/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2014-08-09 13:12:55 UTC
  • Revision ID: teddy@recompile.se-20140809131255-lp31j98u2pl0xpe6
mandos: Stop using str() and remove unnecessary unicode() calls.

* mandos (if_nametoindex): Use "bytes" literal instead of str().
  (initlogger): Use a unicode string for log device.
  (AvahiError.__unicode__): Removed.
  (DBusPropertyException.__unicode__): - '' -
  (ClientDBus.Secret_dbus_property): Use bytes() instead of str().
  (IPv6_TCPServer.server_bind): Use .encode() instead of str().
  (string_to_delta): Removed unnecessary unicode() call.
  (main): Use "isinstance(x, bytes)" instead of "type(x) is str", use
          .decode() instead of unicode(), and use .encode() instead of
          str().

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2015 Teddy Hogeborn
15
 
# Copyright © 2008-2015 Björn Påhlsson
 
14
# Copyright © 2008-2014 Teddy Hogeborn
 
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
 
37
37
from future_builtins import *
38
38
 
39
 
try:
40
 
    import SocketServer as socketserver
41
 
except ImportError:
42
 
    import socketserver
 
39
import SocketServer as socketserver
43
40
import socket
44
41
import argparse
45
42
import datetime
50
47
import gnutls.library.functions
51
48
import gnutls.library.constants
52
49
import gnutls.library.types
53
 
try:
54
 
    import ConfigParser as configparser
55
 
except ImportError:
56
 
    import configparser
 
50
import ConfigParser as configparser
57
51
import sys
58
52
import re
59
53
import os
68
62
import struct
69
63
import fcntl
70
64
import functools
71
 
try:
72
 
    import cPickle as pickle
73
 
except ImportError:
74
 
    import pickle
 
65
import cPickle as pickle
75
66
import multiprocessing
76
67
import types
77
68
import binascii
78
69
import tempfile
79
70
import itertools
80
71
import collections
81
 
import codecs
82
72
 
83
73
import dbus
84
74
import dbus.service
85
 
try:
86
 
    import gobject
87
 
except ImportError:
88
 
    from gi.repository import GObject as gobject
 
75
import gobject
89
76
import avahi
90
77
from dbus.mainloop.glib import DBusGMainLoop
91
78
import ctypes
101
88
    except ImportError:
102
89
        SO_BINDTODEVICE = None
103
90
 
104
 
if sys.version_info.major == 2:
105
 
    str = unicode
106
 
 
107
 
version = "1.6.9"
 
91
version = "1.6.8"
108
92
stored_state_file = "clients.pickle"
109
93
 
110
94
logger = logging.getLogger()
111
95
syslogger = None
112
96
 
113
97
try:
114
 
    if_nametoindex = ctypes.cdll.LoadLibrary(
115
 
        ctypes.util.find_library("c")).if_nametoindex
 
98
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
99
                      (ctypes.util.find_library("c"))
 
100
                      .if_nametoindex)
116
101
except (OSError, AttributeError):
117
 
    
118
102
    def if_nametoindex(interface):
119
103
        "Get an interface index the hard way, i.e. using fcntl()"
120
104
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
129
113
    """init logger and add loglevel"""
130
114
    
131
115
    global syslogger
132
 
    syslogger = (logging.handlers.SysLogHandler(
133
 
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
 
        address = "/dev/log"))
 
116
    syslogger = (logging.handlers.SysLogHandler
 
117
                 (facility =
 
118
                  logging.handlers.SysLogHandler.LOG_DAEMON,
 
119
                  address = "/dev/log"))
135
120
    syslogger.setFormatter(logging.Formatter
136
121
                           ('Mandos [%(process)d]: %(levelname)s:'
137
122
                            ' %(message)s'))
154
139
 
155
140
class PGPEngine(object):
156
141
    """A simple class for OpenPGP symmetric encryption & decryption"""
157
 
    
158
142
    def __init__(self):
159
143
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
144
        self.gnupgargs = ['--batch',
199
183
    
200
184
    def encrypt(self, data, password):
201
185
        passphrase = self.password_encode(password)
202
 
        with tempfile.NamedTemporaryFile(
203
 
                dir=self.tempdir) as passfile:
 
186
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
187
                                         ) as passfile:
204
188
            passfile.write(passphrase)
205
189
            passfile.flush()
206
190
            proc = subprocess.Popen(['gpg', '--symmetric',
217
201
    
218
202
    def decrypt(self, data, password):
219
203
        passphrase = self.password_encode(password)
220
 
        with tempfile.NamedTemporaryFile(
221
 
                dir = self.tempdir) as passfile:
 
204
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
205
                                         ) as passfile:
222
206
            passfile.write(passphrase)
223
207
            passfile.flush()
224
208
            proc = subprocess.Popen(['gpg', '--decrypt',
228
212
                                    stdin = subprocess.PIPE,
229
213
                                    stdout = subprocess.PIPE,
230
214
                                    stderr = subprocess.PIPE)
231
 
            decrypted_plaintext, err = proc.communicate(input = data)
 
215
            decrypted_plaintext, err = proc.communicate(input
 
216
                                                        = data)
232
217
        if proc.returncode != 0:
233
218
            raise PGPError(err)
234
219
        return decrypted_plaintext
240
225
        return super(AvahiError, self).__init__(value, *args,
241
226
                                                **kwargs)
242
227
 
243
 
 
244
228
class AvahiServiceError(AvahiError):
245
229
    pass
246
230
 
247
 
 
248
231
class AvahiGroupError(AvahiError):
249
232
    pass
250
233
 
270
253
    bus: dbus.SystemBus()
271
254
    """
272
255
    
273
 
    def __init__(self,
274
 
                 interface = avahi.IF_UNSPEC,
275
 
                 name = None,
276
 
                 servicetype = None,
277
 
                 port = None,
278
 
                 TXT = None,
279
 
                 domain = "",
280
 
                 host = "",
281
 
                 max_renames = 32768,
282
 
                 protocol = avahi.PROTO_UNSPEC,
283
 
                 bus = None):
 
256
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
257
                 servicetype = None, port = None, TXT = None,
 
258
                 domain = "", host = "", max_renames = 32768,
 
259
                 protocol = avahi.PROTO_UNSPEC, bus = None):
284
260
        self.interface = interface
285
261
        self.name = name
286
262
        self.type = servicetype
296
272
        self.bus = bus
297
273
        self.entry_group_state_changed_match = None
298
274
    
299
 
    def rename(self, remove=True):
 
275
    def rename(self):
300
276
        """Derived from the Avahi example code"""
301
277
        if self.rename_count >= self.max_renames:
302
278
            logger.critical("No suitable Zeroconf service name found"
303
279
                            " after %i retries, exiting.",
304
280
                            self.rename_count)
305
281
            raise AvahiServiceError("Too many renames")
306
 
        self.name = str(
307
 
            self.server.GetAlternativeServiceName(self.name))
308
 
        self.rename_count += 1
 
282
        self.name = unicode(self.server
 
283
                            .GetAlternativeServiceName(self.name))
309
284
        logger.info("Changing Zeroconf service name to %r ...",
310
285
                    self.name)
311
 
        if remove:
312
 
            self.remove()
 
286
        self.remove()
313
287
        try:
314
288
            self.add()
315
289
        except dbus.exceptions.DBusException as error:
316
 
            if (error.get_dbus_name()
317
 
                == "org.freedesktop.Avahi.CollisionError"):
318
 
                logger.info("Local Zeroconf service name collision.")
319
 
                return self.rename(remove=False)
320
 
            else:
321
 
                logger.critical("D-Bus Exception", exc_info=error)
322
 
                self.cleanup()
323
 
                os._exit(1)
 
290
            logger.critical("D-Bus Exception", exc_info=error)
 
