/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2014-08-09 13:12:55 UTC
  • Revision ID: teddy@recompile.se-20140809131255-lp31j98u2pl0xpe6
mandos: Stop using str() and remove unnecessary unicode() calls.

* mandos (if_nametoindex): Use "bytes" literal instead of str().
  (initlogger): Use a unicode string for log device.
  (AvahiError.__unicode__): Removed.
  (DBusPropertyException.__unicode__): - '' -
  (ClientDBus.Secret_dbus_property): Use bytes() instead of str().
  (IPv6_TCPServer.server_bind): Use .encode() instead of str().
  (string_to_delta): Removed unnecessary unicode() call.
  (main): Use "isinstance(x, bytes)" instead of "type(x) is str", use
          .decode() instead of unicode(), and use .encode() instead of
          str().

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python
 
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008-2014 Teddy Hogeborn
 
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
 
37
from future_builtins import *
 
38
 
37
39
import SocketServer as socketserver
38
40
import socket
39
41
import argparse
62
64
import functools
63
65
import cPickle as pickle
64
66
import multiprocessing
 
67
import types
 
68
import binascii
 
69
import tempfile
 
70
import itertools
 
71
import collections
65
72
 
66
73
import dbus
67
74
import dbus.service
81
88
    except ImportError:
82
89
        SO_BINDTODEVICE = None
83
90
 
84
 
 
85
 
version = "1.3.1"
86
 
 
87
 
#logger = logging.getLogger('mandos')
88
 
logger = logging.Logger('mandos')
89
 
syslogger = (logging.handlers.SysLogHandler
90
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
 
              address = str("/dev/log")))
92
 
syslogger.setFormatter(logging.Formatter
93
 
                       ('Mandos [%(process)d]: %(levelname)s:'
94
 
                        ' %(message)s'))
95
 
logger.addHandler(syslogger)
96
 
 
97
 
console = logging.StreamHandler()
98
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
 
                                       ' %(levelname)s:'
100
 
                                       ' %(message)s'))
101
 
logger.addHandler(console)
 
91
version = "1.6.8"
 
92
stored_state_file = "clients.pickle"
 
93
 
 
94
logger = logging.getLogger()
 
95
syslogger = None
 
96
 
 
97
try:
 
98
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
99
                      (ctypes.util.find_library("c"))
 
100
                      .if_nametoindex)
 
101
except (OSError, AttributeError):
 
102
    def if_nametoindex(interface):
 
103
        "Get an interface index the hard way, i.e. using fcntl()"
 
104
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
105
        with contextlib.closing(socket.socket()) as s:
 
106
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
107
                                struct.pack(b"16s16x", interface))
 
108
        interface_index = struct.unpack("I", ifreq[16:20])[0]
 
109
        return interface_index
 
110
 
 
111
 
 
112
def initlogger(debug, level=logging.WARNING):
 
113
    """init logger and add loglevel"""
 
114
    
 
115
    global syslogger
 
116
    syslogger = (logging.handlers.SysLogHandler
 
117
                 (facility =
 
118
                  logging.handlers.SysLogHandler.LOG_DAEMON,
 
119
                  address = "/dev/log"))
 
120
    syslogger.setFormatter(logging.Formatter
 
121
                           ('Mandos [%(process)d]: %(levelname)s:'
 
122
                            ' %(message)s'))
 
123
    logger.addHandler(syslogger)
 
124
    
 
125
    if debug:
 
126
        console = logging.StreamHandler()
 
127
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
128
                                               ' [%(process)d]:'
 
129
                                               ' %(levelname)s:'
 
130
                                               ' %(message)s'))
 
131
        logger.addHandler(console)
 
132
    logger.setLevel(level)
 
133
 
 
134
 
 
135
class PGPError(Exception):
 
136
    """Exception if encryption/decryption fails"""
 
137
    pass
 
138
 
 
139
 
 
140
class PGPEngine(object):
 
141
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
142
    def __init__(self):
 
143
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
144
        self.gnupgargs = ['--batch',
 
145
                          '--home', self.tempdir,
 
146
                          '--force-mdc',
 
147
                          '--quiet',
 
148
                          '--no-use-agent']
 
149
    
 
150
    def __enter__(self):
 
151
        return self
 
152
    
 
153
    def __exit__(self, exc_type, exc_value, traceback):
 
154
        self._cleanup()
 
155
        return False
 
156
    
 
157
    def __del__(self):
 
158
        self._cleanup()
 
159
    
 
160
    def _cleanup(self):
 
161
        if self.tempdir is not None:
 
162
            # Delete contents of tempdir
 
163
            for root, dirs, files in os.walk(self.tempdir,
 
164
                                             topdown = False):
 
165
                for filename in files:
 
166
                    os.remove(os.path.join(root, filename))
 
167
                for dirname in dirs:
 
168
                    os.rmdir(os.path.join(root, dirname))
 
169
            # Remove tempdir
 
170
            os.rmdir(self.tempdir)
 
171
            self.tempdir = None
 
172
    
 
173
    def password_encode(self, password):
 
174
        # Passphrase can not be empty and can not contain newlines or
 
175
        # NUL bytes.  So we prefix it and hex encode it.
 
176
        encoded = b"mandos" + binascii.hexlify(password)
 
177
        if len(encoded) > 2048:
 
178
            # GnuPG can't handle long passwords, so encode differently
 
179
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
180
                       .replace(b"\n", b"\\n")
 
181
                       .replace(b"\0", b"\\x00"))
 
182
        return encoded
 
183
    
 
184
    def encrypt(self, data, password):
 
185
        passphrase = self.password_encode(password)
 
186
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
187
                                         ) as passfile:
 
188
            passfile.write(passphrase)
 
189
            passfile.flush()
 
190
            proc = subprocess.Popen(['gpg', '--symmetric',
 
191
                                     '--passphrase-file',
 
192
                                     passfile.name]
 
193
                                    + self.gnupgargs,
 
194
                                    stdin = subprocess.PIPE,
 
195
                                    stdout = subprocess.PIPE,
 
196
                                    stderr = subprocess.PIPE)
 
197
            ciphertext, err = proc.communicate(input = data)
 
198
        if proc.returncode != 0:
 
199
            raise PGPError(err)
 
200
        return ciphertext
 
201
    
 
202
    def decrypt(self, data, password):
 
203
        passphrase = self.password_encode(password)
 
204
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
205
                                         ) as passfile:
 
206
            passfile.write(passphrase)
 
207
            passfile.flush()
 
208
            proc = subprocess.Popen(['gpg', '--decrypt',
 
209
                                     '--passphrase-file',
 
210
                                     passfile.name]
 
211
                                    + self.gnupgargs,
 
212
                                    stdin = subprocess.PIPE,
 
213
                                    stdout = subprocess.PIPE,
 
214
                                    stderr = subprocess.PIPE)
 
215
            decrypted_plaintext, err = proc.communicate(input
 
216
                                                        = data)
 
217
        if proc.returncode != 0:
 
218
            raise PGPError(err)
 
219
        return decrypted_plaintext
 
220
 
102
221
 
103
222
class AvahiError(Exception):
104
223
    def __init__(self, value, *args, **kwargs):
105
224
        self.value = value
106
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
107
 
    def __unicode__(self):
108
 
        return unicode(repr(self.value))
 
225
        return super(AvahiError, self).__init__(value, *args,
 
226
                                                **kwargs)
109
227
 
110
228
class AvahiServiceError(AvahiError):
111
229
    pass
122
240
               Used to optionally bind to the specified interface.
123
241
    name: string; Example: 'Mandos'
124
242
    type: string; Example: '_mandos._tcp'.
125
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
243
     See <https://www.iana.org/assignments/service-names-port-numbers>
126
244
    port: integer; what port to announce
127
245
    TXT: list of strings; TXT record for the service
128
246
    domain: string; Domain to publish on, default to .local if empty.
134
252
    server: D-Bus Server
135
253
    bus: dbus.SystemBus()
136
254
    """
 
255
    
137
256
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
257
                 servicetype = None, port = None, TXT = None,
139
258
                 domain = "", host = "", max_renames = 32768,
152
271
        self.server = None
153
272
        self.bus = bus
154
273
        self.entry_group_state_changed_match = None
 
274
    
155
275
    def rename(self):
156
276
        """Derived from the Avahi example code"""
157
277
        if self.rename_count >= self.max_renames:
159
279
                            " after %i retries, exiting.",
160
280
                            self.rename_count)
161
281
            raise AvahiServiceError("Too many renames")
162
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
282
        self.name = unicode(self.server
 
283
                            .GetAlternativeServiceName(self.name))
163
284
        logger.info("Changing Zeroconf service name to %r ...",
164
285
                    self.name)
165
 
        syslogger.setFormatter(logging.Formatter
166
 
                               ('Mandos (%s) [%%(process)d]:'
167
 
                                ' %%(levelname)s: %%(message)s'
168
 
                                % self.name))
169
286
        self.remove()
170
287
        try:
171
288
            self.add()
172
289
        except dbus.exceptions.DBusException as error:
173
 
            logger.critical("DBusException: %s", error)
 
290
            logger.critical("D-Bus Exception", exc_info=error)
174
291
            self.cleanup()
175
292
            os._exit(1)
176
293
        self.rename_count += 1
 
294
    
177
295
    def remove(self):
178
296
        """Derived from the Avahi example code"""
179
297
        if self.entry_group_state_changed_match is not None:
181
299
            self.entry_group_state_changed_match = None
182
300
        if self.group is not None:
183
301
            self.group.Reset()
 
302
    
184
303
    def add(self):
185
304
        """Derived from the Avahi example code"""
186
305
        self.remove()
191
310
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
311
        self.entry_group_state_changed_match = (
193
312
            self.group.connect_to_signal(
194
 
                'StateChanged', self .entry_group_state_changed))
 
313
                'StateChanged', self.entry_group_state_changed))
195
314
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
196
315
                     self.name, self.type)
197
316
        self.group.AddService(
203
322
            dbus.UInt16(self.port),
204
323
            avahi.string_array_to_txt_array(self.TXT))
205
324
        self.group.Commit()
 
325
    
206
326
    def entry_group_state_changed(self, state, error):
207
327
        """Derived from the Avahi example code"""
208
328
        logger.debug("Avahi entry group state change: %i", state)
215
335
        elif state == avahi.ENTRY_GROUP_FAILURE:
216
336
            logger.critical("Avahi: Error in group state changed %s",
217
337
                            unicode(error))
218
 
            raise AvahiGroupError("State changed: %s"
219
 
                                  % unicode(error))
 
338
            raise AvahiGroupError("State changed: {!s}"
 
339
                                  .format(error))
 
340
    
220
341
    def cleanup(self):
221
342
        """Derived from the Avahi example code"""
222
343
        if self.group is not None:
223
344
            try:
224
345
                self.group.Free()
225
346
            except (dbus.exceptions.UnknownMethodException,
226
 
                    dbus.exceptions.DBusException) as e:
 
347
                    dbus.exceptions.DBusException):
227
348
                pass
228
349
            self.group = None
229
350
        self.remove()
 
351
    
230
352
    def server_state_changed(self, state, error=None):
231
353
        """Derived from the Avahi example code"""
232
354
        logger.debug("Avahi server state change: %i", state)
251
373
                logger.debug("Unknown state: %r", state)
252
374
            else:
253
375
                logger.debug("Unknown state: %r: %r", state, error)
 
376
    
254
377
    def activate(self):
255
378
        """Derived from the Avahi example code"""
256
379
        if self.server is None:
264
387
        self.server_state_changed(self.server.GetState())
265
388
 
266
389
 
267
 
def _timedelta_to_milliseconds(td):
268
 
    "Convert a datetime.timedelta() to milliseconds"
269
 
    return ((td.days * 24 * 60 * 60 * 1000)
270
 
            + (td.seconds * 1000)
271
 
            + (td.microseconds // 1000))
272
 
        
 
390
class AvahiServiceToSyslog(AvahiService):
 
391
    def rename(self):
 
392
        """Add the new name to the syslog messages"""
 
393
        ret = AvahiService.rename(self)
 
394
        syslogger.setFormatter(logging.Formatter
 
395
                               ('Mandos ({}) [%(process)d]:'
 
396
                                ' %(levelname)s: %(message)s'
 
397
                                .format(self.name)))
 
398
        return ret
 
399
 
 
400
 
273
401
class Client(object):
274
402
    """A representation of a client host served by this server.
275
403
    
276
404
    Attributes:
277
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
405
    approved:   bool(); 'None' if not yet approved/disapproved
278
406
    approval_delay: datetime.timedelta(); Time to wait for approval
279
407
    approval_duration: datetime.timedelta(); Duration of one approval
280
408
    checker:    subprocess.Popen(); a running checker process used
287
415
                     instance %(name)s can be used in the command.
288
416
    checker_initiator_tag: a gobject event source tag, or None
289
417
    created:    datetime.datetime(); (UTC) object creation
 
418
    client_structure: Object describing what attributes a client has
 
419
                      and is used for storing the client at exit
290
420
    current_checker_command: string; current running checker_command
291
 
    disable_hook:  If set, called by disable() as disable_hook(self)
292
421
    disable_initiator_tag: a gobject event source tag, or None
293
422
    enabled:    bool()
294
423
    fingerprint: string (40 or 32 hexadecimal digits); used to
297
426
    interval:   datetime.timedelta(); How often to start a new checker
298
427
    last_approval_request: datetime.datetime(); (UTC) or None
299
428
    last_checked_ok: datetime.datetime(); (UTC) or None
300
 
    last_enabled: datetime.datetime(); (UTC)
 
429
    last_checker_status: integer between 0 and 255 reflecting exit
 
430
                         status of last checker. -1 reflects crashed
 
431
                         checker, -2 means no checker completed yet.
 
