
    """
434
 
    connection.send(func(*args, **kwargs))
435
 
    connection.close()
 
403
 
 
404
def timedelta_to_milliseconds(td):
 
405
    "Convert a datetime.timedelta() to milliseconds"
 
406
    return ((td.days * 24 * 60 * 60 * 1000)
 
407
            + (td.seconds * 1000)
 
408
            + (td.microseconds // 1000))
 
409
 
436
410
 
437
411
class Client(object):
438
412
    """A representation of a client host served by this server.
465
439
    last_checker_status: integer between 0 and 255 reflecting exit
466
440
                         status of last checker. -1 reflects crashed
467
441
                         checker, -2 means no checker completed yet.
468
 
    last_checker_signal: The signal which killed the last checker, if
469
 
                         last_checker_status is -1
470
442
    last_enabled: datetime.datetime(); (UTC) or None
471
443
    name:       string; from the config file, used in log messages and
472
444
                        D-Bus identifiers
485
457
                          "fingerprint", "host", "interval",
486
458
                          "last_approval_request", "last_checked_ok",
487
459
                          "last_enabled", "name", "timeout")
488
 
    client_defaults = {
489
 
        "timeout": "PT5M",
490
 
        "extended_timeout": "PT15M",
491
 
        "interval": "PT2M",
492
 
        "checker": "fping -q -- %%(host)s",
493
 
        "host": "",
494
 
        "approval_delay": "PT0S",
495
 
        "approval_duration": "PT1S",
496
 
        "approved_by_default": "True",
497
 
        "enabled": "True",
498
 
    }
 
460
    client_defaults = { "timeout": "PT5M",
 
461
                        "extended_timeout": "PT15M",
 
462
                        "interval": "PT2M",
 
463
                        "checker": "fping -q -- %%(host)s",
 
464
                        "host": "",
 
465
                        "approval_delay": "PT0S",
 
466
                        "approval_duration": "PT1S",
 
467
                        "approved_by_default": "True",
 
468
                        "enabled": "True",
 
469
                        }
 
470
    
 
471
    def timeout_milliseconds(self):
 
472
        "Return the 'timeout' attribute in milliseconds"
 
473
        return timedelta_to_milliseconds(self.timeout)
 
474
    
 
475
    def extended_timeout_milliseconds(self):
 
476
        "Return the 'extended_timeout' attribute in milliseconds"
 
477
        return timedelta_to_milliseconds(self.extended_timeout)
 
478
    
 
479
    def interval_milliseconds(self):
 
480
        "Return the 'interval' attribute in milliseconds"
 
481
        return timedelta_to_milliseconds(self.interval)
 
482
    
 
483
    def approval_delay_milliseconds(self):
 
484
        return timedelta_to_milliseconds(self.approval_delay)
499
485
    
500
486
    @staticmethod
501
487
    def config_parser(config):
517
503
            client["enabled"] = config.getboolean(client_name,
518
504
                                                  "enabled")
519
505
            
520
 
            # Uppercase and remove spaces from fingerprint for later
521
 
            # comparison purposes with return value from the
522
 
            # fingerprint() function
523
506
            client["fingerprint"] = (section["fingerprint"].upper()
524
507
                                     .replace(" ", ""))
525
508
            if "secret" in section:
530
513
                          "rb") as secfile:
531
514
                    client["secret"] = secfile.read()
532
515
            else:
533
 
                raise TypeError("No secret or secfile for section {}"
 
516
                raise TypeError("No secret or secfile for section {0}"
534
517
                                .format(section))
535
518
            client["timeout"] = string_to_delta(section["timeout"])
536
519
            client["extended_timeout"] = string_to_delta(
553
536
            server_settings = {}
554
537
        self.server_settings = server_settings
555
538
        # adding all client settings
556
 
        for setting, value in settings.items():
 
539
        for setting, value in settings.iteritems():
557
540
            setattr(self, setting, value)
558
541
        
559
542
        if self.enabled:
567
550
            self.expires = None
568
551
        
569
552
        logger.debug("Creating client %r", self.name)
 
553
        # Uppercase and remove spaces from fingerprint for later
 
554
        # comparison purposes with return value from the fingerprint()
 
555
        # function
570
556
        logger.debug("  Fingerprint: %s", self.fingerprint)
571
557
        self.created = settings.get("created",
572
558
                                    datetime.datetime.utcnow())
579
565
        self.current_checker_command = None
580
566
        self.approved = None
581
567
        self.approvals_pending = 0
582
 
        self.changedstate = multiprocessing_manager.Condition(
583
 
            multiprocessing_manager.Lock())
584
 
        self.client_structure = [attr
585
 
                                 for attr in self.__dict__.iterkeys()
 
568
        self.changedstate = (multiprocessing_manager
 
569
                             .Condition(multiprocessing_manager
 
570
                                        .Lock()))
 
571
        self.client_structure = [attr for attr in
 
572
                                 self.__dict__.iterkeys()
586
573
                                 if not attr.startswith("_")]
587
574
        self.client_structure.append("client_structure")
588
575
        
589
 
        for name, t in inspect.getmembers(
590
 
                type(self), lambda obj: isinstance(obj, property)):
 
576
        for name, t in inspect.getmembers(type(self),
 
577
                                          lambda obj:
 
578
                                              isinstance(obj,
 
579
                                                         property)):
591
580
            if not name.startswith("_"):
592
581
                self.client_structure.append(name)
593
582
    
635
624
        # and every interval from then on.
636
625
        if self.checker_initiator_tag is not None:
637
626
            gobject.source_remove(self.checker_initiator_tag)
638
 
        self.checker_initiator_tag = gobject.timeout_add(
639
 
            int(self.interval.total_seconds() * 1000),
640
 
            self.start_checker)
 
627
        self.checker_initiator_tag = (gobject.timeout_add
 
628
                                      (self.interval_milliseconds(),
 
629
                                       self.start_checker))
641
630
        # Schedule a disable() when 'timeout' has passed
642
631
        if self.disable_initiator_tag is not None:
643
632
            gobject.source_remove(self.disable_initiator_tag)
644
 
        self.disable_initiator_tag = gobject.timeout_add(
645
 
            int(self.timeout.total_seconds() * 1000), self.disable)
 
633
        self.disable_initiator_tag = (gobject.timeout_add
 
634
                                   (self.timeout_milliseconds(),
 
635
                                    self.disable))
646
636
        # Also start a new checker *right now*.
647
637
        self.start_checker()
648
638
    
649
 
    def checker_callback(self, source, condition, connection,
650
 
                         command):
 
639
    def checker_callback(self, pid, condition, command):
651
640
        """The checker has completed, so take appropriate actions."""
652
641
        self.checker_callback_tag = None
653
642
        self.checker = None
654
 
        # Read return code from connection (see call_pipe)
655
 
        returncode = connection.recv()
656
 
        connection.close()
657
 
        
658
 
        if returncode >= 0:
659
 
            self.last_checker_status = returncode
660
 
            self.last_checker_signal = None
 
643
        if os.WIFEXITED(condition):
 
644
            self.last_checker_status = os.WEXITSTATUS(condition)
661
645
            if self.last_checker_status == 0:
662
646
                logger.info("Checker for %(name)s succeeded",
663
647
                            vars(self))
664
648
                self.checked_ok()
665
649
            else:
666
 
                logger.info("Checker for %(name)s failed", vars(self))
 
650
                logger.info("Checker for %(name)s failed",
 
651
                            vars(self))
667
652
        else:
668
653
            self.last_checker_status = -1
669
 
            self.last_checker_signal = -returncode
670
654
            logger.warning("Checker for %(name)s crashed?",
671
655
                           vars(self))
672
 
        return False
673
656
    
674
657
    def checked_ok(self):
675
658
        """Assert that the client has been seen, alive and well."""
676
659
        self.last_checked_ok = datetime.datetime.utcnow()
677
660
        self.last_checker_status = 0
678
 
        self.last_checker_signal = None
679
661
        self.bump_timeout()
680
662
    
681
663
    def bump_timeout(self, timeout=None):
686
668
            gobject.source_remove(self.disable_initiator_tag)
687
669
            self.disable_initiator_tag = None
688
670
        if getattr(self, "enabled", False):
689
 
            self.disable_initiator_tag = gobject.timeout_add(
690
 
                int(timeout.total_seconds() * 1000), self.disable)
 
671
            self.disable_initiator_tag = (gobject.timeout_add
 
672
                                          (timedelta_to_milliseconds
 
673
                                           (timeout), self.disable))
691
674
            self.expires = datetime.datetime.utcnow() + timeout
692
675
    
693
676
    def need_approval(self):
707
690
        # than 'timeout' for the client to be disabled, which is as it
708
691
        # should be.
709
692
        
710
 
        if self.checker is not None and not self.checker.is_alive():
711
 
            logger.warning("Checker was not alive; joining")
712
 
            self.checker.join()
713
 
            self.checker = None
 
693
        # If a checker exists, make sure it is not a zombie
 
694
        try:
 
695
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
696
        except AttributeError:
 
697
            pass
 
698
        except OSError as error:
 
699
            if error.errno != errno.ECHILD:
 
700
                raise
 
701
        else:
 
702
            if pid:
 
703
                logger.warning("Checker was a zombie")
 
704
                gobject.source_remove(self.checker_callback_tag)
 
705
                self.checker_callback(pid, status,
 
706
                                      self.current_checker_command)
714
707
        # Start a new checker if needed
715
708
        if self.checker is None:
716
709
            # Escape attributes for the shell
717
 
            escaped_attrs = {
718
 
                attr: re.escape(str(getattr(self, attr)))
719
 
                for attr in self.runtime_expansions }
 
710
            escaped_attrs = dict(
 
711
                (attr, re.escape(unicode(getattr(self, attr))))
 
712
                for attr in
 
713
                self.runtime_expansions)
720
714
            try:
721
715
                command = self.checker_command % escaped_attrs
722
716
            except TypeError as error:
723
717
                logger.error('Could not format string "%s"',
724
 
                             self.checker_command,
 
718
                             self.checker_command, exc_info=error)
 
719
                return True # Try again later
 
720
            self.current_checker_command = command
 
721
            try:
 
722
                logger.info("Starting checker %r for %s",
 
723
                            command, self.name)
 
724
                # We don't need to redirect stdout and stderr, since
 
725
                # in normal mode, that is already done by daemon(),
 
726
                # and in debug mode we don't want to.  (Stdin is
 
727
                # always replaced by /dev/null.)
 