291
            self.cleanup()
 
292
            os._exit(1)
 
293
        self.rename_count += 1
324
294
    
325
295
    def remove(self):
326
296
        """Derived from the Avahi example code"""
364
334
            self.rename()
365
335
        elif state == avahi.ENTRY_GROUP_FAILURE:
366
336
            logger.critical("Avahi: Error in group state changed %s",
367
 
                            str(error))
368
 
            raise AvahiGroupError("State changed: {!s}".format(error))
 
337
                            unicode(error))
 
338
            raise AvahiGroupError("State changed: {!s}"
 
339
                                  .format(error))
369
340
    
370
341
    def cleanup(self):
371
342
        """Derived from the Avahi example code"""
381
352
    def server_state_changed(self, state, error=None):
382
353
        """Derived from the Avahi example code"""
383
354
        logger.debug("Avahi server state change: %i", state)
384
 
        bad_states = {
385
 
            avahi.SERVER_INVALID: "Zeroconf server invalid",
386
 
            avahi.SERVER_REGISTERING: None,
387
 
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
 
            avahi.SERVER_FAILURE: "Zeroconf server failure",
389
 
        }
 
355
        bad_states = { avahi.SERVER_INVALID:
 
356
                           "Zeroconf server invalid",
 
357
                       avahi.SERVER_REGISTERING: None,
 
358
                       avahi.SERVER_COLLISION:
 
359
                           "Zeroconf server name collision",
 
360
                       avahi.SERVER_FAILURE:
 
361
                           "Zeroconf server failure" }
390
362
        if state in bad_states:
391
363
            if bad_states[state] is not None:
392
364
                if error is None:
411
383
                                    follow_name_owner_changes=True),
412
384
                avahi.DBUS_INTERFACE_SERVER)
413
385
        self.server.connect_to_signal("StateChanged",
414
 
                                      self.server_state_changed)
 
386
                                 self.server_state_changed)
415
387
        self.server_state_changed(self.server.GetState())
416
388
 
417
389
 
418
390
class AvahiServiceToSyslog(AvahiService):
419
 
    def rename(self, *args, **kwargs):
 
391
    def rename(self):
420
392
        """Add the new name to the syslog messages"""
421
 
        ret = AvahiService.rename(self, *args, **kwargs)
422
 
        syslogger.setFormatter(logging.Formatter(
423
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
424
 
            .format(self.name)))
 
393
        ret = AvahiService.rename(self)
 
394
        syslogger.setFormatter(logging.Formatter
 
395
                               ('Mandos ({}) [%(process)d]:'
 
396
                                ' %(levelname)s: %(message)s'
 
397
                                .format(self.name)))
425
398
        return ret
426
399
 
427
 
def call_pipe(connection,       # : multiprocessing.Connection
428
 
              func, *args, **kwargs):
429
 
    """This function is meant to be called by multiprocessing.Process
430
 
    
431
 
    This function runs func(*args, **kwargs), and writes the resulting
432
 
    return value on the provided multiprocessing.Connection.
433
 
    """
434
 
    connection.send(func(*args, **kwargs))
435
 
    connection.close()
436
400
 
437
401
class Client(object):
438
402
    """A representation of a client host served by this server.
465
429
    last_checker_status: integer between 0 and 255 reflecting exit
466
430
                         status of last checker. -1 reflects crashed
467
431
                         checker, -2 means no checker completed yet.
468
 
    last_checker_signal: The signal which killed the last checker, if
469
 
                         last_checker_status is -1
470
432
    last_enabled: datetime.datetime(); (UTC) or None
471
433
    name:       string; from the config file, used in log messages and
472
434
                        D-Bus identifiers
485
447
                          "fingerprint", "host", "interval",
486
448
                          "last_approval_request", "last_checked_ok",
487
449
                          "last_enabled", "name", "timeout")
488
 
    client_defaults = {
489
 
        "timeout": "PT5M",
490
 
        "extended_timeout": "PT15M",
491
 
        "interval": "PT2M",
492
 
        "checker": "fping -q -- %%(host)s",
493
 
        "host": "",
494
 
        "approval_delay": "PT0S",
495
 
        "approval_duration": "PT1S",
496
 
        "approved_by_default": "True",
497
 
        "enabled": "True",
498
 
    }
 
450
    client_defaults = { "timeout": "PT5M",
 
451
                        "extended_timeout": "PT15M",
 
452
                        "interval": "PT2M",
 
453
                        "checker": "fping -q -- %%(host)s",
 
454
                        "host": "",
 
455
                        "approval_delay": "PT0S",
 
456
                        "approval_duration": "PT1S",
 
457
                        "approved_by_default": "True",
 
458
                        "enabled": "True",
 
459
                        }
499
460
    
500
461
    @staticmethod
501
462
    def config_parser(config):
517
478
            client["enabled"] = config.getboolean(client_name,
518
479
                                                  "enabled")
519
480
            
520
 
            # Uppercase and remove spaces from fingerprint for later
521
 
            # comparison purposes with return value from the
522
 
            # fingerprint() function
523
481
            client["fingerprint"] = (section["fingerprint"].upper()
524
482
                                     .replace(" ", ""))
525
483
            if "secret" in section:
567
525
            self.expires = None
568
526
        
569
527
        logger.debug("Creating client %r", self.name)
 
528
        # Uppercase and remove spaces from fingerprint for later
 
529
        # comparison purposes with return value from the fingerprint()
 
530
        # function
570
531
        logger.debug("  Fingerprint: %s", self.fingerprint)
571
532
        self.created = settings.get("created",
572
533
                                    datetime.datetime.utcnow())
579
540
        self.current_checker_command = None
580
541
        self.approved = None
581
542
        self.approvals_pending = 0
582
 
        self.changedstate = multiprocessing_manager.Condition(
583
 
            multiprocessing_manager.Lock())
584
 
        self.client_structure = [attr
585
 
                                 for attr in self.__dict__.iterkeys()
 
543
        self.changedstate = (multiprocessing_manager
 
544
                             .Condition(multiprocessing_manager
 
545
                                        .Lock()))
 
546
        self.client_structure = [attr for attr in
 
547
                                 self.__dict__.iterkeys()
586
548
                                 if not attr.startswith("_")]
587
549
        self.client_structure.append("client_structure")
588
550
        
589
 
        for name, t in inspect.getmembers(
590
 
                type(self), lambda obj: isinstance(obj, property)):
 
551
        for name, t in inspect.getmembers(type(self),
 
552
                                          lambda obj:
 
553
                                              isinstance(obj,
 
554
                                                         property)):
591
555
            if not name.startswith("_"):
592
556
                self.client_structure.append(name)
593
557
    
635
599
        # and every interval from then on.
636
600
        if self.checker_initiator_tag is not None:
637
601
            gobject.source_remove(self.checker_initiator_tag)
638
 
        self.checker_initiator_tag = gobject.timeout_add(
639
 
            int(self.interval.total_seconds() * 1000),
640
 
            self.start_checker)
 
602
        self.checker_initiator_tag = (gobject.timeout_add
 
603
                                      (int(self.interval
 
604
                                           .total_seconds() * 1000),
 
605
                                       self.start_checker))
641
606
        # Schedule a disable() when 'timeout' has passed
642
607
        if self.disable_initiator_tag is not None:
643
608
            gobject.source_remove(self.disable_initiator_tag)
644
 
        self.disable_initiator_tag = gobject.timeout_add(
645
 
            int(self.timeout.total_seconds() * 1000), self.disable)
 
609
        self.disable_initiator_tag = (gobject.timeout_add
 
610
                                      (int(self.timeout
 
611
                                           .total_seconds() * 1000),
 
612
                                       self.disable))
646
613
        # Also start a new checker *right now*.
647
614
        self.start_checker()
648
615
    