432
    last_enabled: datetime.datetime(); (UTC) or None
301
433
    name:       string; from the config file, used in log messages and
302
434
                        D-Bus identifiers
303
435
    secret:     bytestring; sent verbatim (over TLS) to client
304
436
    timeout:    datetime.timedelta(); How long from last_checked_ok
305
437
                                      until this client is disabled
306
 
    extended_timeout:   extra long timeout when password has been sent
 
438
    extended_timeout:   extra long timeout when secret has been sent
307
439
    runtime_expansions: Allowed attributes for runtime expansion.
308
440
    expires:    datetime.datetime(); time (UTC) when a client will be
309
441
                disabled, or None
 
442
    server_settings: The server_settings dict from main()
310
443
    """
311
444
    
312
445
    runtime_expansions = ("approval_delay", "approval_duration",
313
 
                          "created", "enabled", "fingerprint",
314
 
                          "host", "interval", "last_checked_ok",
 
446
                          "created", "enabled", "expires",
 
447
                          "fingerprint", "host", "interval",
 
448
                          "last_approval_request", "last_checked_ok",
315
449
                          "last_enabled", "name", "timeout")
316
 
    
317
 
    def timeout_milliseconds(self):
318
 
        "Return the 'timeout' attribute in milliseconds"
319
 
        return _timedelta_to_milliseconds(self.timeout)
320
 
    
321
 
    def extended_timeout_milliseconds(self):
322
 
        "Return the 'extended_timeout' attribute in milliseconds"
323
 
        return _timedelta_to_milliseconds(self.extended_timeout)    
324
 
    
325
 
    def interval_milliseconds(self):
326
 
        "Return the 'interval' attribute in milliseconds"
327
 
        return _timedelta_to_milliseconds(self.interval)
328
 
    
329
 
    def approval_delay_milliseconds(self):
330
 
        return _timedelta_to_milliseconds(self.approval_delay)
331
 
    
332
 
    def __init__(self, name = None, disable_hook=None, config=None):
333
 
        """Note: the 'checker' key in 'config' sets the
334
 
        'checker_command' attribute and *not* the 'checker'
335
 
        attribute."""
 
450
    client_defaults = { "timeout": "PT5M",
 
451
                        "extended_timeout": "PT15M",
 
452
                        "interval": "PT2M",
 
453
                        "checker": "fping -q -- %%(host)s",
 
454
                        "host": "",
 
455
                        "approval_delay": "PT0S",
 
456
                        "approval_duration": "PT1S",
 
457
                        "approved_by_default": "True",
 
458
                        "enabled": "True",
 
459
                        }
 
460
    
 
461
    @staticmethod
 
462
    def config_parser(config):
 
463
        """Construct a new dict of client settings of this form:
 
464
        { client_name: {setting_name: value, ...}, ...}
 
465
        with exceptions for any special settings as defined above.
 
466
        NOTE: Must be a pure function. Must return the same result
 
467
        value given the same arguments.
 
468
        """
 
469
        settings = {}
 
470
        for client_name in config.sections():
 
471
            section = dict(config.items(client_name))
 
472
            client = settings[client_name] = {}
 
473
            
 
474
            client["host"] = section["host"]
 
475
            # Reformat values from string types to Python types
 
476
            client["approved_by_default"] = config.getboolean(
 
477
                client_name, "approved_by_default")
 
478
            client["enabled"] = config.getboolean(client_name,
 
479
                                                  "enabled")
 
480
            
 
481
            client["fingerprint"] = (section["fingerprint"].upper()
 
482
                                     .replace(" ", ""))
 
483
            if "secret" in section:
 
484
                client["secret"] = section["secret"].decode("base64")
 
485
            elif "secfile" in section:
 
486
                with open(os.path.expanduser(os.path.expandvars
 
487
                                             (section["secfile"])),
 
488
                          "rb") as secfile:
 
489
                    client["secret"] = secfile.read()
 
490
            else:
 
491
                raise TypeError("No secret or secfile for section {}"
 
492
                                .format(section))
 
493
            client["timeout"] = string_to_delta(section["timeout"])
 
494
            client["extended_timeout"] = string_to_delta(
 
495
                section["extended_timeout"])
 
496
            client["interval"] = string_to_delta(section["interval"])
 
497
            client["approval_delay"] = string_to_delta(
 
498
                section["approval_delay"])
 
499
            client["approval_duration"] = string_to_delta(
 
500
                section["approval_duration"])
 
501
            client["checker_command"] = section["checker"]
 
502
            client["last_approval_request"] = None
 
503
            client["last_checked_ok"] = None
 
504
            client["last_checker_status"] = -2
 
505
        
 
506
        return settings
 
507
    
 
508
    def __init__(self, settings, name = None, server_settings=None):
336
509
        self.name = name
337
 
        if config is None:
338
 
            config = {}
 
510
        if server_settings is None:
 
511
            server_settings = {}
 
512
        self.server_settings = server_settings
 
513
        # adding all client settings
 
514
        for setting, value in settings.items():
 
515
            setattr(self, setting, value)
 
516
        
 
517
        if self.enabled:
 
518
            if not hasattr(self, "last_enabled"):
 
519
                self.last_enabled = datetime.datetime.utcnow()
 
520
            if not hasattr(self, "expires"):
 
521
                self.expires = (datetime.datetime.utcnow()
 
522
                                + self.timeout)
 
523
        else:
 
524
            self.last_enabled = None
 
525
            self.expires = None
 
526
        
339
527
        logger.debug("Creating client %r", self.name)
340
528
        # Uppercase and remove spaces from fingerprint for later
341
529
        # comparison purposes with return value from the fingerprint()
342
530
        # function
343
 
        self.fingerprint = (config["fingerprint"].upper()
344
 
                            .replace(" ", ""))
345
531
        logger.debug("  Fingerprint: %s", self.fingerprint)
346
 
        if "secret" in config:
347
 
            self.secret = config["secret"].decode("base64")
348
 
        elif "secfile" in config:
349
 
            with open(os.path.expanduser(os.path.expandvars
350
 
                                         (config["secfile"])),
351
 
                      "rb") as secfile:
352
 
                self.secret = secfile.read()
353
 
        else:
354
 
            raise TypeError("No secret or secfile for client %s"
355
 
                            % self.name)
356
 
        self.host = config.get("host", "")
357
 
        self.created = datetime.datetime.utcnow()
358
 
        self.enabled = False
359
 
        self.last_approval_request = None
360
 
        self.last_enabled = None
361
 
        self.last_checked_ok = None
362
 
        self.timeout = string_to_delta(config["timeout"])
363
 
        self.extended_timeout = string_to_delta(config["extended_timeout"])
364
 
        self.interval = string_to_delta(config["interval"])
365
 
        self.disable_hook = disable_hook
 
532
        self.created = settings.get("created",
 
533
                                    datetime.datetime.utcnow())
 
534
        
 
535
        # attributes specific for this server instance
366
536
        self.checker = None
367
537
        self.checker_initiator_tag = None
368
538
        self.disable_initiator_tag = None
369
 
        self.expires = None
370
539
        self.checker_callback_tag = None
371
 
        self.checker_command = config["checker"]
372
540
        self.current_checker_command = None
373
 
        self.last_connect = None
374
 
        self._approved = None
375
 
        self.approved_by_default = config.get("approved_by_default",
376
 
                                              True)
 
541
        self.approved = None
377
542
        self.approvals_pending = 0
378
 
        self.approval_delay = string_to_delta(
379
 
            config["approval_delay"])
380
 
        self.approval_duration = string_to_delta(
381
 
            config["approval_duration"])
382
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
543
        self.changedstate = (multiprocessing_manager
 
544
                             .Condition(multiprocessing_manager
 
545
                                        .Lock()))
 
546
        self.client_structure = [attr for attr in
 
547
                                 self.__dict__.iterkeys()
 
548
                                 if not attr.startswith("_")]
 
549
        self.client_structure.append("client_structure")
 
550
        
 
551
        for name, t in inspect.getmembers(type(self),
 
552
                                          lambda obj:
 
553
                                              isinstance(obj,
 
554
                                                         property)):
 
555
            if not name.startswith("_"):
 
556
                self.client_structure.append(name)
383
557
    
 
558
    # Send notice to process children that client state has changed
384
559
    def send_changedstate(self):
385
 
        self.changedstate.acquire()
386
 
        self.changedstate.notify_all()
387
 
        self.changedstate.release()
388
 
        
 
560
        with self.changedstate:
 
561
            self.changedstate.notify_all()
 
562
    
389
563
    def enable(self):
390
564
        """Start this client's checker and timeout hooks"""
391
565
        if getattr(self, "enabled", False):
392
566
            # Already enabled
393
567
            return
394
 
        self.send_changedstate()
395
 
        # Schedule a new checker to be started an 'interval' from now,
396
 
        # and every interval from then on.
397
 
        self.checker_initiator_tag = (gobject.timeout_add
398
 
                                      (self.interval_milliseconds(),
399
 
                                       self.start_checker))
400
 
        # Schedule a disable() when 'timeout' has passed
401
568
        self.expires = datetime.datetime.utcnow() + self.timeout
402
 
        self.disable_initiator_tag = (gobject.timeout_add
403
 
                                   (self.timeout_milliseconds(),
404
 
                                    self.disable))
405
569
        self.enabled = True
406
570
        self.last_enabled = datetime.datetime.utcnow()
407
 
        # Also start a new checker *right now*.
408
 
        self.start_checker()
 
571
        self.init_checker()
 
572
        self.send_changedstate()
409
573
    
410
574
    def disable(self, quiet=True):
411
575
        """Disable this client."""
412
576
        if not getattr(self, "enabled", False):
413
577
            return False
414
578
        if not quiet:
415
 
            self.send_changedstate()
416
 
        if not quiet:
417
579
            logger.info("Disabling client %s", self.name)
418
 
        if getattr(self, "disable_initiator_tag", False):
 
580
        if getattr(self, "disable_initiator_tag", None) is not None:
419
581
            gobject.source_remove(self.disable_initiator_tag)
420
582
            self.disable_initiator_tag = None
421
583
        self.expires = None
422
 
        if getattr(self, "checker_initiator_tag", False):
 
584
        if getattr(self, "checker_initiator_tag", None) is not None:
423
585
            gobject.source_remove(self.checker_initiator_tag)
424
586
            self.checker_initiator_tag = None
425
587
        self.stop_checker()
426
 
        if self.disable_hook:
427
 
            self.disable_hook(self)
428
588
        self.enabled = False
 
589
        if not quiet:
 
590
            self.send_changedstate()
429
591
        # Do not run this again if called by a gobject.timeout_add
430
592
        return False
431
593
    
432
594
    def __del__(self):
433
 
        self.disable_hook = None
434
595
        self.disable()
435
596
    
 
597
    def init_checker(self):
 
598
        # Schedule a new checker to be started an 'interval' from now,
 
599
        # and every interval from then on.
 
600
        if self.checker_initiator_tag is not None:
 
601
            gobject.source_remove(self.checker_initiator_tag)
 
602
        self.checker_initiator_tag = (gobject.timeout_add
 
603
                                      (int(self.interval
 
604
                                           .total_seconds() * 1000),
 
605
                                       self.start_checker))
 
606
        # Schedule a disable() when 'timeout' has passed
 
607
        if self.disable_initiator_tag is not None:
 
608
            gobject.source_remove(self.disable_initiator_tag)
 
609
        self.disable_initiator_tag = (gobject.timeout_add
 
610
                                      (int(self.timeout
 
611
                                           .total_seconds() * 1000),
 
612
                                       self.disable))
 
613
        # Also start a new checker *right now*.
 
614
        self.start_checker()
 
615
    
436
616
    def checker_callback(self, pid, condition, command):
437
617
        """The checker has completed, so take appropriate actions."""
438
618
        self.checker_callback_tag = None
439
619
        self.checker = None
440
620
        if os.WIFEXITED(condition):
441
 
            exitstatus = os.WEXITSTATUS(condition)
442
 
            if exitstatus == 0:
 
621
            self.last_checker_status = os.WEXITSTATUS(condition)
 
622
            if self.last_checker_status == 0:
443
623
                logger.info("Checker for %(name)s succeeded",
444
624
                            vars(self))
445
625
                self.checked_ok()
447
627
                logger.info("Checker for %(name)s failed",
448
628
                            vars(self))
449
629
        else:
 
630
            self.last_checker_status = -1
450
631
            logger.warning("Checker for %(name)s crashed?",
451
632
                           vars(self))
452
633
    
453
 
    def checked_ok(self, timeout=None):
454
 
        """Bump up the timeout for this client.
455
 
        
456
 
        This should only be called when the client has been seen,
457
 
        alive and well.
458
 
        """
 
634
    def checked_ok(self):
 
635
        """Assert that the client has been seen, alive and well."""
 