728
                # The exception is when not debugging but nevertheless
 
729
                # running in the foreground; use the previously
 
730
                # created wnull.
 
731
                popen_args = {}
 
732
                if (not self.server_settings["debug"]
 
733
                    and self.server_settings["foreground"]):
 
734
                    popen_args.update({"stdout": wnull,
 
735
                                       "stderr": wnull })
 
736
                self.checker = subprocess.Popen(command,
 
737
                                                close_fds=True,
 
738
                                                shell=True, cwd="/",
 
739
                                                **popen_args)
 
740
            except OSError as error:
 
741
                logger.error("Failed to start subprocess",
725
742
                             exc_info=error)
726
 
                return True     # Try again later
727
 
            self.current_checker_command = command
728
 
            logger.info("Starting checker %r for %s", command,
729
 
                        self.name)
730
 
            # We don't need to redirect stdout and stderr, since
731
 
            # in normal mode, that is already done by daemon(),
732
 
            # and in debug mode we don't want to.  (Stdin is
733
 
            # always replaced by /dev/null.)
734
 
            # The exception is when not debugging but nevertheless
735
 
            # running in the foreground; use the previously
736
 
            # created wnull.
737
 
            popen_args = { "close_fds": True,
738
 
                           "shell": True,
739
 
                           "cwd": "/" }
740
 
            if (not self.server_settings["debug"]
741
 
                and self.server_settings["foreground"]):
742
 
                popen_args.update({"stdout": wnull,
743
 
                                   "stderr": wnull })
744
 
            pipe = multiprocessing.Pipe(duplex = False)
745
 
            self.checker = multiprocessing.Process(
746
 
                target = call_pipe,
747
 
                args = (pipe[1], subprocess.call, command),
748
 
                kwargs = popen_args)
749
 
            self.checker.start()
750
 
            self.checker_callback_tag = gobject.io_add_watch(
751
 
                pipe[0].fileno(), gobject.IO_IN,
752
 
                self.checker_callback, pipe[0], command)
 
743
                return True
 
744
            self.checker_callback_tag = (gobject.child_watch_add
 
745
                                         (self.checker.pid,
 
746
                                          self.checker_callback,
 
747
                                          data=command))
 
748
            # The checker may have completed before the gobject
 
749
            # watch was added.  Check for this.
 
750
            try:
 
751
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
752
            except OSError as error:
 
753
                if error.errno == errno.ECHILD:
 
754
                    # This should never happen
 
755
                    logger.error("Child process vanished",
 
756
                                 exc_info=error)
 
757
                    return True
 
758
                raise
 
759
            if pid:
 
760
                gobject.source_remove(self.checker_callback_tag)
 
761
                self.checker_callback(pid, status, command)
753
762
        # Re-run this periodically if run by gobject.timeout_add
754
763
        return True
755
764
    
761
770
        if getattr(self, "checker", None) is None:
762
771
            return
763
772
        logger.debug("Stopping checker for %(name)s", vars(self))
764
 
        self.checker.terminate()
 
773
        try:
 
774
            self.checker.terminate()
 
775
            #time.sleep(0.5)
 
776
            #if self.checker.poll() is None:
 
777
            #    self.checker.kill()
 
778
        except OSError as error:
 
779
            if error.errno != errno.ESRCH: # No such process
 
780
                raise
765
781
        self.checker = None
766
782
 
767
783
 
768
 
def dbus_service_property(dbus_interface,
769
 
                          signature="v",
770
 
                          access="readwrite",
771
 
                          byte_arrays=False):
 
784
def dbus_service_property(dbus_interface, signature="v",
 
785
                          access="readwrite", byte_arrays=False):
772
786
    """Decorators for marking methods of a DBusObjectWithProperties to
773
787
    become properties on the D-Bus.
774
788
    
783
797
    # "Set" method, so we fail early here:
784
798
    if byte_arrays and signature != "ay":
785
799
        raise ValueError("Byte arrays not supported for non-'ay'"
786
 
                         " signature {!r}".format(signature))
787
 
    
 
800
                         " signature {0!r}".format(signature))
788
801
    def decorator(func):
789
802
        func._dbus_is_property = True
790
803
        func._dbus_interface = dbus_interface
795
808
            func._dbus_name = func._dbus_name[:-14]
796
809
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
797
810
        return func
798
 
    
799
811
    return decorator
800
812
 
801
813
 
810
822
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
811
823
                    "false"}
812
824
    """
813
 
    
814
825
    def decorator(func):
815
826
        func._dbus_is_interface = True
816
827
        func._dbus_interface = dbus_interface
817
828
        func._dbus_name = dbus_interface
818
829
        return func
819
 
    
820
830
    return decorator
821
831
 
822
832
 
824
834
    """Decorator to annotate D-Bus methods, signals or properties
825
835
    Usage:
826
836
    
827
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
828
 
                       "org.freedesktop.DBus.Property."
829
 
                       "EmitsChangedSignal": "false"})
830
837
    @dbus_service_property("org.example.Interface", signature="b",
831
838
                           access="r")
 
839
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
840
                        "org.freedesktop.DBus.Property."
 
841
                        "EmitsChangedSignal": "false"})
832
842
    def Property_dbus_property(self):
833
843
        return dbus.Boolean(False)
834
844
    """
835
 
    
836
845
    def decorator(func):
837
846
        func._dbus_annotations = annotations
838
847
        return func
839
 
    
840
848
    return decorator
841
849
 
842
850
 
843
851
class DBusPropertyException(dbus.exceptions.DBusException):
844
852
    """A base class for D-Bus property-related exceptions
845
853
    """
846
 
    pass
 
854
    def __unicode__(self):
 
855
        return unicode(str(self))
847
856
 
848
857
 
849
858
class DBusPropertyAccessException(DBusPropertyException):
873
882
        If called like _is_dbus_thing("method") it returns a function
874
883
        suitable for use as predicate to inspect.getmembers().
875
884
        """
876
 
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
 
885
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
877
886
                                   False)
878
887
    
879
888
    def _get_all_dbus_things(self, thing):
880
889
        """Returns a generator of (name, attribute) pairs
881
890
        """
882
 
        return ((getattr(athing.__get__(self), "_dbus_name", name),
 
891
        return ((getattr(athing.__get__(self), "_dbus_name",
 
892
                         name),
883
893
                 athing.__get__(self))
884
894
                for cls in self.__class__.__mro__
885
895
                for name, athing in
886
 
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
896
                inspect.getmembers(cls,
 
897
                                   self._is_dbus_thing(thing)))
887
898
    
888
899
    def _get_dbus_property(self, interface_name, property_name):
889
900
        """Returns a bound method if one exists which is a D-Bus
890
901
        property with the specified name and interface.
891
902
        """
892
 
        for cls in self.__class__.__mro__:
893
 
            for name, value in inspect.getmembers(
894
 
                    cls, self._is_dbus_thing("property")):
 
903
        for cls in  self.__class__.__mro__:
 
904
            for name, value in (inspect.getmembers
 
905
                                (cls,
 
906
                                 self._is_dbus_thing("property"))):
895
907
                if (value._dbus_name == property_name
896
908
                    and value._dbus_interface == interface_name):
897
909
                    return value.__get__(self)
898
910
        
899
911
        # No such property
900
 
        raise DBusPropertyNotFound("{}:{}.{}".format(
901
 
            self.dbus_object_path, interface_name, property_name))
 
912
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
913
                                   + interface_name + "."
 
914
                                   + property_name)
902
915
    
903
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
904
 
                         in_signature="ss",
 
916
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
905
917
                         out_signature="v")
906
918
    def Get(self, interface_name, property_name):
907
919
        """Standard D-Bus property Get() method, see D-Bus standard.
926
938
            # signatures other than "ay".
927
939
            if prop._dbus_signature != "ay":
928
940
                raise ValueError("Byte arrays not supported for non-"
929
 
                                 "'ay' signature {!r}"
 
941
                                 "'ay' signature {0!r}"
930
942
                                 .format(prop._dbus_signature))
931
943
            value = dbus.ByteArray(b''.join(chr(byte)
932
944
                                            for byte in value))
933
945
        prop(value)
934
946
    
935
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
936
 
                         in_signature="s",
 
947
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
937
948
                         out_signature="a{sv}")
938
949
    def GetAll(self, interface_name):
939
950
        """Standard D-Bus property GetAll() method, see D-Bus
954
965
            if not hasattr(value, "variant_level"):
955
966
                properties[name] = value
956
967
                continue
957
 
            properties[name] = type(value)(
958
 
                value, variant_level = value.variant_level + 1)
 
968
            properties[name] = type(value)(value, variant_level=
 
969
                                           value.variant_level+1)
959
970
        return dbus.Dictionary(properties, signature="sv")
960
971
    
961
 
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
962
 
    def PropertiesChanged(self, interface_name, changed_properties,
963
 
                          invalidated_properties):
964
 
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
965
 
        standard.
966
 
        """
967
 
        pass
968
 
    
969
972
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
970
973
                         out_signature="s",
971
974
                         path_keyword='object_path',
979
982
                                                   connection)
980
983
        try:
981
984
            document = xml.dom.minidom.parseString(xmlstring)
982
 
            
983
985
            def make_tag(document, name, prop):
984
986
                e = document.createElement("property")
985
987
                e.setAttribute("name", name)
986
988
                e.setAttribute("type", prop._dbus_signature)
987
989
                e.setAttribute("access", prop._dbus_access)
988
990
                return e
989
 
            
990
991
            for if_tag in document.getElementsByTagName("interface"):
991
992
                # Add property tags
992
993
                for tag in (make_tag(document, name, prop)
1004
1005
                            if (name == tag.getAttribute("name")
1005
1006
                                and prop._dbus_interface
1006
1007
                                == if_tag.getAttribute("name")):
1007
 
                                annots.update(getattr(
1008
 
                                    prop, "_dbus_annotations", {}))
1009
 
                        for name, value in annots.items():
 
1008
                                annots.update(getattr
 
1009
                                              (prop,
 
1010
                                               "_dbus_annotations",
 
1011
                                               {}))
 
1012
                        for name, value in annots.iteritems():
1010
1013
                            ann_tag = document.createElement(
1011
1014
                                "annotation")
1012
1015
                            ann_tag.setAttribute("name", name)
1015
1018
                # Add interface annotation tags
1016
1019
                for annotation, value in dict(
1017
1020
                    itertools.chain.from_iterable(
1018
 