649
 
    def checker_callback(self, source, condition, connection,
650
 
                         command):
 
616
    def checker_callback(self, pid, condition, command):
651
617
        """The checker has completed, so take appropriate actions."""
652
618
        self.checker_callback_tag = None
653
619
        self.checker = None
654
 
        # Read return code from connection (see call_pipe)
655
 
        returncode = connection.recv()
656
 
        connection.close()
657
 
        
658
 
        if returncode >= 0:
659
 
            self.last_checker_status = returncode
660
 
            self.last_checker_signal = None
 
620
        if os.WIFEXITED(condition):
 
621
            self.last_checker_status = os.WEXITSTATUS(condition)
661
622
            if self.last_checker_status == 0:
662
623
                logger.info("Checker for %(name)s succeeded",
663
624
                            vars(self))
664
625
                self.checked_ok()
665
626
            else:
666
 
                logger.info("Checker for %(name)s failed", vars(self))
 
627
                logger.info("Checker for %(name)s failed",
 
628
                            vars(self))
667
629
        else:
668
630
            self.last_checker_status = -1
669
 
            self.last_checker_signal = -returncode
670
631
            logger.warning("Checker for %(name)s crashed?",
671
632
                           vars(self))
672
 
        return False
673
633
    
674
634
    def checked_ok(self):
675
635
        """Assert that the client has been seen, alive and well."""
676
636
        self.last_checked_ok = datetime.datetime.utcnow()
677
637
        self.last_checker_status = 0
678
 
        self.last_checker_signal = None
679
638
        self.bump_timeout()
680
639
    
681
640
    def bump_timeout(self, timeout=None):
686
645
            gobject.source_remove(self.disable_initiator_tag)
687
646
            self.disable_initiator_tag = None
688
647
        if getattr(self, "enabled", False):
689
 
            self.disable_initiator_tag = gobject.timeout_add(
690
 
                int(timeout.total_seconds() * 1000), self.disable)
 
648
            self.disable_initiator_tag = (gobject.timeout_add
 
649
                                          (int(timeout.total_seconds()
 
650
                                               * 1000), self.disable))
691
651
            self.expires = datetime.datetime.utcnow() + timeout
692
652
    
693
653
    def need_approval(self):
707
667
        # than 'timeout' for the client to be disabled, which is as it
708
668
        # should be.
709
669
        
710
 
        if self.checker is not None and not self.checker.is_alive():
711
 
            logger.warning("Checker was not alive; joining")
712
 
            self.checker.join()
713
 
            self.checker = None
 
670
        # If a checker exists, make sure it is not a zombie
 
671
        try:
 
672
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
673
        except AttributeError:
 
674
            pass
 
675
        except OSError as error:
 
676
            if error.errno != errno.ECHILD:
 
677
                raise
 
678
        else:
 
679
            if pid:
 
680
                logger.warning("Checker was a zombie")
 
681
                gobject.source_remove(self.checker_callback_tag)
 
682
                self.checker_callback(pid, status,
 
683
                                      self.current_checker_command)
714
684
        # Start a new checker if needed
715
685
        if self.checker is None:
716
686
            # Escape attributes for the shell
717
 
            escaped_attrs = {
718
 
                attr: re.escape(str(getattr(self, attr)))
719
 
                for attr in self.runtime_expansions }
 
687
            escaped_attrs = { attr:
 
688
                                  re.escape(unicode(getattr(self,
 
689
                                                            attr)))
 
690
                              for attr in self.runtime_expansions }
720
691
            try:
721
692
                command = self.checker_command % escaped_attrs
722
693
            except TypeError as error:
723
694
                logger.error('Could not format string "%s"',
724
 
                             self.checker_command,
 
695
                             self.checker_command, exc_info=error)
 
696
                return True # Try again later
 
697
            self.current_checker_command = command
 
698
            try:
 
699
                logger.info("Starting checker %r for %s",
 
700
                            command, self.name)
 
701
                # We don't need to redirect stdout and stderr, since
 
702
                # in normal mode, that is already done by daemon(),
 
703
                # and in debug mode we don't want to.  (Stdin is
 
704
                # always replaced by /dev/null.)
 
705
                # The exception is when not debugging but nevertheless
 
706
                # running in the foreground; use the previously
 
707
                # created wnull.
 
708
                popen_args = {}
 
709
                if (not self.server_settings["debug"]
 
710
                    and self.server_settings["foreground"]):
 
711
                    popen_args.update({"stdout": wnull,
 
712
                                       "stderr": wnull })
 
713
                self.checker = subprocess.Popen(command,
 
714
                                                close_fds=True,
 
715
                                                shell=True, cwd="/",
 
716
                                                **popen_args)
 
717
            except OSError as error:
 
718
                logger.error("Failed to start subprocess",
725
719
                             exc_info=error)
726
 
                return True     # Try again later
727
 
            self.current_checker_command = command
728
 
            logger.info("Starting checker %r for %s", command,
729
 
                        self.name)
730
 
            # We don't need to redirect stdout and stderr, since
731
 
            # in normal mode, that is already done by daemon(),
732
 
            # and in debug mode we don't want to.  (Stdin is
733
 
            # always replaced by /dev/null.)
734
 
            # The exception is when not debugging but nevertheless
735
 
            # running in the foreground; use the previously
736
 
            # created wnull.
737
 
            popen_args = { "close_fds": True,
738
 
                           "shell": True,
739
 
                           "cwd": "/" }
740
 
            if (not self.server_settings["debug"]
741
 
                and self.server_settings["foreground"]):
742
 
                popen_args.update({"stdout": wnull,
743
 
                                   "stderr": wnull })
744
 
            pipe = multiprocessing.Pipe(duplex = False)
745
 
            self.checker = multiprocessing.Process(
746
 
                target = call_pipe,
747
 
                args = (pipe[1], subprocess.call, command),
748
 
                kwargs = popen_args)
749
 
            self.checker.start()
750
 
            self.checker_callback_tag = gobject.io_add_watch(
751
 
                pipe[0].fileno(), gobject.IO_IN,
752
 
                self.checker_callback, pipe[0], command)
 
720
                return True
 
721
            self.checker_callback_tag = (gobject.child_watch_add
 
722
                                         (self.checker.pid,
 
723
                                          self.checker_callback,
 
724
                                          data=command))
 
725
            # The checker may have completed before the gobject
 
726
            # watch was added.  Check for this.
 
727
            try:
 
728
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
729
            except OSError as error:
 
730
                if error.errno == errno.ECHILD:
 
731
                    # This should never happen
 
732
                    logger.error("Child process vanished",
 
733
                                 exc_info=error)
 
734
                    return True
 
735
                raise
 
736
            if pid:
 
737
                gobject.source_remove(self.checker_callback_tag)
 
738
                self.checker_callback(pid, status, command)
753
739
        # Re-run this periodically if run by gobject.timeout_add
754
740
        return True
755
741
    
761
747
        if getattr(self, "checker", None) is None:
762
748
            return
763
749
        logger.debug("Stopping checker for %(name)s", vars(self))
764
 
        self.checker.terminate()
 
750
        try:
 
751
            self.checker.terminate()
 
752
            #time.sleep(0.5)
 
753
            #if self.checker.poll() is None:
 
754
            #    self.checker.kill()
 
755
        except OSError as error:
 
756
            if error.errno != errno.ESRCH: # No such process
 
757
                raise
765
758
        self.checker = None
766
759
 
767
760
 
768
 
def dbus_service_property(dbus_interface,
769
 
                          signature="v",
770
 
                          access="readwrite",
771
 
                          byte_arrays=False):
 