636
        self.last_checked_ok = datetime.datetime.utcnow()
 
637
        self.last_checker_status = 0
 
638
        self.bump_timeout()
 
639
    
 
640
    def bump_timeout(self, timeout=None):
 
641
        """Bump up the timeout for this client."""
459
642
        if timeout is None:
460
643
            timeout = self.timeout
461
 
        self.last_checked_ok = datetime.datetime.utcnow()
462
 
        gobject.source_remove(self.disable_initiator_tag)
463
 
        self.expires = datetime.datetime.utcnow() + timeout
464
 
        self.disable_initiator_tag = (gobject.timeout_add
465
 
                                      (_timedelta_to_milliseconds(timeout),
466
 
                                       self.disable))
 
644
        if self.disable_initiator_tag is not None:
 
645
            gobject.source_remove(self.disable_initiator_tag)
 
646
            self.disable_initiator_tag = None
 
647
        if getattr(self, "enabled", False):
 
648
            self.disable_initiator_tag = (gobject.timeout_add
 
649
                                          (int(timeout.total_seconds()
 
650
                                               * 1000), self.disable))
 
651
            self.expires = datetime.datetime.utcnow() + timeout
467
652
    
468
653
    def need_approval(self):
469
654
        self.last_approval_request = datetime.datetime.utcnow()
474
659
        If a checker already exists, leave it running and do
475
660
        nothing."""
476
661
        # The reason for not killing a running checker is that if we
477
 
        # did that, then if a checker (for some reason) started
478
 
        # running slowly and taking more than 'interval' time, the
479
 
        # client would inevitably timeout, since no checker would get
480
 
        # a chance to run to completion.  If we instead leave running
 
662
        # did that, and if a checker (for some reason) started running
 
663
        # slowly and taking more than 'interval' time, then the client
 
664
        # would inevitably timeout, since no checker would get a
 
665
        # chance to run to completion.  If we instead leave running
481
666
        # checkers alone, the checker would have to take more time
482
667
        # than 'timeout' for the client to be disabled, which is as it
483
668
        # should be.
485
670
        # If a checker exists, make sure it is not a zombie
486
671
        try:
487
672
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
488
 
        except (AttributeError, OSError) as error:
489
 
            if (isinstance(error, OSError)
490
 
                and error.errno != errno.ECHILD):
491
 
                raise error
 
673
        except AttributeError:
 
674
            pass
 
675
        except OSError as error:
 
676
            if error.errno != errno.ECHILD:
 
677
                raise
492
678
        else:
493
679
            if pid:
494
680
                logger.warning("Checker was a zombie")
497
683
                                      self.current_checker_command)
498
684
        # Start a new checker if needed
499
685
        if self.checker is None:
 
686
            # Escape attributes for the shell
 
687
            escaped_attrs = { attr:
 
688
                                  re.escape(unicode(getattr(self,
 
689
                                                            attr)))
 
690
                              for attr in self.runtime_expansions }
500
691
            try:
501
 
                # In case checker_command has exactly one % operator
502
 
                command = self.checker_command % self.host
503
 
            except TypeError:
504
 
                # Escape attributes for the shell
505
 
                escaped_attrs = dict(
506
 
                    (attr,
507
 
                     re.escape(unicode(str(getattr(self, attr, "")),
508
 
                                       errors=
509
 
                                       'replace')))
510
 
                    for attr in
511
 
                    self.runtime_expansions)
512
 
                
513
 
                try:
514
 
                    command = self.checker_command % escaped_attrs
515
 
                except TypeError as error:
516
 
                    logger.error('Could not format string "%s":'
517
 
                                 ' %s', self.checker_command, error)
518
 
                    return True # Try again later
 
692
                command = self.checker_command % escaped_attrs
 
693
            except TypeError as error:
 
694
                logger.error('Could not format string "%s"',
 
695
                             self.checker_command, exc_info=error)
 
696
                return True # Try again later
519
697
            self.current_checker_command = command
520
698
            try:
521
699
                logger.info("Starting checker %r for %s",
524
702
                # in normal mode, that is already done by daemon(),
525
703
                # and in debug mode we don't want to.  (Stdin is
526
704
                # always replaced by /dev/null.)
 
705
                # The exception is when not debugging but nevertheless
 
706
                # running in the foreground; use the previously
 
707
                # created wnull.
 
708
                popen_args = {}
 
709
                if (not self.server_settings["debug"]
 
710
                    and self.server_settings["foreground"]):
 
711
                    popen_args.update({"stdout": wnull,
 
712
                                       "stderr": wnull })
527
713
                self.checker = subprocess.Popen(command,
528
714
                                                close_fds=True,
529
 
                                                shell=True, cwd="/")
530
 
                self.checker_callback_tag = (gobject.child_watch_add
531
 
                                             (self.checker.pid,
532
 
                                              self.checker_callback,
533
 
                                              data=command))
534
 
                # The checker may have completed before the gobject
535
 
                # watch was added.  Check for this.
 
715
                                                shell=True, cwd="/",
 
716
                                                **popen_args)
 
717
            except OSError as error:
 
718
                logger.error("Failed to start subprocess",
 
719
                             exc_info=error)
 
720
                return True
 
721
            self.checker_callback_tag = (gobject.child_watch_add
 
722
                                         (self.checker.pid,
 
723
                                          self.checker_callback,
 
724
                                          data=command))
 
725
            # The checker may have completed before the gobject
 
726
            # watch was added.  Check for this.
 
727
            try:
536
728
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
537
 
                if pid:
538
 
                    gobject.source_remove(self.checker_callback_tag)
539
 
                    self.checker_callback(pid, status, command)
540
729
            except OSError as error:
541
 
                logger.error("Failed to start subprocess: %s",
542
 
                             error)
 
730
                if error.errno == errno.ECHILD:
 
731
                    # This should never happen
 
732
                    logger.error("Child process vanished",
 
733
                                 exc_info=error)
 
734
                    return True
 
735
                raise
 
736
            if pid:
 
737
                gobject.source_remove(self.checker_callback_tag)
 
738
                self.checker_callback(pid, status, command)
543
739
        # Re-run this periodically if run by gobject.timeout_add
544
740
        return True
545
741
    
552
748
            return
553
749
        logger.debug("Stopping checker for %(name)s", vars(self))
554
750
        try:
555
 
            os.kill(self.checker.pid, signal.SIGTERM)
 
751
            self.checker.terminate()
556
752
            #time.sleep(0.5)
557
753
            #if self.checker.poll() is None:
558
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
754
            #    self.checker.kill()
559
755
        except OSError as error:
560
756
            if error.errno != errno.ESRCH: # No such process
561
757
                raise
578
774
    # "Set" method, so we fail early here:
579
775
    if byte_arrays and signature != "ay":
580
776
        raise ValueError("Byte arrays not supported for non-'ay'"
581
 
                         " signature %r" % signature)
 
777
                         " signature {!r}".format(signature))
582
778
    def decorator(func):
583
779
        func._dbus_is_property = True
584
780
        func._dbus_interface = dbus_interface
592
788
    return decorator
593
789
 
594
790
 
 
791
def dbus_interface_annotations(dbus_interface):
 
792
    """Decorator for marking functions returning interface annotations
 
793
    
 
794
    Usage:
 
795
    
 
796
    @dbus_interface_annotations("org.example.Interface")
 
797
    def _foo(self):  # Function name does not matter
 
798
        return {"org.freedesktop.DBus.Deprecated": "true",
 
799
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
800
                    "false"}
 
801
    """
 
802
    def decorator(func):
 
803
        func._dbus_is_interface = True
 
804
        func._dbus_interface = dbus_interface
 
805
        func._dbus_name = dbus_interface
 
806
        return func
 
807
    return decorator
 
808
 
 
809
 
 
810
def dbus_annotations(annotations):
 
811
    """Decorator to annotate D-Bus methods, signals or properties
 
812
    Usage:
 
813
    
 
814
    @dbus_service_property("org.example.Interface", signature="b",
 
815
                           access="r")
 
816
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
817
                        "org.freedesktop.DBus.Property."
 
818
                        "EmitsChangedSignal": "false"})
 
819
    def Property_dbus_property(self):
 
820
        return dbus.Boolean(False)
 
821
    """
 
822
    def decorator(func):
 
823
        func._dbus_annotations = annotations
 
824
        return func
 
825
    return decorator
 
826
 
 
827
 
595
828
class DBusPropertyException(dbus.exceptions.DBusException):
596
829
    """A base class for D-Bus property-related exceptions
597
830
    """
598
 
    def __unicode__(self):
599
 
        return unicode(str(self))
600
 
 
 
831
    pass
601
832
 
602
833
class DBusPropertyAccessException(DBusPropertyException):
603
834
    """A property's access permissions disallows an operation.
620
851
    """
621
852
    
622
853
    @staticmethod
623
 
    def _is_dbus_property(obj):
624
 
        return getattr(obj, "_dbus_is_property", False)
 
854
    def _is_dbus_thing(thing):
 
855
        """Returns a function testing if an attribute is a D-Bus thing
 
856
        
 
857
        If called like _is_dbus_thing("method") it returns a function
 
858
        suitable for use as predicate to inspect.getmembers().
 
859
        """
 
860
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
 
861
                                   False)
625
862
    
626
 
    def _get_all_dbus_properties(self):
 
863
    def _get_all_dbus_things(self, thing):
627
864
        """Returns a generator of (name, attribute) pairs
628
865
        """
629
 
        return ((prop._dbus_name, prop)
630
 
                for name, prop in
631
 
                inspect.getmembers(self, self._is_dbus_property))
 
866
        return ((getattr(athing.__get__(self), "_dbus_name",
 
867
                         name),
 
868
                 athing.__get__(self))
 
869
                for cls in self.__class__.__mro__
 
870
                for name, athing in
 
871
                inspect.getmembers(cls,
 
872
                                   self._is_dbus_thing(thing)))
632
873
    
633
874
    def _get_dbus_property(self, interface_name, property_name):
634
875
        """Returns a bound method if one exists which is a D-Bus
635
876
        property with the specified name and interface.
636
877
        """
637
 
        for name in (property_name,
638
 
                     property_name + "_dbus_property"):
639
 
            prop = getattr(self, name, None)
640
 
            if (prop is None
641
 
                or not self._is_dbus_property(prop)
642
 
                or prop._dbus_name != property_name
643
 
                or (interface_name and prop._dbus_interface
644
 
                    and interface_name != prop._dbus_interface)):
645
 
                continue
646
 
            return prop
 
878
        for cls in  self.__class__.__mro__:
 
879
            for name, value in (inspect.getmembers
 
880
                                (cls,
 
881
                                 self._is_dbus_thing("property"))):
 
882
                if (value._dbus_name == property_name
 
883
                    and value._dbus_interface == interface_name):
 
884
                    return value.__get__(self)
 
885
        
647
886
        # No such property
648
887
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
649
888
                                   + interface_name + "."
673
912
            # The byte_arrays option is not supported yet on
674
913
            # signatures other than "ay".
675
914
            if prop._dbus_signature != "ay":
676
 
                raise ValueError
677
 
            value = dbus.ByteArray(''.join(unichr(byte)
678
 
                                           for byte in value))
 
915
                raise ValueError("Byte arrays not supported for non-"
 
916
                                 "'ay' signature {!r}"
 
917
                                 .format(prop._dbus_signature))
 
918
            value = dbus.ByteArray(b''.join(chr(byte)
 
919
                                            for byte in value))
679
920
        prop(value)
680
921
    
681
922
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
686
927
        
687
928
        Note: Will not include properties with access="write".
688
929
        """
689
 
        all = {}
690
 
        for name, prop in self._get_all_dbus_properties():
 
930
        properties = {}
 
931
        for name, prop in self._get_all_dbus_things("property"):
691
932
            if (interface_name
692
933
                and interface_name != prop._dbus_interface):
693
934
                # Interface non-empty but did not match
697
938
                continue
698
939
            value = prop()
699
940
            if not hasattr(value, "variant_level"):
700
 
                all[name] = value
 
941
                properties[name] = value
701
942
                continue
702
 
            all[name] = type(value)(value, variant_level=
703
 
                                    value.variant_level+1)
704
 
        return dbus.Dictionary(all, signature="sv")
 
943
            properties[name] = type(value)(value, variant_level=
 
944
                                           value.variant_level+1)
 
945
        return dbus.Dictionary(properties, signature="sv")
705
946
    
706
947
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
707
948
                         out_signature="s",
708
949
                         path_keyword='object_path',
709
950
                         connection_keyword='connection')
710
951
    def Introspect(self, object_path, connection):
711
 
        """Standard D-Bus method, overloaded to insert property tags.
 
952
        """Overloading of standard D-Bus method.
 
953
        
 
954
        Inserts property tags and interface annotation tags.
712
955
        """
713
956
        xmlstring = dbus.service.Object.Introspect(self, object_path,
714
957
                                                   connection)
721
964
                e.setAttribute("access", prop._dbus_access)
722
965
                return e
723
966
            for if_tag in document.getElementsByTagName("interface"):
 
967
                # Add property tags
724
968
                for tag in (make_tag(document, name, prop)
725
969
                            for name, prop
726
 
                            in self._get_all_dbus_properties()
 
970
                            in self._get_all_dbus_things("property")
727
971
                            if prop._dbus_interface
728
972
                            == if_tag.getAttribute("name")):
729
973
                    if_tag.appendChild(tag)
 
974
                # Add annotation tags
 
975
                for typ in ("method", "signal", "property"):
 
976
                    for tag in if_tag.getElementsByTagName(typ):
 
977
                        annots = dict()
 
978
                        for name, prop in (self.
 
979
                                           _get_all_dbus_things(typ)):
 
980
                            if (name == tag.getAttribute("name")
 
981
                                and prop._dbus_interface
 
982
                                == if_tag.getAttribute("name")):
 
983
                                annots.update(getattr
 
984
                                              (prop,
 
985
                                               "_dbus_annotations",
 
986
                                               {}))
 
987
                        for name, value in annots.items():
 
988
                            ann_tag = document.createElement(
 
989
                                "annotation")
 
990
                            ann_tag.setAttribute("name", name)
 
991
                            ann_tag.setAttribute("value", value)
 
992
                            tag.appendChild(ann_tag)
 
993
                # Add interface annotation tags
 
994
                for annotation, value in dict(
 
995
                    itertools.chain.from_iterable(
 
996
                        annotations().items()
 
997
                        for name, annotations in
 
998
                        self._get_all_dbus_things("interface")
 
999
                        if name == if_tag.getAttribute("name")
 
1000
                        )).items():
 
1001
                    ann_tag = document.createElement("annotation")
 
1002
                    ann_tag.setAttribute("name", annotation)
 
1003
                    ann_tag.setAttribute("value", value)
 
1004
                    if_tag.appendChild(ann_tag)
730
1005
                # Add the names to the return values for the
731
1006
                # "org.freedesktop.DBus.Properties" methods
732
1007
                if (if_tag.getAttribute("name")
747
1022
        except (AttributeError, xml.dom.DOMException,
748
1023
                xml.parsers.expat.ExpatError) as error:
749
1024
            logger.error("Failed to override Introspection method",
750
 
                         error)
 
1025
                         exc_info=error)
751
1026
        return xmlstring
752
1027
 
753
1028
 
754
 
def datetime_to_dbus (dt, variant_level=0):
 
1029
def datetime_to_dbus(dt, variant_level=0):
755
1030
    """Convert a UTC datetime.datetime() to a D-Bus type."""
756
1031
    if dt is None:
757
1032
        return dbus.String("", variant_level = variant_level)
759
1034
                       variant_level=variant_level)
760
1035
 
761
1036
 
 
1037
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1038
    """A class decorator; applied to a subclass of
 
1039
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1040
    interface names according to the "alt_interface_names" mapping.
 
1041
    Usage:
 
1042
    
 
1043
    @alternate_dbus_interfaces({"org.example.Interface":
 
1044
                                    "net.example.AlternateInterface"})
 
1045
    class SampleDBusObject(dbus.service.Object):
 
1046
        @dbus.service.method("org.example.Interface")
 
1047
        def SampleDBusMethod():
 
1048
            pass
 
1049
    
 
1050
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1051
    reachable via two interfaces: "org.example.Interface" and
 
1052
    "net.example.AlternateInterface", the latter of which will have
 
1053
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1054
    "true", unless "deprecate" is passed with a False value.
 