                        annotations().items()
1019
 
                        for name, annotations
1020
 
                        in self._get_all_dbus_things("interface")
 
1021
                        annotations().iteritems()
 
1022
                        for name, annotations in
 
1023
                        self._get_all_dbus_things("interface")
1021
1024
                        if name == if_tag.getAttribute("name")
1022
 
                        )).items():
 
1025
                        )).iteritems():
1023
1026
                    ann_tag = document.createElement("annotation")
1024
1027
                    ann_tag.setAttribute("name", annotation)
1025
1028
                    ann_tag.setAttribute("value", value)
1052
1055
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1053
1056
    if dt is None:
1054
1057
        return dbus.String("", variant_level = variant_level)
1055
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
 
1058
    return dbus.String(dt.isoformat(),
 
1059
                       variant_level=variant_level)
1056
1060
 
1057
1061
 
1058
1062
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1078
1082
    (from DBusObjectWithProperties) and interfaces (from the
1079
1083
    dbus_interface_annotations decorator).
1080
1084
    """
1081
 
    
1082
1085
    def wrapper(cls):
1083
1086
        for orig_interface_name, alt_interface_name in (
1084
 
                alt_interface_names.items()):
 
1087
            alt_interface_names.iteritems()):
1085
1088
            attr = {}
1086
1089
            interface_names = set()
1087
1090
            # Go though all attributes of the class
1089
1092
                # Ignore non-D-Bus attributes, and D-Bus attributes
1090
1093
                # with the wrong interface name
1091
1094
                if (not hasattr(attribute, "_dbus_interface")
1092
 
                    or not attribute._dbus_interface.startswith(
1093
 
                        orig_interface_name)):
 
1095
                    or not attribute._dbus_interface
 
1096
                    .startswith(orig_interface_name)):
1094
1097
                    continue
1095
1098
                # Create an alternate D-Bus interface name based on
1096
1099
                # the current name
1097
 
                alt_interface = attribute._dbus_interface.replace(
1098
 
                    orig_interface_name, alt_interface_name)
 
1100
                alt_interface = (attribute._dbus_interface
 
1101
                                 .replace(orig_interface_name,
 
1102
                                          alt_interface_name))
1099
1103
                interface_names.add(alt_interface)
1100
1104
                # Is this a D-Bus signal?
1101
1105
                if getattr(attribute, "_dbus_is_signal", False):
1102
 
                    if sys.version_info.major == 2:
1103
 
                        # Extract the original non-method undecorated
1104
 
                        # function by black magic
1105
 
                        nonmethod_func = (dict(
 
1106
                    # Extract the original non-method undecorated
 
1107
                    # function by black magic
 
1108
                    nonmethod_func = (dict(
1106
1109
                            zip(attribute.func_code.co_freevars,
1107
 
                                attribute.__closure__))
1108
 
                                          ["func"].cell_contents)
1109
 
                    else:
1110
 
                        nonmethod_func = attribute
 
1110
                                attribute.__closure__))["func"]
 
1111
                                      .cell_contents)
1111
1112
                    # Create a new, but exactly alike, function
1112
1113
                    # object, and decorate it to be a new D-Bus signal
1113
1114
                    # with the alternate D-Bus interface name
1114
 
                    if sys.version_info.major == 2:
1115
 
                        new_function = types.FunctionType(
1116
 
                            nonmethod_func.func_code,
1117
 
                            nonmethod_func.func_globals,
1118
 
                            nonmethod_func.func_name,
1119
 
                            nonmethod_func.func_defaults,
1120
 
                            nonmethod_func.func_closure)
1121
 
                    else:
1122
 
                        new_function = types.FunctionType(
1123
 
                            nonmethod_func.__code__,
1124
 
                            nonmethod_func.__globals__,
1125
 
                            nonmethod_func.__name__,
1126
 
                            nonmethod_func.__defaults__,
1127
 
                            nonmethod_func.__closure__)
1128
 
                    new_function = (dbus.service.signal(
1129
 
                        alt_interface,
1130
 
                        attribute._dbus_signature)(new_function))
 
1115
                    new_function = (dbus.service.signal
 
1116
                                    (alt_interface,
 
1117
                                     attribute._dbus_signature)
 
1118
                                    (types.FunctionType(
 
1119
                                nonmethod_func.func_code,
 
1120
                                nonmethod_func.func_globals,
 
1121
                                nonmethod_func.func_name,
 
1122
                                nonmethod_func.func_defaults,
 
1123
                                nonmethod_func.func_closure)))
1131
1124
                    # Copy annotations, if any
1132
1125
                    try:
1133
 
                        new_function._dbus_annotations = dict(
1134
 
                            attribute._dbus_annotations)
 
1126
                        new_function._dbus_annotations = (
 
1127
                            dict(attribute._dbus_annotations))
1135
1128
                    except AttributeError:
1136
1129
                        pass
1137
1130
                    # Define a creator of a function to call both the
1142
1135
                        """This function is a scope container to pass
1143
1136
                        func1 and func2 to the "call_both" function
1144
1137
                        outside of its arguments"""
1145
 
                        
1146
1138
                        def call_both(*args, **kwargs):
1147
1139
                            """This function will emit two D-Bus
1148
1140
                            signals by calling func1 and func2"""
1149
1141
                            func1(*args, **kwargs)
1150
1142
                            func2(*args, **kwargs)
1151
 
                        
1152
1143
                        return call_both
1153
1144
                    # Create the "call_both" function and add it to
1154
1145
                    # the class
1159
1150
                    # object.  Decorate it to be a new D-Bus method
1160
1151
                    # with the alternate D-Bus interface name.  Add it
1161
1152
                    # to the class.
1162
 
                    attr[attrname] = (
1163
 
                        dbus.service.method(
1164
 
                            alt_interface,
1165
 
                            attribute._dbus_in_signature,
1166
 
                            attribute._dbus_out_signature)
1167
 
                        (types.FunctionType(attribute.func_code,
1168
 
                                            attribute.func_globals,
1169
 
                                            attribute.func_name,
1170
 
                                            attribute.func_defaults,
1171
 
                                            attribute.func_closure)))
 
1153
                    attr[attrname] = (dbus.service.method
 
1154
                                      (alt_interface,
 
1155
                                       attribute._dbus_in_signature,
 
1156
                                       attribute._dbus_out_signature)
 
1157
                                      (types.FunctionType
 
1158
                                       (attribute.func_code,
 
1159
                                        attribute.func_globals,
 
1160
                                        attribute.func_name,
 
1161
                                        attribute.func_defaults,
 
1162
                                        attribute.func_closure)))
1172
1163
                    # Copy annotations, if any
1173
1164
                    try:
1174
 
                        attr[attrname]._dbus_annotations = dict(
1175
 
                            attribute._dbus_annotations)
 
1165
                        attr[attrname]._dbus_annotations = (
 
1166
                            dict(attribute._dbus_annotations))
1176
1167
                    except AttributeError:
1177
1168
                        pass
1178
1169
                # Is this a D-Bus property?
1181
1172
                    # object, and decorate it to be a new D-Bus
1182
1173
                    # property with the alternate D-Bus interface
1183
1174
                    # name.  Add it to the class.
1184
 
                    attr[attrname] = (dbus_service_property(
1185
 
                        alt_interface, attribute._dbus_signature,
1186
 
                        attribute._dbus_access,
1187
 
                        attribute._dbus_get_args_options
1188
 
                        ["byte_arrays"])
1189
 
                                      (types.FunctionType(
1190
 
                                          attribute.func_code,
1191
 
                                          attribute.func_globals,
1192
 
                                          attribute.func_name,
1193
 
                                          attribute.func_defaults,
1194
 
                                          attribute.func_closure)))
 
1175
                    attr[attrname] = (dbus_service_property
 
1176
                                      (alt_interface,
 
1177
                                       attribute._dbus_signature,
 
1178
                                       attribute._dbus_access,
 
1179
                                       attribute
 
1180
                                       ._dbus_get_args_options
 
1181
                                       ["byte_arrays"])
 
1182
                                      (types.FunctionType
 
1183
                                       (attribute.func_code,
 
1184
                                        attribute.func_globals,
 
1185
                                        attribute.func_name,
 
1186
                                        attribute.func_defaults,
 
1187
                                        attribute.func_closure)))
1195
1188
                    # Copy annotations, if any
1196
1189
                    try:
1197
 
                        attr[attrname]._dbus_annotations = dict(
1198
 
                            attribute._dbus_annotations)
 
1190
                        attr[attrname]._dbus_annotations = (
 
1191
                            dict(attribute._dbus_annotations))
1199
1192
                    except AttributeError:
1200
1193
                        pass
1201
1194
                # Is this a D-Bus interface?
1204
1197
                    # object.  Decorate it to be a new D-Bus interface
1205
1198
                    # with the alternate D-Bus interface name.  Add it
1206
1199
                    # to the class.
1207
 
                    attr[attrname] = (
1208
 
                        dbus_interface_annotations(alt_interface)
1209
 
                        (types.FunctionType(attribute.func_code,
1210
 
                                            attribute.func_globals,
1211
 
                                            attribute.func_name,
1212
 
                                            attribute.func_defaults,
1213
 
                                            attribute.func_closure)))
 
1200
                    attr[attrname] = (dbus_interface_annotations
 
1201
                                      (alt_interface)
 
1202
                                      (types.FunctionType
 
1203
                                       (attribute.func_code,
 
1204
                                        attribute.func_globals,
 
1205
                                        attribute.func_name,
 
1206
                                        attribute.func_defaults,
 
1207
                                        attribute.func_closure)))
1214
1208
            if deprecate:
1215
1209
                # Deprecate all alternate interfaces
1216
 
                iname="_AlternateDBusNames_interface_annotation{}"
 
1210
                iname="_AlternateDBusNames_interface_annotation{0}"
1217
1211
                for interface_name in interface_names:
1218
 
                    
1219
1212
                    @dbus_interface_annotations(interface_name)
1220
1213
                    def func(self):
1221
1214
                        return { "org.freedesktop.DBus.Deprecated":
1222
 
                                 "true" }
 
1215
                                     "true" }
1223
1216
                    # Find an unused name
1224
1217
                    for aname in (iname.format(i)
1225
1218
                                  for i in itertools.count()):
1229
1222
            if interface_names:
1230
1223
                # Replace the class with a new subclass of it with
1231
1224
                # methods, signals, etc. as created above.
1232
 
                cls = type(b"{}Alternate".format(cls.__name__),
1233
 
                           (cls, ), attr)
 