761
def dbus_service_property(dbus_interface, signature="v",
 
762
                          access="readwrite", byte_arrays=False):
772
763
    """Decorators for marking methods of a DBusObjectWithProperties to
773
764
    become properties on the D-Bus.
774
765
    
784
775
    if byte_arrays and signature != "ay":
785
776
        raise ValueError("Byte arrays not supported for non-'ay'"
786
777
                         " signature {!r}".format(signature))
787
 
    
788
778
    def decorator(func):
789
779
        func._dbus_is_property = True
790
780
        func._dbus_interface = dbus_interface
795
785
            func._dbus_name = func._dbus_name[:-14]
796
786
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
797
787
        return func
798
 
    
799
788
    return decorator
800
789
 
801
790
 
810
799
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
811
800
                    "false"}
812
801
    """
813
 
    
814
802
    def decorator(func):
815
803
        func._dbus_is_interface = True
816
804
        func._dbus_interface = dbus_interface
817
805
        func._dbus_name = dbus_interface
818
806
        return func
819
 
    
820
807
    return decorator
821
808
 
822
809
 
824
811
    """Decorator to annotate D-Bus methods, signals or properties
825
812
    Usage:
826
813
    
827
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
828
 
                       "org.freedesktop.DBus.Property."
829
 
                       "EmitsChangedSignal": "false"})
830
814
    @dbus_service_property("org.example.Interface", signature="b",
831
815
                           access="r")
 
816
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
817
                        "org.freedesktop.DBus.Property."
 
818
                        "EmitsChangedSignal": "false"})
832
819
    def Property_dbus_property(self):
833
820
        return dbus.Boolean(False)
834
821
    """
835
 
    
836
822
    def decorator(func):
837
823
        func._dbus_annotations = annotations
838
824
        return func
839
 
    
840
825
    return decorator
841
826
 
842
827
 
845
830
    """
846
831
    pass
847
832
 
848
 
 
849
833
class DBusPropertyAccessException(DBusPropertyException):
850
834
    """A property's access permissions disallows an operation.
851
835
    """
879
863
    def _get_all_dbus_things(self, thing):
880
864
        """Returns a generator of (name, attribute) pairs
881
865
        """
882
 
        return ((getattr(athing.__get__(self), "_dbus_name", name),
 
866
        return ((getattr(athing.__get__(self), "_dbus_name",
 
867
                         name),
883
868
                 athing.__get__(self))
884
869
                for cls in self.__class__.__mro__
885
870
                for name, athing in
886
 
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
871
                inspect.getmembers(cls,
 
872
                                   self._is_dbus_thing(thing)))
887
873
    
888
874
    def _get_dbus_property(self, interface_name, property_name):
889
875
        """Returns a bound method if one exists which is a D-Bus
890
876
        property with the specified name and interface.
891
877
        """
892
 
        for cls in self.__class__.__mro__:
893
 
            for name, value in inspect.getmembers(
894
 
                    cls, self._is_dbus_thing("property")):
 
878
        for cls in  self.__class__.__mro__:
 
879
            for name, value in (inspect.getmembers
 
880
                                (cls,
 
881
                                 self._is_dbus_thing("property"))):
895
882
                if (value._dbus_name == property_name
896
883
                    and value._dbus_interface == interface_name):
897
884
                    return value.__get__(self)
898
885
        
899
886
        # No such property
900
 
        raise DBusPropertyNotFound("{}:{}.{}".format(
901
 
            self.dbus_object_path, interface_name, property_name))
 
887
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
888
                                   + interface_name + "."
 
889
                                   + property_name)
902
890
    
903
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
904
 
                         in_signature="ss",
 
891
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
905
892
                         out_signature="v")
906
893
    def Get(self, interface_name, property_name):
907
894
        """Standard D-Bus property Get() method, see D-Bus standard.
932
919
                                            for byte in value))
933
920
        prop(value)
934
921
    
935
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
936
 
                         in_signature="s",
 
922
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
937
923
                         out_signature="a{sv}")
938
924
    def GetAll(self, interface_name):
939
925
        """Standard D-Bus property GetAll() method, see D-Bus
954
940
            if not hasattr(value, "variant_level"):
955
941
                properties[name] = value
956
942
                continue
957
 
            properties[name] = type(value)(
958
 
                value, variant_level = value.variant_level + 1)
 
943
            properties[name] = type(value)(value, variant_level=
 
944
                                           value.variant_level+1)
959
945
        return dbus.Dictionary(properties, signature="sv")
960
946
    
961
 
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
962
 
    def PropertiesChanged(self, interface_name, changed_properties,
963
 
                          invalidated_properties):
964
 
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
965
 
        standard.
966
 
        """
967
 
        pass
968
 
    
969
947
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
970
948
                         out_signature="s",
971
949
                         path_keyword='object_path',
979
957
                                                   connection)
980
958
        try:
981
959
            document = xml.dom.minidom.parseString(xmlstring)
982
 
            
983
960
            def make_tag(document, name, prop):
984
961
                e = document.createElement("property")
985
962
                e.setAttribute("name", name)
986
963
                e.setAttribute("type", prop._dbus_signature)
987
964
                e.setAttribute("access", prop._dbus_access)
988
965
                return e
989
 
            
990
966
            for if_tag in document.getElementsByTagName("interface"):
991
967
                # Add property tags
992
968
                for tag in (make_tag(document, name, prop)
1004
980
                            if (name == tag.getAttribute("name")
1005
981
                                and prop._dbus_interface
1006
982
                                == if_tag.getAttribute("name")):
1007
 
                                annots.update(getattr(
1008
 
                                    prop, "_dbus_annotations", {}))
 
983
                                annots.update(getattr
 
984
                                              (prop,
 
985
                                               "_dbus_annotations",
 
986
                                               {}))
1009
987
                        for name, value in annots.items():
1010
988
                            ann_tag = document.createElement(
1011
989
                                "annotation")
1016
994
                for annotation, value in dict(
1017
995
                    itertools.chain.from_iterable(
1018
996
                        annotations().items()
1019
 
                        for name, annotations
1020
 
                        in self._get_all_dbus_things("interface")
 
997
                        for name, annotations in
 
998
                        self._get_all_dbus_things("interface")
1021
999
                        if name == if_tag.getAttribute("name")
1022
1000
                        )).items():
1023
1001
                    ann_tag = document.createElement("annotation")
1052
1030
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1053
1031
    if dt is None:
1054
1032
        return dbus.String("", variant_level = variant_level)
1055
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
 
1033
    return dbus.String(dt.isoformat(),
 
1034
                       variant_level=variant_level)
1056
1035
 
1057
1036
 
1058
1037
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1078
1057
    (from DBusObjectWithProperties) and interfaces (from the
1079
1058
    dbus_interface_annotations decorator).
1080
1059
    """
1081
 
    
1082
1060
    def wrapper(cls):
1083
1061
        for orig_interface_name, alt_interface_name in (
1084
 
                alt_interface_names.items()):
 
1062
            alt_interface_names.items()):
1085
1063
            attr = {}
1086
1064
            interface_names = set()
1087
1065
            # Go though all attributes of the class
1089
1067
                # Ignore non-D-Bus attributes, and D-Bus attributes
1090
1068
                # with the wrong interface name
1091
1069
                if (not hasattr(attribute, "_dbus_interface")
1092
 
                    or not attribute._dbus_interface.startswith(
1093
 
                        orig_interface_name)):
 
1070
                    or not attribute._dbus_interface
 
1071
                    .startswith(orig_interface_name)):
1094
1072
                    continue
1095
1073
                # Create an alternate D-Bus interface name based on
1096
1074
                # the current name
1097
 
                alt_interface = attribute._dbus_interface.replace(
1098
 
                    orig_interface_name, alt_interface_name)
 