1055
    
 
1056
    This works for methods and signals, and also for D-Bus properties
 
1057
    (from DBusObjectWithProperties) and interfaces (from the
 
1058
    dbus_interface_annotations decorator).
 
1059
    """
 
1060
    def wrapper(cls):
 
1061
        for orig_interface_name, alt_interface_name in (
 
1062
            alt_interface_names.items()):
 
1063
            attr = {}
 
1064
            interface_names = set()
 
1065
            # Go though all attributes of the class
 
1066
            for attrname, attribute in inspect.getmembers(cls):
 
1067
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
1068
                # with the wrong interface name
 
1069
                if (not hasattr(attribute, "_dbus_interface")
 
1070
                    or not attribute._dbus_interface
 
1071
                    .startswith(orig_interface_name)):
 
1072
                    continue
 
1073
                # Create an alternate D-Bus interface name based on
 
1074
                # the current name
 
1075
                alt_interface = (attribute._dbus_interface
 
1076
                                 .replace(orig_interface_name,
 
1077
                                          alt_interface_name))
 
1078
                interface_names.add(alt_interface)
 
1079
                # Is this a D-Bus signal?
 
1080
                if getattr(attribute, "_dbus_is_signal", False):
 
1081
                    # Extract the original non-method undecorated
 
1082
                    # function by black magic
 
1083
                    nonmethod_func = (dict(
 
1084
                            zip(attribute.func_code.co_freevars,
 
1085
                                attribute.__closure__))["func"]
 
1086
                                      .cell_contents)
 
1087
                    # Create a new, but exactly alike, function
 
1088
                    # object, and decorate it to be a new D-Bus signal
 
1089
                    # with the alternate D-Bus interface name
 
1090
                    new_function = (dbus.service.signal
 
1091
                                    (alt_interface,
 
1092
                                     attribute._dbus_signature)
 
1093
                                    (types.FunctionType(
 
1094
                                nonmethod_func.func_code,
 
1095
                                nonmethod_func.func_globals,
 
1096
                                nonmethod_func.func_name,
 
1097
                                nonmethod_func.func_defaults,
 
1098
                                nonmethod_func.func_closure)))
 
1099
                    # Copy annotations, if any
 
1100
                    try:
 
1101
                        new_function._dbus_annotations = (
 
1102
                            dict(attribute._dbus_annotations))
 
1103
                    except AttributeError:
 
1104
                        pass
 
1105
                    # Define a creator of a function to call both the
 
1106
                    # original and alternate functions, so both the
 
1107
                    # original and alternate signals gets sent when
 
1108
                    # the function is called
 
1109
                    def fixscope(func1, func2):
 
1110
                        """This function is a scope container to pass
 
1111
                        func1 and func2 to the "call_both" function
 
1112
                        outside of its arguments"""
 
1113
                        def call_both(*args, **kwargs):
 
1114
                            """This function will emit two D-Bus
 
1115
                            signals by calling func1 and func2"""
 
1116
                            func1(*args, **kwargs)
 
1117
                            func2(*args, **kwargs)
 
1118
                        return call_both
 
1119
                    # Create the "call_both" function and add it to
 
1120
                    # the class
 
1121
                    attr[attrname] = fixscope(attribute, new_function)
 
1122
                # Is this a D-Bus method?
 
1123
                elif getattr(attribute, "_dbus_is_method", False):
 
1124
                    # Create a new, but exactly alike, function
 
1125
                    # object.  Decorate it to be a new D-Bus method
 
1126
                    # with the alternate D-Bus interface name.  Add it
 
1127
                    # to the class.
 
1128
                    attr[attrname] = (dbus.service.method
 
1129
                                      (alt_interface,
 
1130
                                       attribute._dbus_in_signature,
 
1131
                                       attribute._dbus_out_signature)
 
1132
                                      (types.FunctionType
 
1133
                                       (attribute.func_code,
 
1134
                                        attribute.func_globals,
 
1135
                                        attribute.func_name,
 
1136
                                        attribute.func_defaults,
 
1137
                                        attribute.func_closure)))
 
1138
                    # Copy annotations, if any
 
1139
                    try:
 
1140
                        attr[attrname]._dbus_annotations = (
 
1141
                            dict(attribute._dbus_annotations))
 
1142
                    except AttributeError:
 
1143
                        pass
 
1144
                # Is this a D-Bus property?
 
1145
                elif getattr(attribute, "_dbus_is_property", False):
 
1146
                    # Create a new, but exactly alike, function
 
1147
                    # object, and decorate it to be a new D-Bus
 
1148
                    # property with the alternate D-Bus interface
 
1149
                    # name.  Add it to the class.
 
1150
                    attr[attrname] = (dbus_service_property
 
1151
                                      (alt_interface,
 
1152
                                       attribute._dbus_signature,
 
1153
                                       attribute._dbus_access,
 
1154
                                       attribute
 
1155
                                       ._dbus_get_args_options
 
1156
                                       ["byte_arrays"])
 
1157
                                      (types.FunctionType
 
1158
                                       (attribute.func_code,
 
1159
                                        attribute.func_globals,
 
1160
                                        attribute.func_name,
 
1161
                                        attribute.func_defaults,
 
1162
                                        attribute.func_closure)))
 
1163
                    # Copy annotations, if any
 
1164
                    try:
 
1165
                        attr[attrname]._dbus_annotations = (
 
1166
                            dict(attribute._dbus_annotations))
 
1167
                    except AttributeError:
 
1168
                        pass
 
1169
                # Is this a D-Bus interface?
 
1170
                elif getattr(attribute, "_dbus_is_interface", False):
 
1171
                    # Create a new, but exactly alike, function
 
1172
                    # object.  Decorate it to be a new D-Bus interface
 
1173
                    # with the alternate D-Bus interface name.  Add it
 
1174
                    # to the class.
 
1175
                    attr[attrname] = (dbus_interface_annotations
 
1176
                                      (alt_interface)
 
1177
                                      (types.FunctionType
 
1178
                                       (attribute.func_code,
 
1179
                                        attribute.func_globals,
 
1180
                                        attribute.func_name,
 
1181
                                        attribute.func_defaults,
 
1182
                                        attribute.func_closure)))
 
1183
            if deprecate:
 
1184
                # Deprecate all alternate interfaces
 
1185
                iname="_AlternateDBusNames_interface_annotation{}"
 
1186
                for interface_name in interface_names:
 
1187
                    @dbus_interface_annotations(interface_name)
 
1188
                    def func(self):
 
1189
                        return { "org.freedesktop.DBus.Deprecated":
 
1190
                                     "true" }
 
1191
                    # Find an unused name
 
1192
                    for aname in (iname.format(i)
 
1193
                                  for i in itertools.count()):
 
1194
                        if aname not in attr:
 
1195
                            attr[aname] = func
 
1196
                            break
 
1197
            if interface_names:
 
1198
                # Replace the class with a new subclass of it with
 
1199
                # methods, signals, etc. as created above.
 
1200
                cls = type(b"{}Alternate".format(cls.__name__),
 
1201
                           (cls,), attr)
 
1202
        return cls
 
1203
    return wrapper
 
1204
 
 
1205
 
 
1206
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1207
                                "se.bsnet.fukt.Mandos"})
762
1208
class ClientDBus(Client, DBusObjectWithProperties):
763
1209
    """A Client class using D-Bus
764
1210
    
773
1219
    # dbus.service.Object doesn't use super(), so we can't either.
774
1220
    
775
1221
    def __init__(self, bus = None, *args, **kwargs):
776
 
        self._approvals_pending = 0
777
1222
        self.bus = bus
778
1223
        Client.__init__(self, *args, **kwargs)
779
1224
        # Only now, when this client is initialized, can it show up on
785
1230
                                 ("/clients/" + client_object_name))
786
1231
        DBusObjectWithProperties.__init__(self, self.bus,
787
1232
                                          self.dbus_object_path)
788
 
        
 
1233
    
789
1234
    def notifychangeproperty(transform_func,
790
1235
                             dbus_name, type_func=lambda x: x,
791
1236
                             variant_level=1):
792
 
        """ Modify a variable so that its a property that announce its
793
 
        changes to DBus.
794
 
        transform_fun: Function that takes a value and transform it to
795
 
                       DBus type.
796
 
        dbus_name: DBus name of the variable
 
1237
        """ Modify a variable so that it's a property which announces
 
1238
        its changes to DBus.
 
1239
        
 
1240
        transform_fun: Function that takes a value and a variant_level
 
1241
                       and transforms it to a D-Bus type.
 
1242
        dbus_name: D-Bus name of the variable
797
1243
        type_func: Function that transform the value before sending it
798
 
                   to DBus
799
 
        variant_level: DBus variant level. default: 1
 
1244
                   to the D-Bus.  Default: no transform
 
1245
        variant_level: D-Bus variant level.  Default: 1
800
1246
        """
801
 
        real_value = [None,]
 
1247
        attrname = "_{}".format(dbus_name)
802
1248
        def setter(self, value):
803
 
            old_value = real_value[0]
804
 
            real_value[0] = value
805
1249
            if hasattr(self, "dbus_object_path"):
806
 
                if type_func(old_value) != type_func(real_value[0]):
807
 
                    dbus_value = transform_func(type_func(real_value[0]),
808
 
                                                variant_level)
 
1250
                if (not hasattr(self, attrname) or
 
1251
                    type_func(getattr(self, attrname, None))
 
1252
                    != type_func(value)):
 
1253
                    dbus_value = transform_func(type_func(value),
 
1254
                                                variant_level
 
1255
                                                =variant_level)
809
1256
                    self.PropertyChanged(dbus.String(dbus_name),
810
1257
                                         dbus_value)
 
1258
            setattr(self, attrname, value)
811
1259
        
812
 
        return property(lambda self: real_value[0], setter)
813
 
    
 
1260
        return property(lambda self: getattr(self, attrname), setter)
814
1261
    
815
1262
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
816
1263
    approvals_pending = notifychangeproperty(dbus.Boolean,
820
1267
    last_enabled = notifychangeproperty(datetime_to_dbus,
821
1268
                                        "LastEnabled")
822
1269
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
823
 
                                   type_func = lambda checker: checker is not None)
 
1270
                                   type_func = lambda checker:
 
1271
                                       checker is not None)
824
1272
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
825
1273
                                           "LastCheckedOK")
826
 
    last_approval_request = notifychangeproperty(datetime_to_dbus,
827
 
                                                 "LastApprovalRequest")
 
1274
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1275
                                               "LastCheckerStatus")
 
1276
    last_approval_request = notifychangeproperty(
 
1277
        datetime_to_dbus, "LastApprovalRequest")
828
1278
    approved_by_default = notifychangeproperty(dbus.Boolean,
829
1279
                                               "ApprovedByDefault")
830
 
    approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
831
 
                                          type_func = _timedelta_to_milliseconds)
832
 
    approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
833
 
                                             type_func = _timedelta_to_milliseconds)
 
1280
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1281
                                          "ApprovalDelay",
 
1282
                                          type_func =
 
1283
                                          lambda td: td.total_seconds()
 
1284
                                          * 1000)
 
1285
    approval_duration = notifychangeproperty(
 
1286
        dbus.UInt64, "ApprovalDuration",
 
1287
        type_func = lambda td: td.total_seconds() * 1000)
834
1288
    host = notifychangeproperty(dbus.String, "Host")
835
 
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
836
 
                                   type_func = _timedelta_to_milliseconds)
837
 
    extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
838
 
                                            type_func = _timedelta_to_milliseconds)
839
 
    interval = notifychangeproperty(dbus.UInt16, "Interval",
840
 
                                    type_func = _timedelta_to_milliseconds)
 
1289
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1290
                                   type_func = lambda td:
 
1291
                                       td.total_seconds() * 1000)
 
1292
    extended_timeout = notifychangeproperty(
 
1293
        dbus.UInt64, "ExtendedTimeout",
 
1294
        type_func = lambda td: td.total_seconds() * 1000)
 
1295
    interval = notifychangeproperty(dbus.UInt64,
 
1296
                                    "Interval",
 
1297
                                    type_func =
 
1298
                                    lambda td: td.total_seconds()
 
1299
                                    * 1000)
841
1300
    checker_command = notifychangeproperty(dbus.String, "Checker")
842
1301
    
843
1302
    del notifychangeproperty
871
1330
                                       *args, **kwargs)
872
1331
    
873
1332
    def start_checker(self, *args, **kwargs):
874
 
        old_checker = self.checker
875
 
        if self.checker is not None:
876
 
            old_checker_pid = self.checker.pid
877
 
        else:
878
 
            old_checker_pid = None
 
1333
        old_checker_pid = getattr(self.checker, "pid", None)
879
1334
        r = Client.start_checker(self, *args, **kwargs)
880
1335
        # Only if new checker process was started
881
1336
        if (self.checker is not None
885
1340
        return r
886
1341
    
887
1342
    def _reset_approved(self):
888
 
        self._approved = None
 
1343
        self.approved = None
889
1344
        return False
890
1345
    
891
1346
    def approve(self, value=True):
 
1347
        self.approved = value
 
1348
        gobject.timeout_add(int(self.approval_duration.total_seconds()
 
1349
                                * 1000), self._reset_approved)
892
1350
        self.send_changedstate()
893
 
        self._approved = value
894
 
        gobject.timeout_add(_timedelta_to_milliseconds
895
 
                            (self.approval_duration),
896
 
                            self._reset_approved)
897
 
    
898
1351
    
899
1352
    ## D-Bus methods, signals & properties
900
 
    _interface = "se.bsnet.fukt.Mandos.Client"
 
1353
    _interface = "se.recompile.Mandos.Client"
 
1354
    
 
1355
    ## Interfaces
 
1356
    
 
1357
    @dbus_interface_annotations(_interface)
 
1358
    def _foo(self):
 
1359
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1360
                     "false"}
901
1361
    
902
1362
    ## Signals
903
1363
    
995
1455
                           access="readwrite")
996
1456
    def ApprovalDelay_dbus_property(self, value=None):
997
1457
        if value is None:       # get
998
 