1225
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1226
                           (cls,), attr)
1234
1227
        return cls
1235
 
    
1236
1228
    return wrapper
1237
1229
 
1238
1230
 
1239
1231
@alternate_dbus_interfaces({"se.recompile.Mandos":
1240
 
                            "se.bsnet.fukt.Mandos"})
 
1232
                                "se.bsnet.fukt.Mandos"})
1241
1233
class ClientDBus(Client, DBusObjectWithProperties):
1242
1234
    """A Client class using D-Bus
1243
1235
    
1247
1239
    """
1248
1240
    
1249
1241
    runtime_expansions = (Client.runtime_expansions
1250
 
                          + ("dbus_object_path", ))
1251
 
    
1252
 
    _interface = "se.recompile.Mandos.Client"
 
1242
                          + ("dbus_object_path",))
1253
1243
    
1254
1244
    # dbus.service.Object doesn't use super(), so we can't either.
1255
1245
    
1258
1248
        Client.__init__(self, *args, **kwargs)
1259
1249
        # Only now, when this client is initialized, can it show up on
1260
1250
        # the D-Bus
1261
 
        client_object_name = str(self.name).translate(
 
1251
        client_object_name = unicode(self.name).translate(
1262
1252
            {ord("."): ord("_"),
1263
1253
             ord("-"): ord("_")})
1264
 
        self.dbus_object_path = dbus.ObjectPath(
1265
 
            "/clients/" + client_object_name)
 
1254
        self.dbus_object_path = (dbus.ObjectPath
 
1255
                                 ("/clients/" + client_object_name))
1266
1256
        DBusObjectWithProperties.__init__(self, self.bus,
1267
1257
                                          self.dbus_object_path)
1268
1258
    
1269
 
    def notifychangeproperty(transform_func, dbus_name,
1270
 
                             type_func=lambda x: x,
1271
 
                             variant_level=1,
1272
 
                             invalidate_only=False,
1273
 
                             _interface=_interface):
 
1259
    def notifychangeproperty(transform_func,
 
1260
                             dbus_name, type_func=lambda x: x,
 
1261
                             variant_level=1):
1274
1262
        """ Modify a variable so that it's a property which announces
1275
1263
        its changes to DBus.
1276
1264
        
1281
1269
                   to the D-Bus.  Default: no transform
1282
1270
        variant_level: D-Bus variant level.  Default: 1
1283
1271
        """
1284
 
        attrname = "_{}".format(dbus_name)
1285
 
        
 
1272
        attrname = "_{0}".format(dbus_name)
1286
1273
        def setter(self, value):
1287
1274
            if hasattr(self, "dbus_object_path"):
1288
1275
                if (not hasattr(self, attrname) or
1289
1276
                    type_func(getattr(self, attrname, None))
1290
1277
                    != type_func(value)):
1291
 
                    if invalidate_only:
1292
 
                        self.PropertiesChanged(
1293
 
                            _interface, dbus.Dictionary(),
1294
 
                            dbus.Array((dbus_name, )))
1295
 
                    else:
1296
 
                        dbus_value = transform_func(
1297
 
                            type_func(value),
1298
 
                            variant_level = variant_level)
1299
 
                        self.PropertyChanged(dbus.String(dbus_name),
1300
 
                                             dbus_value)
1301
 
                        self.PropertiesChanged(
1302
 
                            _interface,
1303
 
                            dbus.Dictionary({ dbus.String(dbus_name):
1304
 
                                              dbus_value }),
1305
 
                            dbus.Array())
 
1278
                    dbus_value = transform_func(type_func(value),
 
1279
                                                variant_level
 
1280
                                                =variant_level)
 
1281
                    self.PropertyChanged(dbus.String(dbus_name),
 
1282
                                         dbus_value)
1306
1283
            setattr(self, attrname, value)
1307
1284
        
1308
1285
        return property(lambda self: getattr(self, attrname), setter)
1314
1291
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1315
1292
    last_enabled = notifychangeproperty(datetime_to_dbus,
1316
1293
                                        "LastEnabled")
1317
 
    checker = notifychangeproperty(
1318
 
        dbus.Boolean, "CheckerRunning",
1319
 
        type_func = lambda checker: checker is not None)
 
1294
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1295
                                   type_func = lambda checker:
 
1296
                                       checker is not None)
1320
1297
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1321
1298
                                           "LastCheckedOK")
1322
1299
    last_checker_status = notifychangeproperty(dbus.Int16,
1325
1302
        datetime_to_dbus, "LastApprovalRequest")
1326
1303
    approved_by_default = notifychangeproperty(dbus.Boolean,
1327
1304
                                               "ApprovedByDefault")
1328
 
    approval_delay = notifychangeproperty(
1329
 
        dbus.UInt64, "ApprovalDelay",
1330
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1305
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1306
                                          "ApprovalDelay",
 
1307
                                          type_func =
 
1308
                                          timedelta_to_milliseconds)
1331
1309
    approval_duration = notifychangeproperty(
1332
1310
        dbus.UInt64, "ApprovalDuration",
1333
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1311
        type_func = timedelta_to_milliseconds)
1334
1312
    host = notifychangeproperty(dbus.String, "Host")
1335
 
    timeout = notifychangeproperty(
1336
 
        dbus.UInt64, "Timeout",
1337
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1313
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1314
                                   type_func =
 
1315
                                   timedelta_to_milliseconds)
1338
1316
    extended_timeout = notifychangeproperty(
1339
1317
        dbus.UInt64, "ExtendedTimeout",
1340
 
        type_func = lambda td: td.total_seconds() * 1000)
1341
 
    interval = notifychangeproperty(
1342
 
        dbus.UInt64, "Interval",
1343
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1318
        type_func = timedelta_to_milliseconds)
 
1319
    interval = notifychangeproperty(dbus.UInt64,
 
1320
                                    "Interval",
 
1321
                                    type_func =
 
1322
                                    timedelta_to_milliseconds)
1344
1323
    checker_command = notifychangeproperty(dbus.String, "Checker")
1345
 
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1346
 
                                  invalidate_only=True)
1347
1324
    
1348
1325
    del notifychangeproperty
1349
1326
    
1356
1333
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1357
1334
        Client.__del__(self, *args, **kwargs)
1358
1335
    
1359
 
    def checker_callback(self, source, condition,
1360
 
                         connection, command, *args, **kwargs):
1361
 
        ret = Client.checker_callback(self, source, condition,
1362
 
                                      connection, command, *args,
1363
 
                                      **kwargs)
1364
 
        exitstatus = self.last_checker_status
1365
 
        if exitstatus >= 0:
 
1336
    def checker_callback(self, pid, condition, command,
 
1337
                         *args, **kwargs):
 
1338
        self.checker_callback_tag = None
 
1339
        self.checker = None
 
1340
        if os.WIFEXITED(condition):
 
1341
            exitstatus = os.WEXITSTATUS(condition)
1366
1342
            # Emit D-Bus signal
1367
1343
            self.CheckerCompleted(dbus.Int16(exitstatus),
1368
 
                                  dbus.Int64(0),
 
1344
                                  dbus.Int64(condition),
1369
1345
                                  dbus.String(command))
1370
1346
        else:
1371
1347
            # Emit D-Bus signal
1372
1348
            self.CheckerCompleted(dbus.Int16(-1),
1373
 
                                  dbus.Int64(
1374
 
                                      self.last_checker_signal),
 
1349
                                  dbus.Int64(condition),
1375
1350
                                  dbus.String(command))
1376
 
        return ret
 
1351
        
 
1352
        return Client.checker_callback(self, pid, condition, command,
 
1353
                                       *args, **kwargs)
1377
1354
    
1378
1355
    def start_checker(self, *args, **kwargs):
1379
1356
        old_checker_pid = getattr(self.checker, "pid", None)
1391
1368
    
1392
1369
    def approve(self, value=True):
1393
1370
        self.approved = value
1394
 
        gobject.timeout_add(int(self.approval_duration.total_seconds()
1395
 
                                * 1000), self._reset_approved)
 
1371
        gobject.timeout_add(timedelta_to_milliseconds
 
1372
                            (self.approval_duration),
 
1373
                            self._reset_approved)
1396
1374
        self.send_changedstate()
1397
1375
    
1398
1376
    ## D-Bus methods, signals & properties
 
1377
    _interface = "se.recompile.Mandos.Client"
1399
1378
    
1400
1379
    ## Interfaces
1401
1380
    
 
1381
    @dbus_interface_annotations(_interface)
 
1382
    def _foo(self):
 
1383
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1384
                     "false"}
 
1385
    
1402
1386
    ## Signals
1403
1387
    
1404
1388
    # CheckerCompleted - signal
1414
1398
        pass
1415
1399
    
1416
1400
    # PropertyChanged - signal
1417
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1418
1401
    @dbus.service.signal(_interface, signature="sv")
1419
1402
    def PropertyChanged(self, property, value):
1420
1403
        "D-Bus signal"
1484
1467
        return dbus.Boolean(bool(self.approvals_pending))
1485
1468
    
1486
1469
    # ApprovedByDefault - property
1487
 
    @dbus_service_property(_interface,
1488
 
                           signature="b",
 
1470
    @dbus_service_property(_interface, signature="b",
1489
1471
                           access="readwrite")
1490
1472
    def ApprovedByDefault_dbus_property(self, value=None):
1491
1473
        if value is None:       # get
1493
1475
        self.approved_by_default = bool(value)
1494
1476
    
1495
1477
    # ApprovalDelay - property
1496
 
    @dbus_service_property(_interface,
1497
 
                           signature="t",
 
1478
    @dbus_service_property(_interface, signature="t",
1498
1479
                           access="readwrite")
1499
1480
    def ApprovalDelay_dbus_property(self, value=None):
1500
1481
        if value is None:       # get
1501
 
            return dbus.UInt64(self.approval_delay.total_seconds()
1502
 
                               * 1000)
 
1482
            return dbus.UInt64(self.approval_delay_milliseconds())
1503
1483
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1504
1484
    
1505
1485
    # ApprovalDuration - property
1506
 
    @dbus_service_property(_interface,
1507
 
                           signature="t",
 
1486
    @dbus_service_property(_interface, signature="t",
1508
1487
                           access="readwrite")
1509
1488
    def ApprovalDuration_dbus_property(self, value=None):
1510
1489
        if value is None:       # get
1511
 
            return dbus.UInt64(self.approval_duration.total_seconds()
1512
 
                               * 1000)
 