1075
                alt_interface = (attribute._dbus_interface
 
1076
                                 .replace(orig_interface_name,
 
1077
                                          alt_interface_name))
1099
1078
                interface_names.add(alt_interface)
1100
1079
                # Is this a D-Bus signal?
1101
1080
                if getattr(attribute, "_dbus_is_signal", False):
1102
 
                    if sys.version_info.major == 2:
1103
 
                        # Extract the original non-method undecorated
1104
 
                        # function by black magic
1105
 
                        nonmethod_func = (dict(
 
1081
                    # Extract the original non-method undecorated
 
1082
                    # function by black magic
 
1083
                    nonmethod_func = (dict(
1106
1084
                            zip(attribute.func_code.co_freevars,
1107
 
                                attribute.__closure__))
1108
 
                                          ["func"].cell_contents)
1109
 
                    else:
1110
 
                        nonmethod_func = attribute
 
1085
                                attribute.__closure__))["func"]
 
1086
                                      .cell_contents)
1111
1087
                    # Create a new, but exactly alike, function
1112
1088
                    # object, and decorate it to be a new D-Bus signal
1113
1089
                    # with the alternate D-Bus interface name
1114
 
                    if sys.version_info.major == 2:
1115
 
                        new_function = types.FunctionType(
1116
 
                            nonmethod_func.func_code,
1117
 
                            nonmethod_func.func_globals,
1118
 
                            nonmethod_func.func_name,
1119
 
                            nonmethod_func.func_defaults,
1120
 
                            nonmethod_func.func_closure)
1121
 
                    else:
1122
 
                        new_function = types.FunctionType(
1123
 
                            nonmethod_func.__code__,
1124
 
                            nonmethod_func.__globals__,
1125
 
                            nonmethod_func.__name__,
1126
 
                            nonmethod_func.__defaults__,
1127
 
                            nonmethod_func.__closure__)
1128
 
                    new_function = (dbus.service.signal(
1129
 
                        alt_interface,
1130
 
                        attribute._dbus_signature)(new_function))
 
1090
                    new_function = (dbus.service.signal
 
1091
                                    (alt_interface,
 
1092
                                     attribute._dbus_signature)
 
1093
                                    (types.FunctionType(
 
1094
                                nonmethod_func.func_code,
 
1095
                                nonmethod_func.func_globals,
 
1096
                                nonmethod_func.func_name,
 
1097
                                nonmethod_func.func_defaults,
 
1098
                                nonmethod_func.func_closure)))
1131
1099
                    # Copy annotations, if any
1132
1100
                    try:
1133
 
                        new_function._dbus_annotations = dict(
1134
 
                            attribute._dbus_annotations)
 
1101
                        new_function._dbus_annotations = (
 
1102
                            dict(attribute._dbus_annotations))
1135
1103
                    except AttributeError:
1136
1104
                        pass
1137
1105
                    # Define a creator of a function to call both the
1142
1110
                        """This function is a scope container to pass
1143
1111
                        func1 and func2 to the "call_both" function
1144
1112
                        outside of its arguments"""
1145
 
                        
1146
1113
                        def call_both(*args, **kwargs):
1147
1114
                            """This function will emit two D-Bus
1148
1115
                            signals by calling func1 and func2"""
1149
1116
                            func1(*args, **kwargs)
1150
1117
                            func2(*args, **kwargs)
1151
 
                        
1152
1118
                        return call_both
1153
1119
                    # Create the "call_both" function and add it to
1154
1120
                    # the class
1159
1125
                    # object.  Decorate it to be a new D-Bus method
1160
1126
                    # with the alternate D-Bus interface name.  Add it
1161
1127
                    # to the class.
1162
 
                    attr[attrname] = (
1163
 
                        dbus.service.method(
1164
 
                            alt_interface,
1165
 
                            attribute._dbus_in_signature,
1166
 
                            attribute._dbus_out_signature)
1167
 
                        (types.FunctionType(attribute.func_code,
1168
 
                                            attribute.func_globals,
1169
 
                                            attribute.func_name,
1170
 
                                            attribute.func_defaults,
1171
 
                                            attribute.func_closure)))
 
1128
                    attr[attrname] = (dbus.service.method
 
1129
                                      (alt_interface,
 
1130
                                       attribute._dbus_in_signature,
 
1131
                                       attribute._dbus_out_signature)
 
1132
                                      (types.FunctionType
 
1133
                                       (attribute.func_code,
 
1134
                                        attribute.func_globals,
 
1135
                                        attribute.func_name,
 
1136
                                        attribute.func_defaults,
 
1137
                                        attribute.func_closure)))
1172
1138
                    # Copy annotations, if any
1173
1139
                    try:
1174
 
                        attr[attrname]._dbus_annotations = dict(
1175
 
                            attribute._dbus_annotations)
 
1140
                        attr[attrname]._dbus_annotations = (
 
1141
                            dict(attribute._dbus_annotations))
1176
1142
                    except AttributeError:
1177
1143
                        pass
1178
1144
                # Is this a D-Bus property?
1181
1147
                    # object, and decorate it to be a new D-Bus
1182
1148
                    # property with the alternate D-Bus interface
1183
1149
                    # name.  Add it to the class.
1184
 
                    attr[attrname] = (dbus_service_property(
1185
 
                        alt_interface, attribute._dbus_signature,
1186
 
                        attribute._dbus_access,
1187
 
                        attribute._dbus_get_args_options
1188
 
                        ["byte_arrays"])
1189
 
                                      (types.FunctionType(
1190
 
                                          attribute.func_code,
1191
 
                                          attribute.func_globals,
1192
 
                                          attribute.func_name,
1193
 
                                          attribute.func_defaults,
1194
 
                                          attribute.func_closure)))
 
1150
                    attr[attrname] = (dbus_service_property
 
1151
                                      (alt_interface,
 
1152
                                       attribute._dbus_signature,
 
1153
                                       attribute._dbus_access,
 
1154
                                       attribute
 
1155
                                       ._dbus_get_args_options
 
1156
                                       ["byte_arrays"])
 
1157
                                      (types.FunctionType
 
1158
                                       (attribute.func_code,
 
1159
                                        attribute.func_globals,
 
1160
                                        attribute.func_name,
 
1161
                                        attribute.func_defaults,
 
1162
                                        attribute.func_closure)))
1195
1163
                    # Copy annotations, if any
1196
1164
                    try:
1197
 
                        attr[attrname]._dbus_annotations = dict(
1198
 
                            attribute._dbus_annotations)
 
1165
                        attr[attrname]._dbus_annotations = (
 
1166
                            dict(attribute._dbus_annotations))
1199
1167
                    except AttributeError:
1200
1168
                        pass
1201
1169
                # Is this a D-Bus interface?
1204
1172
                    # object.  Decorate it to be a new D-Bus interface
1205
1173
                    # with the alternate D-Bus interface name.  Add it
1206
1174
                    # to the class.
1207
 
                    attr[attrname] = (
1208
 
                        dbus_interface_annotations(alt_interface)
1209
 
                        (types.FunctionType(attribute.func_code,
1210
 
                                            attribute.func_globals,
1211
 
                                            attribute.func_name,
1212
 
                                            attribute.func_defaults,
1213
 
                                            attribute.func_closure)))
 
1175
                    attr[attrname] = (dbus_interface_annotations
 
1176
                                      (alt_interface)
 
1177
                                      (types.FunctionType
 
1178
                                       (attribute.func_code,
 
1179
                                        attribute.func_globals,
 
1180
                                        attribute.func_name,
 
1181
                                        attribute.func_defaults,
 
1182
                                        attribute.func_closure)))
1214
1183
            if deprecate:
1215
1184
                # Deprecate all alternate interfaces
1216
1185
                iname="_AlternateDBusNames_interface_annotation{}"
1217
1186
                for interface_name in interface_names:
1218
 