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1458
            return dbus.UInt64(self.approval_delay.total_seconds()
 
1459
                               * 1000)
999
1460
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1000
1461
    
1001
1462
    # ApprovalDuration - property
1003
1464
                           access="readwrite")
1004
1465
    def ApprovalDuration_dbus_property(self, value=None):
1005
1466
        if value is None:       # get
1006
 
            return dbus.UInt64(_timedelta_to_milliseconds(
1007
 
                    self.approval_duration))
 
1467
            return dbus.UInt64(self.approval_duration.total_seconds()
 
1468
                               * 1000)
1008
1469
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1009
1470
    
1010
1471
    # Name - property
1023
1484
    def Host_dbus_property(self, value=None):
1024
1485
        if value is None:       # get
1025
1486
            return dbus.String(self.host)
1026
 
        self.host = value
 
1487
        self.host = unicode(value)
1027
1488
    
1028
1489
    # Created - property
1029
1490
    @dbus_service_property(_interface, signature="s", access="read")
1030
1491
    def Created_dbus_property(self):
1031
 
        return dbus.String(datetime_to_dbus(self.created))
 
1492
        return datetime_to_dbus(self.created)
1032
1493
    
1033
1494
    # LastEnabled - property
1034
1495
    @dbus_service_property(_interface, signature="s", access="read")
1055
1516
            return
1056
1517
        return datetime_to_dbus(self.last_checked_ok)
1057
1518
    
 
1519
    # LastCheckerStatus - property
 
1520
    @dbus_service_property(_interface, signature="n",
 
1521
                           access="read")
 
1522
    def LastCheckerStatus_dbus_property(self):
 
1523
        return dbus.Int16(self.last_checker_status)
 
1524
    
1058
1525
    # Expires - property
1059
1526
    @dbus_service_property(_interface, signature="s", access="read")
1060
1527
    def Expires_dbus_property(self):
1070
1537
                           access="readwrite")
1071
1538
    def Timeout_dbus_property(self, value=None):
1072
1539
        if value is None:       # get
1073
 
            return dbus.UInt64(self.timeout_milliseconds())
 
1540
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
 
1541
        old_timeout = self.timeout
1074
1542
        self.timeout = datetime.timedelta(0, 0, 0, value)
1075
 
        if getattr(self, "disable_initiator_tag", None) is None:
1076
 
            return
1077
 
        # Reschedule timeout
1078
 
        gobject.source_remove(self.disable_initiator_tag)
1079
 
        self.disable_initiator_tag = None
1080
 
        self.expires = None
1081
 
        time_to_die = (self.
1082
 
                       _timedelta_to_milliseconds((self
1083
 
                                                   .last_checked_ok
1084
 
                                                   + self.timeout)
1085
 
                                                  - datetime.datetime
1086
 
                                                  .utcnow()))
1087
 
        if time_to_die <= 0:
1088
 
            # The timeout has passed
1089
 
            self.disable()
1090
 
        else:
1091
 
            self.expires = (datetime.datetime.utcnow()
1092
 
                            + datetime.timedelta(milliseconds = time_to_die))
1093
 
            self.disable_initiator_tag = (gobject.timeout_add
1094
 
                                          (time_to_die, self.disable))
 
1543
        # Reschedule disabling
 
1544
        if self.enabled:
 
1545
            now = datetime.datetime.utcnow()
 
1546
            self.expires += self.timeout - old_timeout
 
1547
            if self.expires <= now:
 
1548
                # The timeout has passed
 
1549
                self.disable()
 
1550
            else:
 
1551
                if (getattr(self, "disable_initiator_tag", None)
 
1552
                    is None):
 
1553
                    return
 
1554
                gobject.source_remove(self.disable_initiator_tag)
 
1555
                self.disable_initiator_tag = (
 
1556
                    gobject.timeout_add(
 
1557
                        int((self.expires - now).total_seconds()
 
1558
                            * 1000), self.disable))
1095
1559
    
1096
1560
    # ExtendedTimeout - property
1097
1561
    @dbus_service_property(_interface, signature="t",
1098
1562
                           access="readwrite")
1099
1563
    def ExtendedTimeout_dbus_property(self, value=None):
1100
1564
        if value is None:       # get
1101
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1565
            return dbus.UInt64(self.extended_timeout.total_seconds()
 
1566
                               * 1000)
1102
1567
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1103
1568
    
1104
1569
    # Interval - property
1106
1571
                           access="readwrite")
1107
1572
    def Interval_dbus_property(self, value=None):
1108
1573
        if value is None:       # get
1109
 
            return dbus.UInt64(self.interval_milliseconds())
 
1574
            return dbus.UInt64(self.interval.total_seconds() * 1000)
1110
1575
        self.interval = datetime.timedelta(0, 0, 0, value)
1111
1576
        if getattr(self, "checker_initiator_tag", None) is None:
1112
1577
            return
1113
 
        # Reschedule checker run
1114
 
        gobject.source_remove(self.checker_initiator_tag)
1115
 
        self.checker_initiator_tag = (gobject.timeout_add
1116
 
                                      (value, self.start_checker))
1117
 
        self.start_checker()    # Start one now, too
 
1578
        if self.enabled:
 
1579
            # Reschedule checker run
 
1580
            gobject.source_remove(self.checker_initiator_tag)
 
1581
            self.checker_initiator_tag = (gobject.timeout_add
 
1582
                                          (value, self.start_checker))
 
1583
            self.start_checker()    # Start one now, too
1118
1584
    
1119
1585
    # Checker - property
1120
1586
    @dbus_service_property(_interface, signature="s",
1122
1588
    def Checker_dbus_property(self, value=None):
1123
1589
        if value is None:       # get
1124
1590
            return dbus.String(self.checker_command)
1125
 
        self.checker_command = value
 
1591
        self.checker_command = unicode(value)
1126
1592
    
1127
1593
    # CheckerRunning - property
1128
1594
    @dbus_service_property(_interface, signature="b",
1144
1610
    @dbus_service_property(_interface, signature="ay",
1145
1611
                           access="write", byte_arrays=True)
1146
1612
    def Secret_dbus_property(self, value):
1147
 
        self.secret = str(value)
 
1613
        self.secret = bytes(value)
1148
1614
    
1149
1615
    del _interface
1150
1616
 
1157
1623
            raise KeyError()
1158
1624
    
1159
1625
    def __getattribute__(self, name):
1160
 
        if(name == '_pipe'):
 
1626
        if name == '_pipe':
1161
1627
            return super(ProxyClient, self).__getattribute__(name)
1162
1628
        self._pipe.send(('getattr', name))
1163
1629
        data = self._pipe.recv()
1170
1636
            return func
1171
1637
    
1172
1638
    def __setattr__(self, name, value):
1173
 
        if(name == '_pipe'):
 
1639
        if name == '_pipe':
1174
1640
            return super(ProxyClient, self).__setattr__(name, value)
1175
1641
        self._pipe.send(('setattr', name, value))
1176
1642
 
1216
1682
            logger.debug("Protocol version: %r", line)
1217
1683
            try:
1218
1684
                if int(line.strip().split()[0]) > 1:
1219
 
                    raise RuntimeError
 
1685
                    raise RuntimeError(line)
1220
1686
            except (ValueError, IndexError, RuntimeError) as error:
1221
1687
                logger.error("Unknown protocol version: %s", error)
1222
1688
                return
1259
1725
                                       client.name)
1260
1726
                        if self.server.use_dbus:
1261
1727
                            # Emit D-Bus signal
1262
 
                            client.Rejected("Disabled")                    
 
1728
                            client.Rejected("Disabled")
1263
1729
                        return
1264
1730
                    
1265
 
                    if client._approved or not client.approval_delay:
 
1731
                    if client.approved or not client.approval_delay:
1266
1732
                        #We are approved or approval is disabled
1267
1733
                        break
1268
 
                    elif client._approved is None:
 
1734
                    elif client.approved is None:
1269
1735
                        logger.info("Client %s needs approval",
1270
1736
                                    client.name)
1271
1737
                        if self.server.use_dbus:
1272
1738
                            # Emit D-Bus signal
1273
1739
                            client.NeedApproval(
1274
 
                                client.approval_delay_milliseconds(),
1275
 
                                client.approved_by_default)
 
1740
                                client.approval_delay.total_seconds()
 
1741
                                * 1000, client.approved_by_default)
1276
1742
                    else:
1277
1743
                        logger.warning("Client %s was not approved",
1278
1744
                                       client.name)
1282
1748
                        return
1283
1749
                    
1284
1750
                    #wait until timeout or approved
1285
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1286
1751
                    time = datetime.datetime.now()
1287
1752
                    client.changedstate.acquire()
1288
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1753
                    client.changedstate.wait(delay.total_seconds())
1289
1754
                    client.changedstate.release()
1290
1755
                    time2 = datetime.datetime.now()
1291
1756
                    if (time2 - time) >= delay:
1307
1772
                    try:
1308
1773
                        sent = session.send(client.secret[sent_size:])
1309
1774
                    except gnutls.errors.GNUTLSError as error:
1310
 
                        logger.warning("gnutls send failed")
 
1775
                        logger.warning("gnutls send failed",
 
1776
                                       exc_info=error)
1311
1777
                        return
1312
1778
                    logger.debug("Sent: %d, remaining: %d",
1313
1779
                                 sent, len(client.secret)
1315
1781
                    sent_size += sent
1316
1782
                
1317
1783
                logger.info("Sending secret to %s", client.name)
1318
 
                # bump the timeout as if seen
1319
 
                client.checked_ok(client.extended_timeout)
 
1784
                # bump the timeout using extended_timeout
 
1785
                client.bump_timeout(client.extended_timeout)
1320
1786
                if self.server.use_dbus:
1321
1787
                    # Emit D-Bus signal
1322
1788
                    client.GotSecret()
1327
1793
                try:
1328
1794
                    session.bye()
1329
1795
                except gnutls.errors.GNUTLSError as error:
1330
 
                    logger.warning("GnuTLS bye failed")
 
1796
                    logger.warning("GnuTLS bye failed",
 
1797
                                   exc_info=error)
1331
1798
    
1332
1799
    @staticmethod
1333
1800
    def peer_certificate(session):
1389
1856
        # Convert the buffer to a Python bytestring
1390
1857
        fpr = ctypes.string_at(buf, buf_len.value)
1391
1858
        # Convert the bytestring to hexadecimal notation
1392
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1859
        hex_fpr = binascii.hexlify(fpr).upper()
1393
1860
        return hex_fpr
1394
1861
 
1395
1862
 
1398
1865
    def sub_process_main(self, request, address):
1399
1866
        try:
1400
1867
            self.finish_request(request, address)
1401
 
        except:
 
1868
        except Exception:
1402
1869
            self.handle_error(request, address)
1403
1870
        self.close_request(request)
1404
 
            
 
1871
    
1405
1872
    def process_request(self, request, address):
1406
1873
        """Start a new process to process the request."""
1407
 
        multiprocessing.Process(target = self.sub_process_main,
1408
 
                                args = (request, address)).start()
 
1874
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1875
                                       args = (request, address))
 
1876
        proc.start()
 
1877
        return proc
1409
1878
 
1410
1879
 
1411
1880
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1417
1886
        """
1418
1887
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1419
1888
        
1420
 
        super(MultiprocessingMixInWithPipe,
1421
 
              self).process_request(request, client_address)
 
1889
        proc = MultiprocessingMixIn.process_request(self, request,
 
1890
                                                    client_address)
1422
1891
        self.child_pipe.close()
1423
 
        self.add_pipe(parent_pipe)
 
1892
        self.add_pipe(parent_pipe, proc)
1424
1893
    
1425
 
    def add_pipe(self, parent_pipe):
 
1894
    def add_pipe(self, parent_pipe, proc):
1426
1895
        """Dummy function; override as necessary"""
1427
 
        raise NotImplementedError
 
1896
        raise NotImplementedError()
1428
1897
 
1429
1898
 
1430
1899
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1437
1906
        use_ipv6:       Boolean; to use IPv6 or not
1438
1907
    """
1439
1908
    def __init__(self, server_address, RequestHandlerClass,
1440
 
                 interface=None, use_ipv6=True):
 
1909
                 interface=None, use_ipv6=True, socketfd=None):
 
1910
        """If socketfd is set, use that file descriptor instead of
 
1911
        creating a new one with socket.socket().
 
1912
        """
1441
1913
        self.interface = interface
1442
1914
        if use_ipv6:
1443
1915
            self.address_family = socket.AF_INET6
 
1916
        if socketfd is not None:
 
1917
            # Save the file descriptor
 
1918
            self.socketfd = socketfd
 
1919
            # Save the original socket.socket() function
 
1920
            self.socket_socket = socket.socket
 
1921
            # To implement --socket, we monkey patch socket.socket.
 
1922
            # 
 
1923
            # (When socketserver.TCPServer is a new-style class, we
 
1924
            # could make self.socket into a property instead of monkey
 
1925
            # patching socket.socket.)
 
1926
            # 
 
1927
            # Create a one-time-only replacement for socket.socket()
 
1928
            @functools.wraps(socket.socket)
 
1929
            def socket_wrapper(*args, **kwargs):
 
1930
                # Restore original function so subsequent calls are
 
1931
                # not affected.
 
1932
                socket.socket = self.socket_socket
 
1933
                del self.socket_socket
 
1934
                # This time only, return a new socket object from the
 
1935
                # saved file descriptor.
 