1490
            return dbus.UInt64(timedelta_to_milliseconds(
 
1491
                    self.approval_duration))
1513
1492
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1514
1493
    
1515
1494
    # Name - property
1523
1502
        return dbus.String(self.fingerprint)
1524
1503
    
1525
1504
    # Host - property
1526
 
    @dbus_service_property(_interface,
1527
 
                           signature="s",
 
1505
    @dbus_service_property(_interface, signature="s",
1528
1506
                           access="readwrite")
1529
1507
    def Host_dbus_property(self, value=None):
1530
1508
        if value is None:       # get
1531
1509
            return dbus.String(self.host)
1532
 
        self.host = str(value)
 
1510
        self.host = unicode(value)
1533
1511
    
1534
1512
    # Created - property
1535
1513
    @dbus_service_property(_interface, signature="s", access="read")
1542
1520
        return datetime_to_dbus(self.last_enabled)
1543
1521
    
1544
1522
    # Enabled - property
1545
 
    @dbus_service_property(_interface,
1546
 
                           signature="b",
 
1523
    @dbus_service_property(_interface, signature="b",
1547
1524
                           access="readwrite")
1548
1525
    def Enabled_dbus_property(self, value=None):
1549
1526
        if value is None:       # get
1554
1531
            self.disable()
1555
1532
    
1556
1533
    # LastCheckedOK - property
1557
 
    @dbus_service_property(_interface,
1558
 
                           signature="s",
 
1534
    @dbus_service_property(_interface, signature="s",
1559
1535
                           access="readwrite")
1560
1536
    def LastCheckedOK_dbus_property(self, value=None):
1561
1537
        if value is not None:
1564
1540
        return datetime_to_dbus(self.last_checked_ok)
1565
1541
    
1566
1542
    # LastCheckerStatus - property
1567
 
    @dbus_service_property(_interface, signature="n", access="read")
 
1543
    @dbus_service_property(_interface, signature="n",
 
1544
                           access="read")
1568
1545
    def LastCheckerStatus_dbus_property(self):
1569
1546
        return dbus.Int16(self.last_checker_status)
1570
1547
    
1579
1556
        return datetime_to_dbus(self.last_approval_request)
1580
1557
    
1581
1558
    # Timeout - property
1582
 
    @dbus_service_property(_interface,
1583
 
                           signature="t",
 
1559
    @dbus_service_property(_interface, signature="t",
1584
1560
                           access="readwrite")
1585
1561
    def Timeout_dbus_property(self, value=None):
1586
1562
        if value is None:       # get
1587
 
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
 
1563
            return dbus.UInt64(self.timeout_milliseconds())
1588
1564
        old_timeout = self.timeout
1589
1565
        self.timeout = datetime.timedelta(0, 0, 0, value)
1590
1566
        # Reschedule disabling
1599
1575
                    is None):
1600
1576
                    return
1601
1577
                gobject.source_remove(self.disable_initiator_tag)
1602
 
                self.disable_initiator_tag = gobject.timeout_add(
1603
 
                    int((self.expires - now).total_seconds() * 1000),
1604
 
                    self.disable)
 
1578
                self.disable_initiator_tag = (
 
1579
                    gobject.timeout_add(
 
1580
                        timedelta_to_milliseconds(self.expires - now),
 
1581
                        self.disable))
1605
1582
    
1606
1583
    # ExtendedTimeout - property
1607
 
    @dbus_service_property(_interface,
1608
 
                           signature="t",
 
1584
    @dbus_service_property(_interface, signature="t",
1609
1585
                           access="readwrite")
1610
1586
    def ExtendedTimeout_dbus_property(self, value=None):
1611
1587
        if value is None:       # get
1612
 
            return dbus.UInt64(self.extended_timeout.total_seconds()
1613
 
                               * 1000)
 
1588
            return dbus.UInt64(self.extended_timeout_milliseconds())
1614
1589
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1615
1590
    
1616
1591
    # Interval - property
1617
 
    @dbus_service_property(_interface,
1618
 
                           signature="t",
 
1592
    @dbus_service_property(_interface, signature="t",
1619
1593
                           access="readwrite")
1620
1594
    def Interval_dbus_property(self, value=None):
1621
1595
        if value is None:       # get
1622
 
            return dbus.UInt64(self.interval.total_seconds() * 1000)
 
1596
            return dbus.UInt64(self.interval_milliseconds())
1623
1597
        self.interval = datetime.timedelta(0, 0, 0, value)
1624
1598
        if getattr(self, "checker_initiator_tag", None) is None:
1625
1599
            return
1626
1600
        if self.enabled:
1627
1601
            # Reschedule checker run
1628
1602
            gobject.source_remove(self.checker_initiator_tag)
1629
 
            self.checker_initiator_tag = gobject.timeout_add(
1630
 
                value, self.start_checker)
1631
 
            self.start_checker() # Start one now, too
 
1603
            self.checker_initiator_tag = (gobject.timeout_add
 
1604
                                          (value, self.start_checker))
 
1605
            self.start_checker()    # Start one now, too
1632
1606
    
1633
1607
    # Checker - property
1634
 
    @dbus_service_property(_interface,
1635
 
                           signature="s",
 
1608
    @dbus_service_property(_interface, signature="s",
1636
1609
                           access="readwrite")
1637
1610
    def Checker_dbus_property(self, value=None):
1638
1611
        if value is None:       # get
1639
1612
            return dbus.String(self.checker_command)
1640
 
        self.checker_command = str(value)
 
1613
        self.checker_command = unicode(value)
1641
1614
    
1642
1615
    # CheckerRunning - property
1643
 
    @dbus_service_property(_interface,
1644
 
                           signature="b",
 
1616
    @dbus_service_property(_interface, signature="b",
1645
1617
                           access="readwrite")
1646
1618
    def CheckerRunning_dbus_property(self, value=None):
1647
1619
        if value is None:       # get
1657
1629
        return self.dbus_object_path # is already a dbus.ObjectPath
1658
1630
    
1659
1631
    # Secret = property
1660
 
    @dbus_service_property(_interface,
1661
 
                           signature="ay",
1662
 
                           access="write",
1663
 
                           byte_arrays=True)
 
1632
    @dbus_service_property(_interface, signature="ay",
 
1633
                           access="write", byte_arrays=True)
1664
1634
    def Secret_dbus_property(self, value):
1665
 
        self.secret = bytes(value)
 
1635
        self.secret = str(value)
1666
1636
    
1667
1637
    del _interface
1668
1638
 
1672
1642
        self._pipe = child_pipe
1673
1643
        self._pipe.send(('init', fpr, address))
1674
1644
        if not self._pipe.recv():
1675
 
            raise KeyError(fpr)
 
1645
            raise KeyError()
1676
1646
    
1677
1647
    def __getattribute__(self, name):
1678
1648
        if name == '_pipe':
1682
1652
        if data[0] == 'data':
1683
1653
            return data[1]
1684
1654
        if data[0] == 'function':
1685
 
            
1686
1655
            def func(*args, **kwargs):
1687
1656
                self._pipe.send(('funcall', name, args, kwargs))
1688
1657
                return self._pipe.recv()[1]
1689
 
            
1690
1658
            return func
1691
1659
    
1692
1660
    def __setattr__(self, name, value):
1704
1672
    def handle(self):
1705
1673
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1706
1674
            logger.info("TCP connection from: %s",
1707
 
                        str(self.client_address))
 
1675
                        unicode(self.client_address))
1708
1676
            logger.debug("Pipe FD: %d",
1709
1677
                         self.server.child_pipe.fileno())
1710
1678
            
1711
 
            session = gnutls.connection.ClientSession(
1712
 
                self.request, gnutls.connection .X509Credentials())
 
1679
            session = (gnutls.connection
 
1680
                       .ClientSession(self.request,
 
1681
                                      gnutls.connection
 
1682
                                      .X509Credentials()))
1713
1683
            
1714
1684
            # Note: gnutls.connection.X509Credentials is really a
1715
1685
            # generic GnuTLS certificate credentials object so long as
1724
1694
            priority = self.server.gnutls_priority
1725
1695
            if priority is None:
1726
1696
                priority = "NORMAL"
1727
 
            gnutls.library.functions.gnutls_priority_set_direct(
1728
 
                session._c_object, priority, None)
 
1697
            (gnutls.library.functions
 
1698
             .gnutls_priority_set_direct(session._c_object,
 
1699
                                         priority, None))
1729
1700
            
1730
1701
            # Start communication using the Mandos protocol
1731
1702
            # Get protocol number
1751
1722
            approval_required = False
1752
1723
            try:
1753
1724
                try:
1754
 
                    fpr = self.fingerprint(
1755
 
                        self.peer_certificate(session))
 
1725
                    fpr = self.fingerprint(self.peer_certificate
 
1726
                                           (session))
1756
1727
                except (TypeError,
1757
1728
                        gnutls.errors.GNUTLSError) as error:
1758
1729
                    logger.warning("Bad certificate: %s", error)
1773
1744
                while True:
1774
1745
                    if not client.enabled:
1775
1746
                        logger.info("Client %s is disabled",
1776
 
                                    client.name)
 
1747
                                       client.name)
1777
1748
                        if self.server.use_dbus:
1778
1749
                            # Emit D-Bus signal
1779
1750
                            client.Rejected("Disabled")
1788
1759
                        if self.server.use_dbus:
1789
1760
                            # Emit D-Bus signal
1790
1761
                            client.NeedApproval(
1791
 
                                client.approval_delay.total_seconds()
1792
 
                                * 1000, client.approved_by_default)
 
1762
                                client.approval_delay_milliseconds(),
 
1763
                                client.approved_by_default)
1793
1764
                    else:
1794
1765
                        logger.warning("Client %s was not approved",
1795
1766
                                       client.name)
1801
1772
                    #wait until timeout or approved
1802
1773
                    time = datetime.datetime.now()
1803
1774
                    client.changedstate.acquire()
1804
 
                    client.changedstate.wait(delay.total_seconds())
 
1775
                    client.changedstate.wait(
 
1776
                        float(timedelta_to_milliseconds(delay)
 