                    
1219
1187
                    @dbus_interface_annotations(interface_name)
1220
1188
                    def func(self):
1221
1189
                        return { "org.freedesktop.DBus.Deprecated":
1222
 
                                 "true" }
 
1190
                                     "true" }
1223
1191
                    # Find an unused name
1224
1192
                    for aname in (iname.format(i)
1225
1193
                                  for i in itertools.count()):
1230
1198
                # Replace the class with a new subclass of it with
1231
1199
                # methods, signals, etc. as created above.
1232
1200
                cls = type(b"{}Alternate".format(cls.__name__),
1233
 
                           (cls, ), attr)
 
1201
                           (cls,), attr)
1234
1202
        return cls
1235
 
    
1236
1203
    return wrapper
1237
1204
 
1238
1205
 
1239
1206
@alternate_dbus_interfaces({"se.recompile.Mandos":
1240
 
                            "se.bsnet.fukt.Mandos"})
 
1207
                                "se.bsnet.fukt.Mandos"})
1241
1208
class ClientDBus(Client, DBusObjectWithProperties):
1242
1209
    """A Client class using D-Bus
1243
1210
    
1247
1214
    """
1248
1215
    
1249
1216
    runtime_expansions = (Client.runtime_expansions
1250
 
                          + ("dbus_object_path", ))
1251
 
    
1252
 
    _interface = "se.recompile.Mandos.Client"
 
1217
                          + ("dbus_object_path",))
1253
1218
    
1254
1219
    # dbus.service.Object doesn't use super(), so we can't either.
1255
1220
    
1258
1223
        Client.__init__(self, *args, **kwargs)
1259
1224
        # Only now, when this client is initialized, can it show up on
1260
1225
        # the D-Bus
1261
 
        client_object_name = str(self.name).translate(
 
1226
        client_object_name = unicode(self.name).translate(
1262
1227
            {ord("."): ord("_"),
1263
1228
             ord("-"): ord("_")})
1264
 
        self.dbus_object_path = dbus.ObjectPath(
1265
 
            "/clients/" + client_object_name)
 
1229
        self.dbus_object_path = (dbus.ObjectPath
 
1230
                                 ("/clients/" + client_object_name))
1266
1231
        DBusObjectWithProperties.__init__(self, self.bus,
1267
1232
                                          self.dbus_object_path)
1268
1233
    
1269
 
    def notifychangeproperty(transform_func, dbus_name,
1270
 
                             type_func=lambda x: x,
1271
 
                             variant_level=1,
1272
 
                             invalidate_only=False,
1273
 
                             _interface=_interface):
 
1234
    def notifychangeproperty(transform_func,
 
1235
                             dbus_name, type_func=lambda x: x,
 
1236
                             variant_level=1):
1274
1237
        """ Modify a variable so that it's a property which announces
1275
1238
        its changes to DBus.
1276
1239
        
1282
1245
        variant_level: D-Bus variant level.  Default: 1
1283
1246
        """
1284
1247
        attrname = "_{}".format(dbus_name)
1285
 
        
1286
1248
        def setter(self, value):
1287
1249
            if hasattr(self, "dbus_object_path"):
1288
1250
                if (not hasattr(self, attrname) or
1289
1251
                    type_func(getattr(self, attrname, None))
1290
1252
                    != type_func(value)):
1291
 
                    if invalidate_only:
1292
 
                        self.PropertiesChanged(
1293
 
                            _interface, dbus.Dictionary(),
1294
 
                            dbus.Array((dbus_name, )))
1295
 
                    else:
1296
 
                        dbus_value = transform_func(
1297
 
                            type_func(value),
1298
 
                            variant_level = variant_level)
1299
 
                        self.PropertyChanged(dbus.String(dbus_name),
1300
 
                                             dbus_value)
1301
 
                        self.PropertiesChanged(
1302
 
                            _interface,
1303
 
                            dbus.Dictionary({ dbus.String(dbus_name):
1304
 
                                              dbus_value }),
1305
 
                            dbus.Array())
 
1253
                    dbus_value = transform_func(type_func(value),
 
1254
                                                variant_level
 
1255
                                                =variant_level)
 
1256
                    self.PropertyChanged(dbus.String(dbus_name),
 
1257
                                         dbus_value)
1306
1258
            setattr(self, attrname, value)
1307
1259
        
1308
1260
        return property(lambda self: getattr(self, attrname), setter)
1314
1266
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1315
1267
    last_enabled = notifychangeproperty(datetime_to_dbus,
1316
1268
                                        "LastEnabled")
1317
 
    checker = notifychangeproperty(
1318
 
        dbus.Boolean, "CheckerRunning",
1319
 
        type_func = lambda checker: checker is not None)
 
1269
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1270
                                   type_func = lambda checker:
 
1271
                                       checker is not None)
1320
1272
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1321
1273
                                           "LastCheckedOK")
1322
1274
    last_checker_status = notifychangeproperty(dbus.Int16,
1325
1277
        datetime_to_dbus, "LastApprovalRequest")
1326
1278
    approved_by_default = notifychangeproperty(dbus.Boolean,
1327
1279
                                               "ApprovedByDefault")
1328
 
    approval_delay = notifychangeproperty(
1329
 
        dbus.UInt64, "ApprovalDelay",
1330
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1280
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1281
                                          "ApprovalDelay",
 
1282
                                          type_func =
 
1283
                                          lambda td: td.total_seconds()
 
1284
                                          * 1000)
1331
1285
    approval_duration = notifychangeproperty(
1332
1286
        dbus.UInt64, "ApprovalDuration",
1333
1287
        type_func = lambda td: td.total_seconds() * 1000)
1334
1288
    host = notifychangeproperty(dbus.String, "Host")
1335
 
    timeout = notifychangeproperty(
1336
 
        dbus.UInt64, "Timeout",
1337
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1289
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1290
                                   type_func = lambda td:
 
1291
                                       td.total_seconds() * 1000)
1338
1292
    extended_timeout = notifychangeproperty(
1339
1293
        dbus.UInt64, "ExtendedTimeout",
1340
1294
        type_func = lambda td: td.total_seconds() * 1000)
1341
 
    interval = notifychangeproperty(
1342
 
        dbus.UInt64, "Interval",
1343
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1295
    interval = notifychangeproperty(dbus.UInt64,
 
1296
                                    "Interval",
 
1297
                                    type_func =
 
1298
                                    lambda td: td.total_seconds()
 
1299
                                    * 1000)
1344
1300
    checker_command = notifychangeproperty(dbus.String, "Checker")
1345
 
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1346
 
                                  invalidate_only=True)
1347
1301
    
1348
1302
    del notifychangeproperty
1349
1303
    
1356
1310
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1357
1311
        Client.__del__(self, *args, **kwargs)
1358
1312
    
1359
 
    def checker_callback(self, source, condition,
1360
 
                         connection, command, *args, **kwargs):
1361
 
        ret = Client.checker_callback(self, source, condition,
1362
 
                                      connection, command, *args,
1363
 
                                      **kwargs)
1364
 
        exitstatus = self.last_checker_status
1365
 
        if exitstatus >= 0:
 
1313
    def checker_callback(self, pid, condition, command,
 
1314
                         *args, **kwargs):
 
1315
        self.checker_callback_tag = None
 
1316
        self.checker = None
 
1317
        if os.WIFEXITED(condition):
 
1318
            exitstatus = os.WEXITSTATUS(condition)
1366
1319
            # Emit D-Bus signal
1367
1320
            self.CheckerCompleted(dbus.Int16(exitstatus),
1368
 