1936
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
1937
            # Replace socket.socket() function with wrapper
 
1938
            socket.socket = socket_wrapper
 
1939
        # The socketserver.TCPServer.__init__ will call
 
1940
        # socket.socket(), which might be our replacement,
 
1941
        # socket_wrapper(), if socketfd was set.
1444
1942
        socketserver.TCPServer.__init__(self, server_address,
1445
1943
                                        RequestHandlerClass)
 
1944
    
1446
1945
    def server_bind(self):
1447
1946
        """This overrides the normal server_bind() function
1448
1947
        to bind to an interface if one was specified, and also NOT to
1456
1955
                try:
1457
1956
                    self.socket.setsockopt(socket.SOL_SOCKET,
1458
1957
                                           SO_BINDTODEVICE,
1459
 
                                           str(self.interface
1460
 
                                               + '\0'))
 
1958
                                           (self.interface + "\0")
 
1959
                                           .encode("utf-8"))
1461
1960
                except socket.error as error:
1462
 
                    if error[0] == errno.EPERM:
1463
 
                        logger.error("No permission to"
1464
 
                                     " bind to interface %s",
1465
 
                                     self.interface)
1466
 
                    elif error[0] == errno.ENOPROTOOPT:
 
1961
                    if error.errno == errno.EPERM:
 
1962
                        logger.error("No permission to bind to"
 
1963
                                     " interface %s", self.interface)
 
1964
                    elif error.errno == errno.ENOPROTOOPT:
1467
1965
                        logger.error("SO_BINDTODEVICE not available;"
1468
1966
                                     " cannot bind to interface %s",
1469
1967
                                     self.interface)
 
1968
                    elif error.errno == errno.ENODEV:
 
1969
                        logger.error("Interface %s does not exist,"
 
1970
                                     " cannot bind", self.interface)
1470
1971
                    else:
1471
1972
                        raise
1472
1973
        # Only bind(2) the socket if we really need to.
1475
1976
                if self.address_family == socket.AF_INET6:
1476
1977
                    any_address = "::" # in6addr_any
1477
1978
                else:
1478
 
                    any_address = socket.INADDR_ANY
 
1979
                    any_address = "0.0.0.0" # INADDR_ANY
1479
1980
                self.server_address = (any_address,
1480
1981
                                       self.server_address[1])
1481
1982
            elif not self.server_address[1]:
1502
2003
    """
1503
2004
    def __init__(self, server_address, RequestHandlerClass,
1504
2005
                 interface=None, use_ipv6=True, clients=None,
1505
 
                 gnutls_priority=None, use_dbus=True):
 
2006
                 gnutls_priority=None, use_dbus=True, socketfd=None):
1506
2007
        self.enabled = False
1507
2008
        self.clients = clients
1508
2009
        if self.clients is None:
1509
 
            self.clients = set()
 
2010
            self.clients = {}
1510
2011
        self.use_dbus = use_dbus
1511
2012
        self.gnutls_priority = gnutls_priority
1512
2013
        IPv6_TCPServer.__init__(self, server_address,
1513
2014
                                RequestHandlerClass,
1514
2015
                                interface = interface,
1515
 
                                use_ipv6 = use_ipv6)
 
2016
                                use_ipv6 = use_ipv6,
 
2017
                                socketfd = socketfd)
1516
2018
    def server_activate(self):
1517
2019
        if self.enabled:
1518
2020
            return socketserver.TCPServer.server_activate(self)
 
2021
    
1519
2022
    def enable(self):
1520
2023
        self.enabled = True
1521
 
    def add_pipe(self, parent_pipe):
 
2024
    
 
2025
    def add_pipe(self, parent_pipe, proc):
1522
2026
        # Call "handle_ipc" for both data and EOF events
1523
2027
        gobject.io_add_watch(parent_pipe.fileno(),
1524
2028
                             gobject.IO_IN | gobject.IO_HUP,
1525
2029
                             functools.partial(self.handle_ipc,
1526
 
                                               parent_pipe = parent_pipe))
1527
 
        
 
2030
                                               parent_pipe =
 
2031
                                               parent_pipe,
 
2032
                                               proc = proc))
 
2033
    
1528
2034
    def handle_ipc(self, source, condition, parent_pipe=None,
1529
 
                   client_object=None):
1530
 
        condition_names = {
1531
 
            gobject.IO_IN: "IN",   # There is data to read.
1532
 
            gobject.IO_OUT: "OUT", # Data can be written (without
1533
 
                                    # blocking).
1534
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1535
 
            gobject.IO_ERR: "ERR", # Error condition.
1536
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1537
 
                                    # broken, usually for pipes and
1538
 
                                    # sockets).
1539
 
            }
1540
 
        conditions_string = ' | '.join(name
1541
 
                                       for cond, name in
1542
 
                                       condition_names.iteritems()
1543
 
                                       if cond & condition)
1544
 
        # error or the other end of multiprocessing.Pipe has closed
1545
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
2035
                   proc = None, client_object=None):
 
2036
        # error, or the other end of multiprocessing.Pipe has closed
 
2037
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2038
            # Wait for other process to exit
 
2039
            proc.join()
1546
2040
            return False
1547
2041
        
1548
2042
        # Read a request from the child
1553
2047
            fpr = request[1]
1554
2048
            address = request[2]
1555
2049
            
1556
 
            for c in self.clients:
 
2050
            for c in self.clients.itervalues():
1557
2051
                if c.fingerprint == fpr:
1558
2052
                    client = c
1559
2053
                    break
1562
2056
                            "dress: %s", fpr, address)
1563
2057
                if self.use_dbus:
1564
2058
                    # Emit D-Bus signal
1565
 
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
2059
                    mandos_dbus_service.ClientNotFound(fpr,
 
2060
                                                       address[0])
1566
2061
                parent_pipe.send(False)
1567
2062
                return False
1568
2063
            
1569
2064
            gobject.io_add_watch(parent_pipe.fileno(),
1570
2065
                                 gobject.IO_IN | gobject.IO_HUP,
1571
2066
                                 functools.partial(self.handle_ipc,
1572
 
                                                   parent_pipe = parent_pipe,
1573
 
                                                   client_object = client))
 
2067
                                                   parent_pipe =
 
2068
                                                   parent_pipe,
 
2069
                                                   proc = proc,
 
2070
                                                   client_object =
 
2071
                                                   client))
1574
2072
            parent_pipe.send(True)
1575
 
            # remove the old hook in favor of the new above hook on same fileno
 
2073
            # remove the old hook in favor of the new above hook on
 
2074
            # same fileno
1576
2075
            return False
1577
2076
        if command == 'funcall':
1578
2077
            funcname = request[1]
1579
2078
            args = request[2]
1580
2079
            kwargs = request[3]
1581
2080
            
1582
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
2081
            parent_pipe.send(('data', getattr(client_object,
 
2082
                                              funcname)(*args,
 
2083
                                                         **kwargs)))
1583
2084
        
1584
2085
        if command == 'getattr':
1585
2086
            attrname = request[1]
1586
2087
            if callable(client_object.__getattribute__(attrname)):
1587
2088
                parent_pipe.send(('function',))
1588
2089
            else:
1589
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
2090
                parent_pipe.send(('data', client_object
 
2091
                                  .__getattribute__(attrname)))
1590
2092
        
1591
2093
        if command == 'setattr':
1592
2094
            attrname = request[1]
1596
2098
        return True
1597
2099
 
1598
2100
 
 
2101
def rfc3339_duration_to_delta(duration):
 
2102
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2103
    
 
2104
    >>> rfc3339_duration_to_delta("P7D")
 
2105
    datetime.timedelta(7)
 
2106
    >>> rfc3339_duration_to_delta("PT60S")
 
2107
    datetime.timedelta(0, 60)
 
2108
    >>> rfc3339_duration_to_delta("PT60M")
 
2109
    datetime.timedelta(0, 3600)
 
2110
    >>> rfc3339_duration_to_delta("PT24H")
 
2111
    datetime.timedelta(1)
 
2112
    >>> rfc3339_duration_to_delta("P1W")
 
2113
    datetime.timedelta(7)
 
2114
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2115
    datetime.timedelta(0, 330)
 
2116
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2117
    datetime.timedelta(1, 200)
 
2118
    """
 
2119
    
 
2120
    # Parsing an RFC 3339 duration with regular expressions is not
 
2121
    # possible - there would have to be multiple places for the same
 
2122
    # values, like seconds.  The current code, while more esoteric, is
 
2123
    # cleaner without depending on a parsing library.  If Python had a
 
2124
    # built-in library for parsing we would use it, but we'd like to
 
2125
    # avoid excessive use of external libraries.
 
2126
    
 
2127
    # New type for defining tokens, syntax, and semantics all-in-one
 
2128
    Token = collections.namedtuple("Token",
 
2129
                                   ("regexp", # To match token; if
 
2130
                                              # "value" is not None,
 
2131
                                              # must have a "group"
 
2132
                                              # containing digits
 
2133
                                    "value",  # datetime.timedelta or
 
2134
                                              # None
 
2135
                                    "followers")) # Tokens valid after
 
2136
                                                  # this token
 
2137
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2138
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2139
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2140
    token_second = Token(re.compile(r"(\d+)S"),
 
2141
                         datetime.timedelta(seconds=1),
 
2142
                         frozenset((token_end,)))
 
2143
    token_minute = Token(re.compile(r"(\d+)M"),
 
2144
                         datetime.timedelta(minutes=1),
 
2145
                         frozenset((token_second, token_end)))
 
2146
    token_hour = Token(re.compile(r"(\d+)H"),
 
2147
                       datetime.timedelta(hours=1),
 
2148
                       frozenset((token_minute, token_end)))
 
2149
    token_time = Token(re.compile(r"T"),
 
2150
                       None,
 
2151
                       frozenset((token_hour, token_minute,
 
2152
                                  token_second)))
 
2153
    token_day = Token(re.compile(r"(\d+)D"),
 
2154
                      datetime.timedelta(days=1),
 
2155
                      frozenset((token_time, token_end)))
 
2156
    token_month = Token(re.compile(r"(\d+)M"),
 
2157
                        datetime.timedelta(weeks=4),
 
2158
                        frozenset((token_day, token_end)))
 
2159
    token_year = Token(re.compile(r"(\d+)Y"),
 
2160
                       datetime.timedelta(weeks=52),
 
2161
                       frozenset((token_month, token_end)))
 
2162
    token_week = Token(re.compile(r"(\d+)W"),
 
2163
                       datetime.timedelta(weeks=1),
 
2164
                       frozenset((token_end,)))
 
2165
    token_duration = Token(re.compile(r"P"), None,
 
2166
                           frozenset((token_year, token_month,
 
2167
                                      token_day, token_time,
 
2168
                                      token_week)))
 
2169
    # Define starting values
 
2170
    value = datetime.timedelta() # Value so far
 
2171
    found_token = None
 
2172
    followers = frozenset((token_duration,)) # Following valid tokens
 
2173
    s = duration                # String left to parse
 
2174
    # Loop until end token is found
 
2175
    while found_token is not token_end:
 
2176
        # Search for any currently valid tokens
 
2177
        for token in followers:
 
2178
            match = token.regexp.match(s)
 
2179
            if match is not None:
 
2180
                # Token found
 
2181
                if token.value is not None:
 
2182
                    # Value found, parse digits
 
2183
                    factor = int(match.group(1), 10)
 
2184
                    # Add to value so far
 
2185
                    value += factor * token.value
 
2186
                # Strip token from string
 
2187
                s = token.regexp.sub("", s, 1)
 
2188
                # Go to found token
 
2189
                found_token = token
 
2190
                # Set valid next tokens
 
2191
                followers = found_token.followers
 
2192
                break
 
2193
        else:
 
2194
            # No currently valid tokens were found
 
2195
            raise ValueError("Invalid RFC 3339 duration")
 
2196
    # End token found
 
2197
    return value
 
2198
 
 
2199
 
1599
2200
def string_to_delta(interval):
1600
2201
    """Parse a string and return a datetime.timedelta
1601
2202
    
1612
2213
    >>> string_to_delta('5m 30s')
1613
2214
    datetime.timedelta(0, 330)
1614
2215
    """
 
2216
    
 
2217
    try:
 
2218
        return rfc3339_duration_to_delta(interval)
 
2219
    except ValueError:
 
2220
        pass
 
2221
    
1615
2222
    timevalue = datetime.timedelta(0)
1616
2223
    for s in interval.split():
1617
2224
        try:
1618
 
            suffix = unicode(s[-1])
 
2225
            suffix = s[-1]
1619
2226
            value = int(s[:-1])
1620
2227
            if suffix == "d":
1621
2228
                delta = datetime.timedelta(value)
1628
2235
            elif suffix == "w":
1629
2236
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1630
2237
            else:
1631
 
                raise ValueError("Unknown suffix %r" % suffix)
1632
 
        except (ValueError, IndexError) as e:
 
2238
                raise ValueError("Unknown suffix {!r}"
 
2239
                                 .format(suffix))
 
2240
        except IndexError as e:
1633
2241
            raise ValueError(*(e.args))
1634
2242
        timevalue += delta
1635
2243
    return timevalue
1636
2244
 
1637
2245
 
1638
 
def if_nametoindex(interface):
1639
 
    """Call the C function if_nametoindex(), or equivalent
1640
 
    
1641
 
    Note: This function cannot accept a unicode string."""
1642
 
    global if_nametoindex
1643
 
    try:
1644
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1645
 
                          (ctypes.util.find_library("c"))
1646
 
                          .if_nametoindex)
1647
 
    except (OSError, AttributeError):
1648
 
        logger.warning("Doing if_nametoindex the hard way")
1649
 
        def if_nametoindex(interface):
1650
 
            "Get an interface index the hard way, i.e. using fcntl()"
1651
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1652
 
            with contextlib.closing(socket.socket()) as s:
1653
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1654
 
                                    struct.pack(str("16s16x"),
1655
 
                                                interface))
1656
 
            interface_index = struct.unpack(str("I"),
1657
 
                                            ifreq[16:20])[0]
1658
 
            return interface_index
1659
 
    return if_nametoindex(interface)
1660
 
 
1661
 
 
1662
2246
def daemon(nochdir = False, noclose = False):
1663
2247
    """See daemon(3).  Standard BSD Unix function.
1664
2248
    
1672
2256
        sys.exit()
1673
2257
    if not noclose:
1674
2258
        # Close all standard open file descriptors
1675
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2259
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1676
2260
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1677
 
            raise OSError(errno.ENODEV,
1678
 
                          "%s not a character device"
1679
 
                          % os.path.devnull)
 
2261
            raise OSError(errno.ENODEV, "{} not a character device"
 
2262
                          .format(os.devnull))
1680
2263
        os.dup2(null, sys.stdin.fileno())
1681
2264
        os.dup2(null, sys.stdout.fileno())
1682
2265
        os.dup2(null, sys.stderr.fileno())
1691
2274
    