1777
                              / 1000))
1805
1778
                    client.changedstate.release()
1806
1779
                    time2 = datetime.datetime.now()
1807
1780
                    if (time2 - time) >= delay:
1826
1799
                        logger.warning("gnutls send failed",
1827
1800
                                       exc_info=error)
1828
1801
                        return
1829
 
                    logger.debug("Sent: %d, remaining: %d", sent,
1830
 
                                 len(client.secret) - (sent_size
1831
 
                                                       + sent))
 
1802
                    logger.debug("Sent: %d, remaining: %d",
 
1803
                                 sent, len(client.secret)
 
1804
                                 - (sent_size + sent))
1832
1805
                    sent_size += sent
1833
1806
                
1834
1807
                logger.info("Sending secret to %s", client.name)
1851
1824
    def peer_certificate(session):
1852
1825
        "Return the peer's OpenPGP certificate as a bytestring"
1853
1826
        # If not an OpenPGP certificate...
1854
 
        if (gnutls.library.functions.gnutls_certificate_type_get(
1855
 
                session._c_object)
 
1827
        if (gnutls.library.functions
 
1828
            .gnutls_certificate_type_get(session._c_object)
1856
1829
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1857
1830
            # ...do the normal thing
1858
1831
            return session.peer_certificate
1872
1845
    def fingerprint(openpgp):
1873
1846
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1874
1847
        # New GnuTLS "datum" with the OpenPGP public key
1875
 
        datum = gnutls.library.types.gnutls_datum_t(
1876
 
            ctypes.cast(ctypes.c_char_p(openpgp),
1877
 
                        ctypes.POINTER(ctypes.c_ubyte)),
1878
 
            ctypes.c_uint(len(openpgp)))
 
1848
        datum = (gnutls.library.types
 
1849
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1850
                                             ctypes.POINTER
 
1851
                                             (ctypes.c_ubyte)),
 
1852
                                 ctypes.c_uint(len(openpgp))))
1879
1853
        # New empty GnuTLS certificate
1880
1854
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1881
 
        gnutls.library.functions.gnutls_openpgp_crt_init(
1882
 
            ctypes.byref(crt))
 
1855
        (gnutls.library.functions
 
1856
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1883
1857
        # Import the OpenPGP public key into the certificate
1884
 
        gnutls.library.functions.gnutls_openpgp_crt_import(
1885
 
            crt, ctypes.byref(datum),
1886
 
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
1858
        (gnutls.library.functions
 
1859
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1860
                                    gnutls.library.constants
 
1861
                                    .GNUTLS_OPENPGP_FMT_RAW))
1887
1862
        # Verify the self signature in the key
1888
1863
        crtverify = ctypes.c_uint()
1889
 
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
 
            crt, 0, ctypes.byref(crtverify))
 
1864
        (gnutls.library.functions
 
1865
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1866
                                         ctypes.byref(crtverify)))
1891
1867
        if crtverify.value != 0:
1892
1868
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1893
 
            raise gnutls.errors.CertificateSecurityError(
1894
 
                "Verify failed")
 
1869
            raise (gnutls.errors.CertificateSecurityError
 
1870
                   ("Verify failed"))
1895
1871
        # New buffer for the fingerprint
1896
1872
        buf = ctypes.create_string_buffer(20)
1897
1873
        buf_len = ctypes.c_size_t()
1898
1874
        # Get the fingerprint from the certificate into the buffer
1899
 
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
 
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
 
1875
        (gnutls.library.functions
 
1876
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1877
                                             ctypes.byref(buf_len)))
1901
1878
        # Deinit the certificate
1902
1879
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1903
1880
        # Convert the buffer to a Python bytestring
1909
1886
 
1910
1887
class MultiprocessingMixIn(object):
1911
1888
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1912
 
    
1913
1889
    def sub_process_main(self, request, address):
1914
1890
        try:
1915
1891
            self.finish_request(request, address)
1927
1903
 
1928
1904
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1929
1905
    """ adds a pipe to the MixIn """
1930
 
    
1931
1906
    def process_request(self, request, client_address):
1932
1907
        """Overrides and wraps the original process_request().
1933
1908
        
1954
1929
        interface:      None or a network interface name (string)
1955
1930
        use_ipv6:       Boolean; to use IPv6 or not
1956
1931
    """
1957
 
    
1958
1932
    def __init__(self, server_address, RequestHandlerClass,
1959
 
                 interface=None,
1960
 
                 use_ipv6=True,
1961
 
                 socketfd=None):
 
1933
                 interface=None, use_ipv6=True, socketfd=None):
1962
1934
        """If socketfd is set, use that file descriptor instead of
1963
1935
        creating a new one with socket.socket().
1964
1936
        """
2005
1977
                             self.interface)
2006
1978
            else:
2007
1979
                try:
2008
 
                    self.socket.setsockopt(
2009
 
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
 
                        (self.interface + "\0").encode("utf-8"))
 
1980
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1981
                                           SO_BINDTODEVICE,
 
1982
                                           str(self.interface + '\0'))
2011
1983
                except socket.error as error:
2012
1984
                    if error.errno == errno.EPERM:
2013
1985
                        logger.error("No permission to bind to"
2031
2003
                self.server_address = (any_address,
2032
2004
                                       self.server_address[1])
2033
2005
            elif not self.server_address[1]:
2034
 
                self.server_address = (self.server_address[0], 0)
 
2006
                self.server_address = (self.server_address[0],
 
2007
                                       0)
2035
2008
#                 if self.interface:
2036
2009
#                     self.server_address = (self.server_address[0],
2037
2010
#                                            0, # port
2051
2024
    
2052
2025
    Assumes a gobject.MainLoop event loop.
2053
2026
    """
2054
 
    
2055
2027
    def __init__(self, server_address, RequestHandlerClass,
2056
 
                 interface=None,
2057
 
                 use_ipv6=True,
2058
 
                 clients=None,
2059
 
                 gnutls_priority=None,
2060
 
                 use_dbus=True,
2061
 
                 socketfd=None):
 
2028
                 interface=None, use_ipv6=True, clients=None,
 
2029
                 gnutls_priority=None, use_dbus=True, socketfd=None):
2062
2030
        self.enabled = False
2063
2031
        self.clients = clients
2064
2032
        if self.clients is None:
2070
2038
                                interface = interface,
2071
2039
                                use_ipv6 = use_ipv6,
2072
2040
                                socketfd = socketfd)
2073
 
    
2074
2041
    def server_activate(self):
2075
2042
        if self.enabled:
2076
2043
            return socketserver.TCPServer.server_activate(self)
2080
2047
    
2081
2048
    def add_pipe(self, parent_pipe, proc):
2082
2049
        # Call "handle_ipc" for both data and EOF events
2083
 
        gobject.io_add_watch(
2084
 
            parent_pipe.fileno(),
2085
 
            gobject.IO_IN | gobject.IO_HUP,
2086
 
            functools.partial(self.handle_ipc,
2087
 
                              parent_pipe = parent_pipe,
2088
 
                              proc = proc))
 
2050
        gobject.io_add_watch(parent_pipe.fileno(),
 
2051
                             gobject.IO_IN | gobject.IO_HUP,
 
2052
                             functools.partial(self.handle_ipc,
 
2053
                                               parent_pipe =
 
2054
                                               parent_pipe,
 
2055
                                               proc = proc))
2089
2056
    
2090
 
    def handle_ipc(self, source, condition,
2091
 
                   parent_pipe=None,
2092
 
                   proc = None,
2093
 
                   client_object=None):
 
2057
    def handle_ipc(self, source, condition, parent_pipe=None,
 
2058
                   proc = None, client_object=None):
2094
2059
        # error, or the other end of multiprocessing.Pipe has closed
2095
2060
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
2096
2061
            # Wait for other process to exit
2119
2084
                parent_pipe.send(False)
2120
2085
                return False
2121
2086
            
2122
 
            gobject.io_add_watch(
2123
 
                parent_pipe.fileno(),
2124
 
                gobject.IO_IN | gobject.IO_HUP,
2125
 
                functools.partial(self.handle_ipc,
2126
 
                                  parent_pipe = parent_pipe,
2127
 
                                  proc = proc,
2128
 
                                  client_object = client))
 
2087
            gobject.io_add_watch(parent_pipe.fileno(),
 
2088
                                 gobject.IO_IN | gobject.IO_HUP,
 
2089
                                 functools.partial(self.handle_ipc,
 
2090
                                                   parent_pipe =
 
2091
                                                   parent_pipe,
 
2092
                                                   proc = proc,
 
2093
                                                   client_object =
 
2094
                                                   client))
2129
2095
            parent_pipe.send(True)
2130
2096
            # remove the old hook in favor of the new above hook on
2131
2097
            # same fileno
2137
2103
            
2138
2104
            parent_pipe.send(('data', getattr(client_object,
2139
2105
                                              funcname)(*args,
2140
 
                                                        **kwargs)))
 
2106
                                                         **kwargs)))
2141
2107
        
2142
2108
        if command == 'getattr':
2143
2109
            attrname = request[1]
2144
 
            if isinstance(client_object.__getattribute__(attrname),
2145
 
                          collections.Callable):
2146
 
                parent_pipe.send(('function', ))
 
2110
            if callable(client_object.__getattribute__(attrname)):
 
2111
                parent_pipe.send(('function',))
2147
2112
            else:
2148
 
                parent_pipe.send((
2149
 
                    'data', client_object.__getattribute__(attrname)))
 
2113
                parent_pipe.send(('data', client_object
 
2114
                                  .__getattribute__(attrname)))
2150
2115
        
2151
2116
        if command == 'setattr':
2152
2117
            attrname = request[1]
2183
2148
    # avoid excessive use of external libraries.
2184
2149
    
2185
2150
    # New type for defining tokens, syntax, and semantics all-in-one
2186
 
    Token = collections.namedtuple("Token", (
2187
 
        "regexp",  # To match token; if "value" is not None, must have
2188
 
                   # a "group" containing digits
2189
 
        "value",   # datetime.timedelta or None
2190
 
        "followers"))           # Tokens valid after this token
 
2151
    Token = collections.namedtuple("Token",
 
2152
                                   ("regexp", # To match token; if
 
2153
                                              # "value" is not None,
 
2154
                                              # must have a "group"
 
2155
                                              # containing digits
 
2156
                                    "value",  # datetime.timedelta or
 
2157
                                              # None
 
2158
                                    "followers")) # Tokens valid after
 
2159
                                                  # this token
2191
2160
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2192
2161
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2193
2162
    token_end = Token(re.compile(r"$"), None, frozenset())
2194
2163
    token_second = Token(re.compile(r"(\d+)S"),
2195
2164
                         datetime.timedelta(seconds=1),
2196
 