                                  dbus.Int64(0),
 
1321
                                  dbus.Int64(condition),
1369
1322
                                  dbus.String(command))
1370
1323
        else:
1371
1324
            # Emit D-Bus signal
1372
1325
            self.CheckerCompleted(dbus.Int16(-1),
1373
 
                                  dbus.Int64(
1374
 
                                      self.last_checker_signal),
 
1326
                                  dbus.Int64(condition),
1375
1327
                                  dbus.String(command))
1376
 
        return ret
 
1328
        
 
1329
        return Client.checker_callback(self, pid, condition, command,
 
1330
                                       *args, **kwargs)
1377
1331
    
1378
1332
    def start_checker(self, *args, **kwargs):
1379
1333
        old_checker_pid = getattr(self.checker, "pid", None)
1396
1350
        self.send_changedstate()
1397
1351
    
1398
1352
    ## D-Bus methods, signals & properties
 
1353
    _interface = "se.recompile.Mandos.Client"
1399
1354
    
1400
1355
    ## Interfaces
1401
1356
    
 
1357
    @dbus_interface_annotations(_interface)
 
1358
    def _foo(self):
 
1359
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1360
                     "false"}
 
1361
    
1402
1362
    ## Signals
1403
1363
    
1404
1364
    # CheckerCompleted - signal
1414
1374
        pass
1415
1375
    
1416
1376
    # PropertyChanged - signal
1417
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1418
1377
    @dbus.service.signal(_interface, signature="sv")
1419
1378
    def PropertyChanged(self, property, value):
1420
1379
        "D-Bus signal"
1484
1443
        return dbus.Boolean(bool(self.approvals_pending))
1485
1444
    
1486
1445
    # ApprovedByDefault - property
1487
 
    @dbus_service_property(_interface,
1488
 
                           signature="b",
 
1446
    @dbus_service_property(_interface, signature="b",
1489
1447
                           access="readwrite")
1490
1448
    def ApprovedByDefault_dbus_property(self, value=None):
1491
1449
        if value is None:       # get
1493
1451
        self.approved_by_default = bool(value)
1494
1452
    
1495
1453
    # ApprovalDelay - property
1496
 
    @dbus_service_property(_interface,
1497
 
                           signature="t",
 
1454
    @dbus_service_property(_interface, signature="t",
1498
1455
                           access="readwrite")
1499
1456
    def ApprovalDelay_dbus_property(self, value=None):
1500
1457
        if value is None:       # get
1503
1460
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1504
1461
    
1505
1462
    # ApprovalDuration - property
1506
 
    @dbus_service_property(_interface,
1507
 
                           signature="t",
 
1463
    @dbus_service_property(_interface, signature="t",
1508
1464
                           access="readwrite")
1509
1465
    def ApprovalDuration_dbus_property(self, value=None):
1510
1466
        if value is None:       # get
1523
1479
        return dbus.String(self.fingerprint)
1524
1480
    
1525
1481
    # Host - property
1526
 
    @dbus_service_property(_interface,
1527
 
                           signature="s",
 
1482
    @dbus_service_property(_interface, signature="s",
1528
1483
                           access="readwrite")
1529
1484
    def Host_dbus_property(self, value=None):
1530
1485
        if value is None:       # get
1531
1486
            return dbus.String(self.host)
1532
 
        self.host = str(value)
 
1487
        self.host = unicode(value)
1533
1488
    
1534
1489
    # Created - property
1535
1490
    @dbus_service_property(_interface, signature="s", access="read")
1542
1497
        return datetime_to_dbus(self.last_enabled)
1543
1498
    
1544
1499
    # Enabled - property
1545
 
    @dbus_service_property(_interface,
1546
 
                           signature="b",
 
1500
    @dbus_service_property(_interface, signature="b",
1547
1501
                           access="readwrite")
1548
1502
    def Enabled_dbus_property(self, value=None):
1549
1503
        if value is None:       # get
1554
1508
            self.disable()
1555
1509
    
1556
1510
    # LastCheckedOK - property
1557
 
    @dbus_service_property(_interface,
1558
 
                           signature="s",
 
1511
    @dbus_service_property(_interface, signature="s",
1559
1512
                           access="readwrite")
1560
1513
    def LastCheckedOK_dbus_property(self, value=None):
1561
1514
        if value is not None:
1564
1517
        return datetime_to_dbus(self.last_checked_ok)
1565
1518
    
1566
1519
    # LastCheckerStatus - property
1567
 
    @dbus_service_property(_interface, signature="n", access="read")
 
1520
    @dbus_service_property(_interface, signature="n",
 
1521
                           access="read")
1568
1522
    def LastCheckerStatus_dbus_property(self):
1569
1523
        return dbus.Int16(self.last_checker_status)
1570
1524
    
1579
1533
        return datetime_to_dbus(self.last_approval_request)
1580
1534
    
1581
1535
    # Timeout - property
1582
 
    @dbus_service_property(_interface,
1583
 
                           signature="t",
 
1536
    @dbus_service_property(_interface, signature="t",
1584
1537
                           access="readwrite")
1585
1538
    def Timeout_dbus_property(self, value=None):
1586
1539
        if value is None:       # get
1599
1552
                    is None):
1600
1553
                    return
1601
1554
                gobject.source_remove(self.disable_initiator_tag)
1602
 
                self.disable_initiator_tag = gobject.timeout_add(
1603
 
                    int((self.expires - now).total_seconds() * 1000),
1604
 
                    self.disable)
 
1555
                self.disable_initiator_tag = (
 
1556
                    gobject.timeout_add(
 
1557
                        int((self.expires - now).total_seconds()
 
1558
                            * 1000), self.disable))
1605
1559
    
1606
1560
    # ExtendedTimeout - property
1607
 
    @dbus_service_property(_interface,
1608
 
                           signature="t",
 
1561
    @dbus_service_property(_interface, signature="t",
1609
1562
                           access="readwrite")
1610
1563
    def ExtendedTimeout_dbus_property(self, value=None):
1611
1564
        if value is None:       # get
1614
1567
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1615
1568
    
1616
1569
    # Interval - property
1617
 
    @dbus_service_property(_interface,
1618
 
                           signature="t",
 
1570
    @dbus_service_property(_interface, signature="t",
1619
1571
                           access="readwrite")
1620
1572
    def Interval_dbus_property(self, value=None):
1621
1573
        if value is None:       # get
1626
1578
        if self.enabled:
1627
1579
            # Reschedule checker run
1628
1580
            gobject.source_remove(self.checker_initiator_tag)
1629
 
            self.checker_initiator_tag = gobject.timeout_add(
1630
 
                value, self.start_checker)
1631
 
            self.start_checker() # Start one now, too
 
1581
            self.checker_initiator_tag = (gobject.timeout_add
 
1582
                                          (value, self.start_checker))
 
1583
            self.start_checker()    # Start one now, too
1632
1584
    
1633
1585
    # Checker - property
1634
 
    @dbus_service_property(_interface,
1635
 
                           signature="s",
 
1586
    @dbus_service_property(_interface, signature="s",
1636
1587
                           access="readwrite")
1637
1588
    def Checker_dbus_property(self, value=None):
1638
1589
        if value is None:       # get
1639
1590
            return dbus.String(self.checker_command)
1640
 
        self.checker_command = str(value)
 
1591
        self.checker_command = unicode(value)
1641
1592
    
1642
1593
    # CheckerRunning - property
1643
 
    @dbus_service_property(_interface,
1644
 
                           signature="b",
 
1594
    @dbus_service_property(_interface, signature="b",
1645
1595
                           access="readwrite")
1646
1596
    def CheckerRunning_dbus_property(self, value=None):
1647
1597
        if value is None:       # get
1657
1607
        return self.dbus_object_path # is already a dbus.ObjectPath
1658
1608
    