1692
2275
    parser = argparse.ArgumentParser()
1693
2276
    parser.add_argument("-v", "--version", action="version",
1694
 
                        version = "%%(prog)s %s" % version,
 
2277
                        version = "%(prog)s {}".format(version),
1695
2278
                        help="show version number and exit")
1696
2279
    parser.add_argument("-i", "--interface", metavar="IF",
1697
2280
                        help="Bind to interface IF")
1703
2286
                        help="Run self-test")
1704
2287
    parser.add_argument("--debug", action="store_true",
1705
2288
                        help="Debug mode; run in foreground and log"
1706
 
                        " to terminal")
 
2289
                        " to terminal", default=None)
1707
2290
    parser.add_argument("--debuglevel", metavar="LEVEL",
1708
2291
                        help="Debug level for stdout output")
1709
2292
    parser.add_argument("--priority", help="GnuTLS"
1716
2299
                        " files")
1717
2300
    parser.add_argument("--no-dbus", action="store_false",
1718
2301
                        dest="use_dbus", help="Do not provide D-Bus"
1719
 
                        " system bus interface")
 
2302
                        " system bus interface", default=None)
1720
2303
    parser.add_argument("--no-ipv6", action="store_false",
1721
 
                        dest="use_ipv6", help="Do not use IPv6")
 
2304
                        dest="use_ipv6", help="Do not use IPv6",
 
2305
                        default=None)
 
2306
    parser.add_argument("--no-restore", action="store_false",
 
2307
                        dest="restore", help="Do not restore stored"
 
2308
                        " state", default=None)
 
2309
    parser.add_argument("--socket", type=int,
 
2310
                        help="Specify a file descriptor to a network"
 
2311
                        " socket to use instead of creating one")
 
2312
    parser.add_argument("--statedir", metavar="DIR",
 
2313
                        help="Directory to save/restore state in")
 
2314
    parser.add_argument("--foreground", action="store_true",
 
2315
                        help="Run in foreground", default=None)
 
2316
    parser.add_argument("--no-zeroconf", action="store_false",
 
2317
                        dest="zeroconf", help="Do not use Zeroconf",
 
2318
                        default=None)
 
2319
    
1722
2320
    options = parser.parse_args()
1723
2321
    
1724
2322
    if options.check:
1725
2323
        import doctest
1726
 
        doctest.testmod()
1727
 
        sys.exit()
 
2324
        fail_count, test_count = doctest.testmod()
 
2325
        sys.exit(os.EX_OK if fail_count == 0 else 1)
1728
2326
    
1729
2327
    # Default values for config file for server-global settings
1730
2328
    server_defaults = { "interface": "",
1732
2330
                        "port": "",
1733
2331
                        "debug": "False",
1734
2332
                        "priority":
1735
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2333
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
1736
2334
                        "servicename": "Mandos",
1737
2335
                        "use_dbus": "True",
1738
2336
                        "use_ipv6": "True",
1739
2337
                        "debuglevel": "",
 
2338
                        "restore": "True",
 
2339
                        "socket": "",
 
2340
                        "statedir": "/var/lib/mandos",
 
2341
                        "foreground": "False",
 
2342
                        "zeroconf": "True",
1740
2343
                        }
1741
2344
    
1742
2345
    # Parse config file for server-global settings
1747
2350
    # Convert the SafeConfigParser object to a dict
1748
2351
    server_settings = server_config.defaults()
1749
2352
    # Use the appropriate methods on the non-string config options
1750
 
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2353
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1751
2354
        server_settings[option] = server_config.getboolean("DEFAULT",
1752
2355
                                                           option)
1753
2356
    if server_settings["port"]:
1754
2357
        server_settings["port"] = server_config.getint("DEFAULT",
1755
2358
                                                       "port")
 
2359
    if server_settings["socket"]:
 
2360
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2361
                                                         "socket")
 
2362
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2363
        # over with an opened os.devnull.  But we don't want this to
 
2364
        # happen with a supplied network socket.
 
2365
        if 0 <= server_settings["socket"] <= 2:
 
2366
            server_settings["socket"] = os.dup(server_settings
 
2367
                                               ["socket"])
1756
2368
    del server_config
1757
2369
    
1758
2370
    # Override the settings from the config file with command line
1759
2371
    # options, if set.
1760
2372
    for option in ("interface", "address", "port", "debug",
1761
2373
                   "priority", "servicename", "configdir",
1762
 
                   "use_dbus", "use_ipv6", "debuglevel"):
 
2374
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2375
                   "statedir", "socket", "foreground", "zeroconf"):
1763
2376
        value = getattr(options, option)
1764
2377
        if value is not None:
1765
2378
            server_settings[option] = value
1766
2379
    del options
1767
2380
    # Force all strings to be unicode
1768
2381
    for option in server_settings.keys():
1769
 
        if type(server_settings[option]) is str:
1770
 
            server_settings[option] = unicode(server_settings[option])
 
2382
        if isinstance(server_settings[option], bytes):
 
2383
            server_settings[option] = (server_settings[option]
 
2384
                                       .decode("utf-8"))
 
2385
    # Force all boolean options to be boolean
 
2386
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2387
                   "foreground", "zeroconf"):
 
2388
        server_settings[option] = bool(server_settings[option])
 
2389
    # Debug implies foreground
 
2390
    if server_settings["debug"]:
 
2391
        server_settings["foreground"] = True
1771
2392
    # Now we have our good server settings in "server_settings"
1772
2393
    
1773
2394
    ##################################################################
1774
2395
    
 
2396
    if (not server_settings["zeroconf"] and
 
2397
        not (server_settings["port"]
 
2398
             or server_settings["socket"] != "")):
 
2399
            parser.error("Needs port or socket to work without"
 
2400
                         " Zeroconf")
 
2401
    
1775
2402
    # For convenience
1776
2403
    debug = server_settings["debug"]
1777
2404
    debuglevel = server_settings["debuglevel"]
1778
2405
    use_dbus = server_settings["use_dbus"]
1779
2406
    use_ipv6 = server_settings["use_ipv6"]
 
2407
    stored_state_path = os.path.join(server_settings["statedir"],
 
2408
                                     stored_state_file)
 
2409
    foreground = server_settings["foreground"]
 
2410
    zeroconf = server_settings["zeroconf"]
 
2411
    
 
2412
    if debug:
 
2413
        initlogger(debug, logging.DEBUG)
 
2414
    else:
 
2415
        if not debuglevel:
 
2416
            initlogger(debug)
 
2417
        else:
 
2418
            level = getattr(logging, debuglevel.upper())
 
2419
            initlogger(debug, level)
1780
2420
    
1781
2421
    if server_settings["servicename"] != "Mandos":
1782
2422
        syslogger.setFormatter(logging.Formatter
1783
 
                               ('Mandos (%s) [%%(process)d]:'
1784
 
                                ' %%(levelname)s: %%(message)s'
1785
 
                                % server_settings["servicename"]))
 
2423
                               ('Mandos ({}) [%(process)d]:'
 
2424
                                ' %(levelname)s: %(message)s'
 
2425
                                .format(server_settings
 
2426
                                        ["servicename"])))
1786
2427
    
1787
2428
    # Parse config file with clients
1788
 
    client_defaults = { "timeout": "5m",
1789
 
                        "extended_timeout": "15m",
1790
 
                        "interval": "2m",
1791
 
                        "checker": "fping -q -- %%(host)s",
1792
 
                        "host": "",
1793
 
                        "approval_delay": "0s",
1794
 
                        "approval_duration": "1s",
1795
 
                        }
1796
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2429
    client_config = configparser.SafeConfigParser(Client
 
2430
                                                  .client_defaults)
1797
2431
    client_config.read(os.path.join(server_settings["configdir"],
1798
2432
                                    "clients.conf"))
1799
2433
    
1800
2434
    global mandos_dbus_service
1801
2435
    mandos_dbus_service = None
1802
2436
    
 
2437
    socketfd = None
 
2438
    if server_settings["socket"] != "":
 
2439
        socketfd = server_settings["socket"]
1803
2440
    tcp_server = MandosServer((server_settings["address"],
1804
2441
                               server_settings["port"]),
1805
2442
                              ClientHandler,
1808
2445
                              use_ipv6=use_ipv6,
1809
2446
                              gnutls_priority=
1810
2447
                              server_settings["priority"],
1811
 
                              use_dbus=use_dbus)
1812
 
    if not debug:
1813
 
        pidfilename = "/var/run/mandos.pid"
 
2448
                              use_dbus=use_dbus,
 
2449
                              socketfd=socketfd)
 
2450
    if not foreground:
 
2451
        pidfilename = "/run/mandos.pid"
 
2452
        if not os.path.isdir("/run/."):
 
2453
            pidfilename = "/var/run/mandos.pid"
 
2454
        pidfile = None
1814
2455
        try:
1815
2456
            pidfile = open(pidfilename, "w")
1816
 
        except IOError:
1817
 
            logger.error("Could not open file %r", pidfilename)
 
2457
        except IOError as e:
 
2458
            logger.error("Could not open file %r", pidfilename,
 
2459
                         exc_info=e)
1818
2460
    
1819
 
    try:
1820
 
        uid = pwd.getpwnam("_mandos").pw_uid
1821
 
        gid = pwd.getpwnam("_mandos").pw_gid
1822
 
    except KeyError:
 
2461
    for name in ("_mandos", "mandos", "nobody"):
1823
2462
        try:
1824
 
            uid = pwd.getpwnam("mandos").pw_uid
1825
 
            gid = pwd.getpwnam("mandos").pw_gid
 
2463
            uid = pwd.getpwnam(name).pw_uid
 
2464
            gid = pwd.getpwnam(name).pw_gid
 
2465
            break
1826
2466
        except KeyError:
1827
 
            try:
1828
 
                uid = pwd.getpwnam("nobody").pw_uid
1829
 
                gid = pwd.getpwnam("nobody").pw_gid
1830
 
            except KeyError:
1831
 
                uid = 65534
1832
 
                gid = 65534
 
2467
            continue
 
2468
    else:
 
2469
        uid = 65534
 
2470
        gid = 65534
1833
2471
    try:
1834
2472
        os.setgid(gid)
1835
2473
        os.setuid(uid)
1836
2474
    except OSError as error:
1837
 
        if error[0] != errno.EPERM:
1838
 
            raise error
1839
 
    
1840
 
    if not debug and not debuglevel:
1841
 
        syslogger.setLevel(logging.WARNING)
1842
 
        console.setLevel(logging.WARNING)
1843
 
    if debuglevel:
1844
 
        level = getattr(logging, debuglevel.upper())
1845
 
        syslogger.setLevel(level)
1846
 
        console.setLevel(level)
 
2475
        if error.errno != errno.EPERM:
 
2476
            raise
1847
2477
    
1848
2478
    if debug:
1849
2479
        # Enable all possible GnuTLS debugging
1860
2490
         .gnutls_global_set_log_function(debug_gnutls))
1861
2491
        
1862
2492
        # Redirect stdin so all checkers get /dev/null
1863
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2493
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1864
2494
        os.dup2(null, sys.stdin.fileno())
1865
2495
        if null > 2:
1866
2496
            os.close(null)
1867
 
    else:
1868
 
        # No console logging
1869
 
        logger.removeHandler(console)
1870
2497
    
1871
2498
    # Need to fork before connecting to D-Bus
1872
 
    if not debug:
 
2499
    if not foreground:
1873
2500
        # Close all input and output, do double fork, etc.
1874
2501
        daemon()
1875
2502
    
 
2503
    # multiprocessing will use threads, so before we use gobject we
 
2504
    # need to inform gobject that threads will be used.
 
2505
    gobject.threads_init()
 
2506
    
1876
2507
    global main_loop
1877
2508
    # From the Avahi example code
1878
 
    DBusGMainLoop(set_as_default=True )
 
2509
    DBusGMainLoop(set_as_default=True)
1879
2510
    main_loop = gobject.MainLoop()
1880
2511
    bus = dbus.SystemBus()
1881
2512
    # End of Avahi example code
1882
2513
    if use_dbus:
1883
2514
        try:
1884
 
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
 
2515
            bus_name = dbus.service.BusName("se.recompile.Mandos",
1885
2516
                                            bus, do_not_queue=True)
 
2517
            old_bus_name = (dbus.service.BusName
 
2518
                            ("se.bsnet.fukt.Mandos", bus,
 
2519
                             do_not_queue=True))
1886
2520
        except dbus.exceptions.NameExistsException as e:
1887
 
            logger.error(unicode(e) + ", disabling D-Bus")
 
2521
            logger.error("Disabling D-Bus:", exc_info=e)
1888
2522
            use_dbus = False
1889
2523
            server_settings["use_dbus"] = False
1890
2524
            tcp_server.use_dbus = False
1891
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1892
 
    service = AvahiService(name = server_settings["servicename"],
1893
 
                           servicetype = "_mandos._tcp",
1894
 
                           protocol = protocol, bus = bus)
1895
 
    if server_settings["interface"]:
1896
 
        service.interface = (if_nametoindex
1897
 
                             (str(server_settings["interface"])))
 
2525
    if zeroconf:
 
2526
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2527
        service = AvahiServiceToSyslog(name =
 
2528
                                       server_settings["servicename"],
 
2529
                                       servicetype = "_mandos._tcp",
 
2530
                                       protocol = protocol, bus = bus)
 
2531
        if server_settings["interface"]:
 
2532
            service.interface = (if_nametoindex
 
2533
                                 (server_settings["interface"]
 
2534
                                  .encode("utf-8")))
1898
2535
    
1899
2536
    global multiprocessing_manager
1900
2537
    multiprocessing_manager = multiprocessing.Manager()
1902
2539
    client_class = Client
1903
2540
    if use_dbus:
1904
2541
        client_class = functools.partial(ClientDBus, bus = bus)
1905
 
    def client_config_items(config, section):
1906
 
        special_settings = {
1907
 
            "approved_by_default":
1908
 
                lambda: config.getboolean(section,
1909
 
                                          "approved_by_default"),
1910
 
            }
1911
 
        for name, value in config.items(section):
 
2542
    
 
2543
    client_settings = Client.config_parser(client_config)
 
2544
    old_client_settings = {}
 
2545
    clients_data = {}
 
2546
    
 
2547
    # This is used to redirect stdout and stderr for checker processes
 
2548
    global wnull
 
2549
    wnull = open(os.devnull, "w") # A writable /dev/null
 
2550
    # Only used if server is running in foreground but not in debug
 
2551
    # mode
 
2552
    if debug or not foreground:
 
2553
        wnull.close()
 
2554
    
 
2555
    # Get client data and settings from last running state.
 