                         frozenset((token_end, )))
 
2165
                         frozenset((token_end,)))
2197
2166
    token_minute = Token(re.compile(r"(\d+)M"),
2198
2167
                         datetime.timedelta(minutes=1),
2199
2168
                         frozenset((token_second, token_end)))
2215
2184
                       frozenset((token_month, token_end)))
2216
2185
    token_week = Token(re.compile(r"(\d+)W"),
2217
2186
                       datetime.timedelta(weeks=1),
2218
 
                       frozenset((token_end, )))
 
2187
                       frozenset((token_end,)))
2219
2188
    token_duration = Token(re.compile(r"P"), None,
2220
2189
                           frozenset((token_year, token_month,
2221
2190
                                      token_day, token_time,
2222
 
                                      token_week)))
 
2191
                                      token_week))),
2223
2192
    # Define starting values
2224
2193
    value = datetime.timedelta() # Value so far
2225
2194
    found_token = None
2226
 
    followers = frozenset((token_duration, )) # Following valid tokens
 
2195
    followers = frozenset(token_duration,) # Following valid tokens
2227
2196
    s = duration                # String left to parse
2228
2197
    # Loop until end token is found
2229
2198
    while found_token is not token_end:
2246
2215
                break
2247
2216
        else:
2248
2217
            # No currently valid tokens were found
2249
 
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2250
 
                             .format(duration))
 
2218
            raise ValueError("Invalid RFC 3339 duration")
2251
2219
    # End token found
2252
2220
    return value
2253
2221
 
2277
2245
    timevalue = datetime.timedelta(0)
2278
2246
    for s in interval.split():
2279
2247
        try:
2280
 
            suffix = s[-1]
 
2248
            suffix = unicode(s[-1])
2281
2249
            value = int(s[:-1])
2282
2250
            if suffix == "d":
2283
2251
                delta = datetime.timedelta(value)
2290
2258
            elif suffix == "w":
2291
2259
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2292
2260
            else:
2293
 
                raise ValueError("Unknown suffix {!r}".format(suffix))
 
2261
                raise ValueError("Unknown suffix {0!r}"
 
2262
                                 .format(suffix))
2294
2263
        except IndexError as e:
2295
2264
            raise ValueError(*(e.args))
2296
2265
        timevalue += delta
2313
2282
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2314
2283
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2315
2284
            raise OSError(errno.ENODEV,
2316
 
                          "{} not a character device"
 
2285
                          "{0} not a character device"
2317
2286
                          .format(os.devnull))
2318
2287
        os.dup2(null, sys.stdin.fileno())
2319
2288
        os.dup2(null, sys.stdout.fileno())
2329
2298
    
2330
2299
    parser = argparse.ArgumentParser()
2331
2300
    parser.add_argument("-v", "--version", action="version",
2332
 
                        version = "%(prog)s {}".format(version),
 
2301
                        version = "%(prog)s {0}".format(version),
2333
2302
                        help="show version number and exit")
2334
2303
    parser.add_argument("-i", "--interface", metavar="IF",
2335
2304
                        help="Bind to interface IF")
2385
2354
                        "port": "",
2386
2355
                        "debug": "False",
2387
2356
                        "priority":
2388
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2389
 
                        ":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
 
2357
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2390
2358
                        "servicename": "Mandos",
2391
2359
                        "use_dbus": "True",
2392
2360
                        "use_ipv6": "True",
2396
2364
                        "statedir": "/var/lib/mandos",
2397
2365
                        "foreground": "False",
2398
2366
                        "zeroconf": "True",
2399
 
                    }
 
2367
                        }
2400
2368
    
2401
2369
    # Parse config file for server-global settings
2402
2370
    server_config = configparser.SafeConfigParser(server_defaults)
2403
2371
    del server_defaults
2404
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
2372
    server_config.read(os.path.join(options.configdir,
 
2373
                                    "mandos.conf"))
2405
2374
    # Convert the SafeConfigParser object to a dict
2406
2375
    server_settings = server_config.defaults()
2407
2376
    # Use the appropriate methods on the non-string config options
2425
2394
    # Override the settings from the config file with command line
2426
2395
    # options, if set.
2427
2396
    for option in ("interface", "address", "port", "debug",
2428
 
                   "priority", "servicename", "configdir", "use_dbus",
2429
 
                   "use_ipv6", "debuglevel", "restore", "statedir",
2430
 
                   "socket", "foreground", "zeroconf"):
 
2397
                   "priority", "servicename", "configdir",
 
2398
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2399
                   "statedir", "socket", "foreground", "zeroconf"):
2431
2400
        value = getattr(options, option)
2432
2401
        if value is not None:
2433
2402
            server_settings[option] = value
2434
2403
    del options
2435
2404
    # Force all strings to be unicode
2436
2405
    for option in server_settings.keys():
2437
 
        if isinstance(server_settings[option], bytes):
2438
 
            server_settings[option] = (server_settings[option]
2439
 
                                       .decode("utf-8"))
 
2406
        if type(server_settings[option]) is str:
 
2407
            server_settings[option] = unicode(server_settings[option])
2440
2408
    # Force all boolean options to be boolean
2441
2409
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2442
2410
                   "foreground", "zeroconf"):
2448
2416
    
2449
2417
    ##################################################################
2450
2418
    
2451
 
    if (not server_settings["zeroconf"]
2452
 
        and not (server_settings["port"]
2453
 
                 or server_settings["socket"] != "")):
2454
 
        parser.error("Needs port or socket to work without Zeroconf")
 
2419
    if (not server_settings["zeroconf"] and
 
2420
        not (server_settings["port"]
 
2421
             or server_settings["socket"] != "")):
 
2422
            parser.error("Needs port or socket to work without"
 
2423
                         " Zeroconf")
2455
2424
    
2456
2425
    # For convenience
2457
2426
    debug = server_settings["debug"]
2473
2442
            initlogger(debug, level)
2474
2443
    
2475
2444
    if server_settings["servicename"] != "Mandos":
2476
 
        syslogger.setFormatter(
2477
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
2478
 
                              ' %(levelname)s: %(message)s'.format(
2479
 
                                  server_settings["servicename"])))
 
2445
        syslogger.setFormatter(logging.Formatter
 
2446
                               ('Mandos ({0}) [%(process)d]:'
 
2447
                                ' %(levelname)s: %(message)s'
 
2448
                                .format(server_settings
 
2449
                                        ["servicename"])))
2480
2450
    
2481
2451
    # Parse config file with clients
2482
2452
    client_config = configparser.SafeConfigParser(Client
2490
2460
    socketfd = None
2491
2461
    if server_settings["socket"] != "":
2492
2462
        socketfd = server_settings["socket"]
2493
 
    tcp_server = MandosServer(
2494
 
        (server_settings["address"], server_settings["port"]),
2495
 
        ClientHandler,
2496
 
        interface=(server_settings["interface"] or None),
2497
 
        use_ipv6=use_ipv6,
2498
 
        gnutls_priority=server_settings["priority"],
2499
 
        use_dbus=use_dbus,
2500
 
        socketfd=socketfd)
 
2463
    tcp_server = MandosServer((server_settings["address"],
 
2464
                               server_settings["port"]),
 
2465
                              ClientHandler,
 
2466
                              interface=(server_settings["interface"]
 
2467
                                         or None),
 
2468
                              use_ipv6=use_ipv6,
 
2469
                              gnutls_priority=
 
2470
                              server_settings["priority"],
 
2471
                              use_dbus=use_dbus,
 
2472
                              socketfd=socketfd)
2501
2473
    if not foreground:
2502
2474
        pidfilename = "/run/mandos.pid"
2503
2475
        if not os.path.isdir("/run/."):
2504
2476
            pidfilename = "/var/run/mandos.pid"
2505
2477
        pidfile = None
2506
2478
        try:
2507
 
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
 
2479
            pidfile = open(pidfilename, "w")
2508
2480
        except IOError as e:
2509
2481
            logger.error("Could not open file %r", pidfilename,
2510
2482
                         exc_info=e)
2537
2509
        def debug_gnutls(level, string):
2538
2510
            logger.debug("GnuTLS: %s", string[:-1])
2539
2511
        
2540
 
        gnutls.library.functions.gnutls_global_set_log_function(
2541
 
            debug_gnutls)
 
2512
        (gnutls.library.functions
 
2513
         .gnutls_global_set_log_function(debug_gnutls))
2542
2514
        
2543
2515
        # Redirect stdin so all checkers get /dev/null
2544
2516
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2564
2536
    if use_dbus:
2565
2537
        try:
2566
2538
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2567
 
                                            bus,
2568
 
                                            do_not_queue=True)
2569
 
            old_bus_name = dbus.service.BusName(
2570
 
                "se.bsnet.fukt.Mandos", bus,
2571
 
                do_not_queue=True)
2572
 
        except dbus.exceptions.DBusException as e:
 
2539
                                            bus, do_not_queue=True)
 
2540
            old_bus_name = (dbus.service.BusName
 
2541
                            ("se.bsnet.fukt.Mandos", bus,
 
2542
                             do_not_queue=True))
 
2543
        except dbus.exceptions.NameExistsException as e:
2573
2544
            logger.error("Disabling D-Bus:", exc_info=e)
2574
2545
            use_dbus = False
2575
2546
            server_settings["use_dbus"] = False
2576
2547
            tcp_server.use_dbus = False
2577
2548
    if zeroconf:
2578
2549
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2579
 
        service = AvahiServiceToSyslog(
2580
 
            name = server_settings["servicename"],
2581
 
            servicetype = "_mandos._tcp",
2582
 
            protocol = protocol,
2583
 
            bus = bus)
 
2550
        service = AvahiServiceToSyslog(name =
 
2551
                                       server_settings["servicename"],
 
2552
                                       servicetype = "_mandos._tcp",
 
2553
                                       protocol = protocol, bus = bus)
2584
2554
        if server_settings["interface"]:
2585
 
            service.interface = if_nametoindex(
2586
 
                server_settings["interface"].encode("utf-8"))
 
2555
            service.interface = (if_nametoindex
 
2556
                                 (str(server_settings["interface"])))
2587
2557
    