2556
    if server_settings["restore"]:
 
2557
        try:
 
2558
            with open(stored_state_path, "rb") as stored_state:
 
2559
                clients_data, old_client_settings = (pickle.load
 
2560
                                                     (stored_state))
 
2561
            os.remove(stored_state_path)
 
2562
        except IOError as e:
 
2563
            if e.errno == errno.ENOENT:
 
2564
                logger.warning("Could not load persistent state: {}"
 
2565
                                .format(os.strerror(e.errno)))
 
2566
            else:
 
2567
                logger.critical("Could not load persistent state:",
 
2568
                                exc_info=e)
 
2569
                raise
 
2570
        except EOFError as e:
 
2571
            logger.warning("Could not load persistent state: "
 
2572
                           "EOFError:", exc_info=e)
 
2573
    
 
2574
    with PGPEngine() as pgp:
 
2575
        for client_name, client in clients_data.items():
 
2576
            # Skip removed clients
 
2577
            if client_name not in client_settings:
 
2578
                continue
 
2579
            
 
2580
            # Decide which value to use after restoring saved state.
 
2581
            # We have three different values: Old config file,
 
2582
            # new config file, and saved state.
 
2583
            # New config value takes precedence if it differs from old
 
2584
            # config value, otherwise use saved state.
 
2585
            for name, value in client_settings[client_name].items():
 
2586
                try:
 
2587
                    # For each value in new config, check if it
 
2588
                    # differs from the old config value (Except for
 
2589
                    # the "secret" attribute)
 
2590
                    if (name != "secret" and
 
2591
                        value != old_client_settings[client_name]
 
2592
                        [name]):
 
2593
                        client[name] = value
 
2594
                except KeyError:
 
2595
                    pass
 
2596
            
 
2597
            # Clients who has passed its expire date can still be
 
2598
            # enabled if its last checker was successful.  Clients
 
2599
            # whose checker succeeded before we stored its state is
 
2600
            # assumed to have successfully run all checkers during
 
2601
            # downtime.
 
2602
            if client["enabled"]:
 
2603
                if datetime.datetime.utcnow() >= client["expires"]:
 
2604
                    if not client["last_checked_ok"]:
 
2605
                        logger.warning(
 
2606
                            "disabling client {} - Client never "
 
2607
                            "performed a successful checker"
 
2608
                            .format(client_name))
 
2609
                        client["enabled"] = False
 
2610
                    elif client["last_checker_status"] != 0:
 
2611
                        logger.warning(
 
2612
                            "disabling client {} - Client last"
 
2613
                            " checker failed with error code {}"
 
2614
                            .format(client_name,
 
2615
                                    client["last_checker_status"]))
 
2616
                        client["enabled"] = False
 
2617
                    else:
 
2618
                        client["expires"] = (datetime.datetime
 
2619
                                             .utcnow()
 
2620
                                             + client["timeout"])
 
2621
                        logger.debug("Last checker succeeded,"
 
2622
                                     " keeping {} enabled"
 
2623
                                     .format(client_name))
1912
2624
            try:
1913
 
                yield (name, special_settings[name]())
1914
 
            except KeyError:
1915
 
                yield (name, value)
1916
 
    
1917
 
    tcp_server.clients.update(set(
1918
 
            client_class(name = section,
1919
 
                         config= dict(client_config_items(
1920
 
                        client_config, section)))
1921
 
            for section in client_config.sections()))
 
2625
                client["secret"] = (
 
2626
                    pgp.decrypt(client["encrypted_secret"],
 
2627
                                client_settings[client_name]
 
2628
                                ["secret"]))
 
2629
            except PGPError:
 
2630
                # If decryption fails, we use secret from new settings
 
2631
                logger.debug("Failed to decrypt {} old secret"
 
2632
                             .format(client_name))
 
2633
                client["secret"] = (
 
2634
                    client_settings[client_name]["secret"])
 
2635
    
 
2636
    # Add/remove clients based on new changes made to config
 
2637
    for client_name in (set(old_client_settings)
 
2638
                        - set(client_settings)):
 
2639
        del clients_data[client_name]
 
2640
    for client_name in (set(client_settings)
 
2641
                        - set(old_client_settings)):
 
2642
        clients_data[client_name] = client_settings[client_name]
 
2643
    
 
2644
    # Create all client objects
 
2645
    for client_name, client in clients_data.items():
 
2646
        tcp_server.clients[client_name] = client_class(
 
2647
            name = client_name, settings = client,
 
2648
            server_settings = server_settings)
 
2649
    
1922
2650
    if not tcp_server.clients:
1923
2651
        logger.warning("No clients defined")
1924
 
        
1925
 
    if not debug:
1926
 
        try:
1927
 
            with pidfile:
1928
 
                pid = os.getpid()
1929
 
                pidfile.write(str(pid) + "\n".encode("utf-8"))
1930
 
            del pidfile
1931
 
        except IOError:
1932
 
            logger.error("Could not write to file %r with PID %d",
1933
 
                         pidfilename, pid)
1934
 
        except NameError:
1935
 
            # "pidfile" was never created
1936
 
            pass
 
2652
    
 
2653
    if not foreground:
 
2654
        if pidfile is not None:
 
2655
            try:
 
2656
                with pidfile:
 
2657
                    pid = os.getpid()
 
2658
                    pidfile.write("{}\n".format(pid).encode("utf-8"))
 
2659
            except IOError:
 
2660
                logger.error("Could not write to file %r with PID %d",
 
2661
                             pidfilename, pid)
 
2662
        del pidfile
1937
2663
        del pidfilename
1938
 
        
1939
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1940
2664
    
1941
2665
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1942
2666
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1943
2667
    
1944
2668
    if use_dbus:
1945
 
        class MandosDBusService(dbus.service.Object):
 
2669
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2670
                                        "se.bsnet.fukt.Mandos"})
 
2671
        class MandosDBusService(DBusObjectWithProperties):
1946
2672
            """A D-Bus proxy object"""
1947
2673
            def __init__(self):
1948
2674
                dbus.service.Object.__init__(self, bus, "/")
1949
 
            _interface = "se.bsnet.fukt.Mandos"
 
2675
            _interface = "se.recompile.Mandos"
 
2676
            
 
2677
            @dbus_interface_annotations(_interface)
 
2678
            def _foo(self):
 
2679
                return { "org.freedesktop.DBus.Property"
 
2680
                         ".EmitsChangedSignal":
 
2681
                             "false"}
1950
2682
            
1951
2683
            @dbus.service.signal(_interface, signature="o")
1952
2684
            def ClientAdded(self, objpath):
1967
2699
            def GetAllClients(self):
1968
2700
                "D-Bus method"
1969
2701
                return dbus.Array(c.dbus_object_path
1970
 
                                  for c in tcp_server.clients)
 
2702
                                  for c in
 
2703
                                  tcp_server.clients.itervalues())
1971
2704
            
1972
2705
            @dbus.service.method(_interface,
1973
2706
                                 out_signature="a{oa{sv}}")
1975
2708
                "D-Bus method"
1976
2709
                return dbus.Dictionary(
1977
2710
                    ((c.dbus_object_path, c.GetAll(""))
1978
 
                     for c in tcp_server.clients),
 
2711
                     for c in tcp_server.clients.itervalues()),
1979
2712
                    signature="oa{sv}")
1980
2713
            
1981
2714
            @dbus.service.method(_interface, in_signature="o")
1982
2715
            def RemoveClient(self, object_path):
1983
2716
                "D-Bus method"
1984
 
                for c in tcp_server.clients:
 
2717
                for c in tcp_server.clients.itervalues():
1985
2718
                    if c.dbus_object_path == object_path:
1986
 
                        tcp_server.clients.remove(c)
 
2719
                        del tcp_server.clients[c.name]
1987
2720
                        c.remove_from_connection()
1988
2721
                        # Don't signal anything except ClientRemoved
1989
2722
                        c.disable(quiet=True)
1998
2731
    
1999
2732
    def cleanup():
2000
2733
        "Cleanup function; run on exit"
2001
 
        service.cleanup()
2002
 
        
 
2734
        if zeroconf:
 
2735
            service.cleanup()
 
2736
        
 
2737
        multiprocessing.active_children()
 
2738
        wnull.close()
 
2739
        if not (tcp_server.clients or client_settings):
 
2740
            return
 
2741
        
 
2742
        # Store client before exiting. Secrets are encrypted with key
 
2743
        # based on what config file has. If config file is
 
2744
        # removed/edited, old secret will thus be unrecovable.
 
2745
        clients = {}
 
2746
        with PGPEngine() as pgp:
 
2747
            for client in tcp_server.clients.itervalues():
 
2748
                key = client_settings[client.name]["secret"]
 
2749
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2750
                                                      key)
 
2751
                client_dict = {}
 
2752
                
 
2753
                # A list of attributes that can not be pickled
 
2754
                # + secret.
 
2755
                exclude = { "bus", "changedstate", "secret",
 
2756
                            "checker", "server_settings" }
 
2757
                for name, typ in (inspect.getmembers
 
2758
                                  (dbus.service.Object)):
 
2759
                    exclude.add(name)
 
2760
                
 
2761
                client_dict["encrypted_secret"] = (client
 
2762
                                                   .encrypted_secret)
 
2763
                for attr in client.client_structure:
 
2764
                    if attr not in exclude:
 
2765
                        client_dict[attr] = getattr(client, attr)
 
2766
                
 
2767
                clients[client.name] = client_dict
 
2768
                del client_settings[client.name]["secret"]
 
2769
        
 
2770
        try:
 
2771
            with (tempfile.NamedTemporaryFile
 
2772
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2773
                   dir=os.path.dirname(stored_state_path),
 
2774
                   delete=False)) as stored_state:
 
2775
                pickle.dump((clients, client_settings), stored_state)
 
2776
                tempname=stored_state.name
 
2777
            os.rename(tempname, stored_state_path)
 
2778
        except (IOError, OSError) as e:
 
2779
            if not debug:
 
2780
                try:
 
2781
                    os.remove(tempname)
 
2782
                except NameError:
 
2783
                    pass
 
2784
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2785
                logger.warning("Could not save persistent state: {}"
 
2786
                               .format(os.strerror(e.errno)))
 
2787
            else:
 
2788
                logger.warning("Could not save persistent state:",
 
2789
                               exc_info=e)
 
2790
                raise
 
2791
        
 
2792
        # Delete all clients, and settings from config
2003
2793
        while tcp_server.clients:
2004
 
            client = tcp_server.clients.pop()
 
2794
            name, client = tcp_server.clients.popitem()
2005
2795
            if use_dbus:
2006
2796
                client.remove_from_connection()
2007
 
            client.disable_hook = None
2008
2797
            # Don't signal anything except ClientRemoved
2009
2798
            client.disable(quiet=True)
2010
2799
            if use_dbus:
2011
2800
                # Emit D-Bus signal
2012
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
2801
                mandos_dbus_service.ClientRemoved(client
 
2802
                                                  .dbus_object_path,
2013
2803
                                                  client.name)
 
2804
        client_settings.clear()
2014
2805
    
2015
2806
    atexit.register(cleanup)
2016
2807
    
2017
 
    for client in tcp_server.clients:
 
2808
    for client in tcp_server.clients.itervalues():
2018
2809
        if use_dbus:
2019
2810
            # Emit D-Bus signal
2020
2811
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2021
 
        client.enable()
 
2812
        # Need to initiate checking of clients
 
2813
        if client.enabled:
 
2814
            client.init_checker()
2022
2815
    
2023
2816
    tcp_server.enable()
2024
2817
    tcp_server.server_activate()
2025
2818
    
2026
2819
    # Find out what port we got
2027
 
    service.port = tcp_server.socket.getsockname()[1]
 
2820
    if zeroconf:
 
2821
        service.port = tcp_server.socket.getsockname()[1]
2028
2822
    if use_ipv6:
2029
2823
        logger.info("Now listening on address %r, port %d,"
2030
 
                    " flowinfo %d, scope_id %d"
2031
 
                    % tcp_server.socket.getsockname())
 
2824
                    " flowinfo %d, scope_id %d",
 
2825
                    *tcp_server.socket.getsockname())
2032
2826
    else:                       # IPv4
2033
 
        logger.info("Now listening on address %r, port %d"
2034
 
                    % tcp_server.socket.getsockname())
 
2827
        logger.info("Now listening on address %r, port %d",
 
2828
                    *tcp_server.socket.getsockname())
2035
2829
    
2036
2830
    #service.interface = tcp_server.socket.getsockname()[3]
2037
2831
    
2038
2832
    try:
2039
 
        # From the Avahi example code
2040
 
        try:
2041
 
            service.activate()
2042
 
        except dbus.exceptions.DBusException as error:
2043
 
            logger.critical("DBusException: %s", error)
2044
 
            cleanup()
2045
 
            sys.exit(1)
2046
 
        # End of Avahi example code
 
2833
        if zeroconf:
 
2834
            # From the Avahi example code
 
2835
            try:
 
2836
                service.activate()
 
2837
            except dbus.exceptions.DBusException as error:
 
2838
                logger.critical("D-Bus Exception", exc_info=error)
 
2839
                cleanup()
 
2840
                sys.exit(1)
 
2841
            # End of Avahi example code
2047
2842
        
2048
2843
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2049
2844
                             lambda *args, **kwargs:
2053
2848
        logger.debug("Starting main loop")
2054
2849
        main_loop.run()
2055
2850
    except AvahiError as error:
2056
 
        logger.critical("AvahiError: %s", error)
 
2851
        logger.critical("Avahi Error", exc_info=error)
2057
2852
        cleanup()
2058
2853
        sys.exit(1)
2059
2854
    except KeyboardInterrupt:
2064
2859
    # Must run before the D-Bus bus name gets deregistered
2065
2860
    cleanup()
2066
2861
 
2067
 
 
2068
2862
if __name__ == '__main__':
2069
2863
    main()