2588
2558
    global multiprocessing_manager
2589
2559
    multiprocessing_manager = multiprocessing.Manager()
2608
2578
    if server_settings["restore"]:
2609
2579
        try:
2610
2580
            with open(stored_state_path, "rb") as stored_state:
2611
 
                clients_data, old_client_settings = pickle.load(
2612
 
                    stored_state)
 
2581
                clients_data, old_client_settings = (pickle.load
 
2582
                                                     (stored_state))
2613
2583
            os.remove(stored_state_path)
2614
2584
        except IOError as e:
2615
2585
            if e.errno == errno.ENOENT:
2616
 
                logger.warning("Could not load persistent state:"
2617
 
                               " {}".format(os.strerror(e.errno)))
 
2586
                logger.warning("Could not load persistent state: {0}"
 
2587
                                .format(os.strerror(e.errno)))
2618
2588
            else:
2619
2589
                logger.critical("Could not load persistent state:",
2620
2590
                                exc_info=e)
2621
2591
                raise
2622
2592
        except EOFError as e:
2623
2593
            logger.warning("Could not load persistent state: "
2624
 
                           "EOFError:",
2625
 
                           exc_info=e)
 
2594
                           "EOFError:", exc_info=e)
2626
2595
    
2627
2596
    with PGPEngine() as pgp:
2628
 
        for client_name, client in clients_data.items():
 
2597
        for client_name, client in clients_data.iteritems():
2629
2598
            # Skip removed clients
2630
2599
            if client_name not in client_settings:
2631
2600
                continue
2640
2609
                    # For each value in new config, check if it
2641
2610
                    # differs from the old config value (Except for
2642
2611
                    # the "secret" attribute)
2643
 
                    if (name != "secret"
2644
 
                        and (value !=
2645
 
                             old_client_settings[client_name][name])):
 
2612
                    if (name != "secret" and
 
2613
                        value != old_client_settings[client_name]
 
2614
                        [name]):
2646
2615
                        client[name] = value
2647
2616
                except KeyError:
2648
2617
                    pass
2649
2618
            
2650
2619
            # Clients who has passed its expire date can still be
2651
 
            # enabled if its last checker was successful.  A Client
 
2620
            # enabled if its last checker was successful.  Clients
2652
2621
            # whose checker succeeded before we stored its state is
2653
2622
            # assumed to have successfully run all checkers during
2654
2623
            # downtime.
2656
2625
                if datetime.datetime.utcnow() >= client["expires"]:
2657
2626
                    if not client["last_checked_ok"]:
2658
2627
                        logger.warning(
2659
 
                            "disabling client {} - Client never "
2660
 
                            "performed a successful checker".format(
2661
 
                                client_name))
 
2628
                            "disabling client {0} - Client never "
 
2629
                            "performed a successful checker"
 
2630
                            .format(client_name))
2662
2631
                        client["enabled"] = False
2663
2632
                    elif client["last_checker_status"] != 0:
2664
2633
                        logger.warning(
2665
 
                            "disabling client {} - Client last"
2666
 
                            " checker failed with error code"
2667
 
                            " {}".format(
2668
 
                                client_name,
2669
 
                                client["last_checker_status"]))
 
2634
                            "disabling client {0} - Client "
 
2635
                            "last checker failed with error code {1}"
 
2636
                            .format(client_name,
 
2637
                                    client["last_checker_status"]))
2670
2638
                        client["enabled"] = False
2671
2639
                    else:
2672
 
                        client["expires"] = (
2673
 
                            datetime.datetime.utcnow()
2674
 
                            + client["timeout"])
 
2640
                        client["expires"] = (datetime.datetime
 
2641
                                             .utcnow()
 
2642
                                             + client["timeout"])
2675
2643
                        logger.debug("Last checker succeeded,"
2676
 
                                     " keeping {} enabled".format(
2677
 
                                         client_name))
 
2644
                                     " keeping {0} enabled"
 
2645
                                     .format(client_name))
2678
2646
            try:
2679
 
                client["secret"] = pgp.decrypt(
2680
 
                    client["encrypted_secret"],
2681
 
                    client_settings[client_name]["secret"])
 
2647
                client["secret"] = (
 
2648
                    pgp.decrypt(client["encrypted_secret"],
 
2649
                                client_settings[client_name]
 
2650
                                ["secret"]))
2682
2651
            except PGPError:
2683
2652
                # If decryption fails, we use secret from new settings
2684
 
                logger.debug("Failed to decrypt {} old secret".format(
2685
 
                    client_name))
2686
 
                client["secret"] = (client_settings[client_name]
2687
 
                                    ["secret"])
 
2653
                logger.debug("Failed to decrypt {0} old secret"
 
2654
                             .format(client_name))
 
2655
                client["secret"] = (
 
2656
                    client_settings[client_name]["secret"])
2688
2657
    
2689
2658
    # Add/remove clients based on new changes made to config
2690
2659
    for client_name in (set(old_client_settings)
2695
2664
        clients_data[client_name] = client_settings[client_name]
2696
2665
    
2697
2666
    # Create all client objects
2698
 
    for client_name, client in clients_data.items():
 
2667
    for client_name, client in clients_data.iteritems():
2699
2668
        tcp_server.clients[client_name] = client_class(
2700
 
            name = client_name,
2701
 
            settings = client,
 
2669
            name = client_name, settings = client,
2702
2670
            server_settings = server_settings)
2703
2671
    
2704
2672
    if not tcp_server.clients:
2706
2674
    
2707
2675
    if not foreground:
2708
2676
        if pidfile is not None:
2709
 
            pid = os.getpid()
2710
2677
            try:
2711
2678
                with pidfile:
2712
 
                    print(pid, file=pidfile)
 
2679
                    pid = os.getpid()
 
2680
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
2713
2681
            except IOError:
2714
2682
                logger.error("Could not write to file %r with PID %d",
2715
2683
                             pidfilename, pid)
2720
2688
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2721
2689
    
2722
2690
    if use_dbus:
2723
 
        
2724
 
        @alternate_dbus_interfaces(
2725
 
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
 
2691
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2692
                                        "se.bsnet.fukt.Mandos"})
2726
2693
        class MandosDBusService(DBusObjectWithProperties):
2727
2694
            """A D-Bus proxy object"""
2728
 
            
2729
2695
            def __init__(self):
2730
2696
                dbus.service.Object.__init__(self, bus, "/")
2731
 
            
2732
2697
            _interface = "se.recompile.Mandos"
2733
2698
            
2734
2699
            @dbus_interface_annotations(_interface)
2735
2700
            def _foo(self):
2736
 
                return {
2737
 
                    "org.freedesktop.DBus.Property.EmitsChangedSignal":
2738
 
                    "false" }
 
2701
                return { "org.freedesktop.DBus.Property"
 
2702
                         ".EmitsChangedSignal":
 
2703
                             "false"}
2739
2704
            
2740
2705
            @dbus.service.signal(_interface, signature="o")
2741
2706
            def ClientAdded(self, objpath):
2755
2720
            @dbus.service.method(_interface, out_signature="ao")
2756
2721
            def GetAllClients(self):
2757
2722
                "D-Bus method"
2758
 
                return dbus.Array(c.dbus_object_path for c in
 
2723
                return dbus.Array(c.dbus_object_path
 
2724
                                  for c in
2759
2725
                                  tcp_server.clients.itervalues())
2760
2726
            
2761
2727
            @dbus.service.method(_interface,
2763
2729
            def GetAllClientsWithProperties(self):
2764
2730
                "D-Bus method"
2765
2731
                return dbus.Dictionary(
2766
 
                    { c.dbus_object_path: c.GetAll("")
2767
 
                      for c in tcp_server.clients.itervalues() },
 
2732
                    ((c.dbus_object_path, c.GetAll(""))
 
2733
                     for c in tcp_server.clients.itervalues()),
2768
2734
                    signature="oa{sv}")
2769
2735
            
2770
2736
            @dbus.service.method(_interface, in_signature="o")
2808
2774
                
2809
2775
                # A list of attributes that can not be pickled
2810
2776
                # + secret.
2811
 
                exclude = { "bus", "changedstate", "secret",
2812
 
                            "checker", "server_settings" }
2813
 
                for name, typ in inspect.getmembers(dbus.service
2814
 
                                                    .Object):
 
2777
                exclude = set(("bus", "changedstate", "secret",
 
2778
                               "checker", "server_settings"))
 
2779
                for name, typ in (inspect.getmembers
 
2780
                                  (dbus.service.Object)):
2815
2781
                    exclude.add(name)
2816
2782
                
2817
2783
                client_dict["encrypted_secret"] = (client
2824
2790
                del client_settings[client.name]["secret"]
2825
2791
        
2826
2792
        try:
2827
 
            with tempfile.NamedTemporaryFile(
2828
 
                    mode='wb',
2829
 
                    suffix=".pickle",
2830
 
                    prefix='clients-',
2831
 
                    dir=os.path.dirname(stored_state_path),
2832
 
                    delete=False) as stored_state:
 
2793
            with (tempfile.NamedTemporaryFile
 
2794
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2795
                   dir=os.path.dirname(stored_state_path),
 
2796
                   delete=False)) as stored_state:
2833
2797
                pickle.dump((clients, client_settings), stored_state)
2834
 
                tempname = stored_state.name
 
2798
                tempname=stored_state.name
2835
2799
            os.rename(tempname, stored_state_path)
2836
2800
        except (IOError, OSError) as e:
2837
2801
            if not debug:
2840
2804
                except NameError:
2841
2805
                    pass
2842
2806
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2843
 
                logger.warning("Could not save persistent state: {}"
 
2807
                logger.warning("Could not save persistent state: {0}"
2844
2808
                               .format(os.strerror(e.errno)))
2845
2809
            else:
2846
2810
                logger.warning("Could not save persistent state:",
2856
2820
            client.disable(quiet=True)
2857
2821
            if use_dbus:
2858
2822
                # Emit D-Bus signal
2859
 
                mandos_dbus_service.ClientRemoved(
2860
 
                    client.dbus_object_path, client.name)
 
2823
                mandos_dbus_service.ClientRemoved(client
 
2824
                                                  .dbus_object_path,
 
2825
                                                  client.name)
2861
2826
        client_settings.clear()
2862
2827
    
2863
2828
    atexit.register(cleanup)
2916
2881
    # Must run before the D-Bus bus name gets deregistered
2917
2882
    cleanup()
2918
2883
 
2919
 
 
2920
2884
if __name__ == '__main__':
2921
2885
    main()