1659
1609
    # Secret = property
1660
 
    @dbus_service_property(_interface,
1661
 
                           signature="ay",
1662
 
                           access="write",
1663
 
                           byte_arrays=True)
 
1610
    @dbus_service_property(_interface, signature="ay",
 
1611
                           access="write", byte_arrays=True)
1664
1612
    def Secret_dbus_property(self, value):
1665
1613
        self.secret = bytes(value)
1666
1614
    
1672
1620
        self._pipe = child_pipe
1673
1621
        self._pipe.send(('init', fpr, address))
1674
1622
        if not self._pipe.recv():
1675
 
            raise KeyError(fpr)
 
1623
            raise KeyError()
1676
1624
    
1677
1625
    def __getattribute__(self, name):
1678
1626
        if name == '_pipe':
1682
1630
        if data[0] == 'data':
1683
1631
            return data[1]
1684
1632
        if data[0] == 'function':
1685
 
            
1686
1633
            def func(*args, **kwargs):
1687
1634
                self._pipe.send(('funcall', name, args, kwargs))
1688
1635
                return self._pipe.recv()[1]
1689
 
            
1690
1636
            return func
1691
1637
    
1692
1638
    def __setattr__(self, name, value):
1704
1650
    def handle(self):
1705
1651
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1706
1652
            logger.info("TCP connection from: %s",
1707
 
                        str(self.client_address))
 
1653
                        unicode(self.client_address))
1708
1654
            logger.debug("Pipe FD: %d",
1709
1655
                         self.server.child_pipe.fileno())
1710
1656
            
1711
 
            session = gnutls.connection.ClientSession(
1712
 
                self.request, gnutls.connection .X509Credentials())
 
1657
            session = (gnutls.connection
 
1658
                       .ClientSession(self.request,
 
1659
                                      gnutls.connection
 
1660
                                      .X509Credentials()))
1713
1661
            
1714
1662
            # Note: gnutls.connection.X509Credentials is really a
1715
1663
            # generic GnuTLS certificate credentials object so long as
1724
1672
            priority = self.server.gnutls_priority
1725
1673
            if priority is None:
1726
1674
                priority = "NORMAL"
1727
 
            gnutls.library.functions.gnutls_priority_set_direct(
1728
 
                session._c_object, priority, None)
 
1675
            (gnutls.library.functions
 
1676
             .gnutls_priority_set_direct(session._c_object,
 
1677
                                         priority, None))
1729
1678
            
1730
1679
            # Start communication using the Mandos protocol
1731
1680
            # Get protocol number
1751
1700
            approval_required = False
1752
1701
            try:
1753
1702
                try:
1754
 
                    fpr = self.fingerprint(
1755
 
                        self.peer_certificate(session))
 
1703
                    fpr = self.fingerprint(self.peer_certificate
 
1704
                                           (session))
1756
1705
                except (TypeError,
1757
1706
                        gnutls.errors.GNUTLSError) as error:
1758
1707
                    logger.warning("Bad certificate: %s", error)
1773
1722
                while True:
1774
1723
                    if not client.enabled:
1775
1724
                        logger.info("Client %s is disabled",
1776
 
                                    client.name)
 
1725
                                       client.name)
1777
1726
                        if self.server.use_dbus:
1778
1727
                            # Emit D-Bus signal
1779
1728
                            client.Rejected("Disabled")
1826
1775
                        logger.warning("gnutls send failed",
1827
1776
                                       exc_info=error)
1828
1777
                        return
1829
 
                    logger.debug("Sent: %d, remaining: %d", sent,
1830
 
                                 len(client.secret) - (sent_size
1831
 
                                                       + sent))
 
1778
                    logger.debug("Sent: %d, remaining: %d",
 
1779
                                 sent, len(client.secret)
 
1780
                                 - (sent_size + sent))
1832
1781
                    sent_size += sent
1833
1782
                
1834
1783
                logger.info("Sending secret to %s", client.name)
1851
1800
    def peer_certificate(session):
1852
1801
        "Return the peer's OpenPGP certificate as a bytestring"
1853
1802
        # If not an OpenPGP certificate...
1854
 
        if (gnutls.library.functions.gnutls_certificate_type_get(
1855
 
                session._c_object)
 
1803
        if (gnutls.library.functions
 
1804
            .gnutls_certificate_type_get(session._c_object)
1856
1805
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1857
1806
            # ...do the normal thing
1858
1807
            return session.peer_certificate
1872
1821
    def fingerprint(openpgp):
1873
1822
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1874
1823
        # New GnuTLS "datum" with the OpenPGP public key
1875
 
        datum = gnutls.library.types.gnutls_datum_t(
1876
 
            ctypes.cast(ctypes.c_char_p(openpgp),
1877
 
                        ctypes.POINTER(ctypes.c_ubyte)),
1878
 
            ctypes.c_uint(len(openpgp)))
 
1824
        datum = (gnutls.library.types
 
1825
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1826
                                             ctypes.POINTER
 
1827
                                             (ctypes.c_ubyte)),
 
1828
                                 ctypes.c_uint(len(openpgp))))
1879
1829
        # New empty GnuTLS certificate
1880
1830
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1881
 
        gnutls.library.functions.gnutls_openpgp_crt_init(
1882
 
            ctypes.byref(crt))
 
1831
        (gnutls.library.functions
 
1832
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1883
1833
        # Import the OpenPGP public key into the certificate
1884
 
        gnutls.library.functions.gnutls_openpgp_crt_import(
1885
 
            crt, ctypes.byref(datum),
1886
 
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
1834
        (gnutls.library.functions
 
1835
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1836
                                    gnutls.library.constants
 
1837
                                    .GNUTLS_OPENPGP_FMT_RAW))
1887
1838
        # Verify the self signature in the key
1888
1839
        crtverify = ctypes.c_uint()
1889
 
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
 
            crt, 0, ctypes.byref(crtverify))
 
1840
        (gnutls.library.functions
 
1841
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1842
                                         ctypes.byref(crtverify)))
1891
1843
        if crtverify.value != 0:
1892
1844
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1893
 
            raise gnutls.errors.CertificateSecurityError(
1894
 
                "Verify failed")
 
1845
            raise (gnutls.errors.CertificateSecurityError
 
1846
                   ("Verify failed"))
1895
1847
        # New buffer for the fingerprint
1896
1848
        buf = ctypes.create_string_buffer(20)
1897
1849
        buf_len = ctypes.c_size_t()
1898
1850
        # Get the fingerprint from the certificate into the buffer
1899
 
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
 
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
 
1851
        (gnutls.library.functions
 
1852
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1853
                                             ctypes.byref(buf_len)))
1901
1854
        # Deinit the certificate
1902
1855
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1903
1856
        # Convert the buffer to a Python bytestring
1909
1862
 
1910
1863
class MultiprocessingMixIn(object):
1911
1864
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1912
 
    
1913
1865
    def sub_process_main(self, request, address):
1914
1866
        try:
1915
1867
            self.finish_request(request, address)
1927
1879
 
1928
1880
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1929
1881
    """ adds a pipe to the MixIn """
1930
 
    
1931
1882
    def process_request(self, request, client_address):
1932
1883
        """Overrides and wraps the original process_request().
1933
1884
        
1954
1905
        interface:      None or a network interface name (string)
1955
1906
        use_ipv6:       Boolean; to use IPv6 or not
1956
1907
    """
1957
 
    
1958
1908
    def __init__(self, server_address, RequestHandlerClass,
1959
 
                 interface=None,
1960
 
                 use_ipv6=True,
1961
 
                 socketfd=None):
 
1909
                 interface=None, use_ipv6=True, socketfd=None):
1962
1910
        """If socketfd is set, use that file descriptor instead of
1963
1911
        creating a new one with socket.socket().
1964
1912
        """
2005
1953
                             self.interface)
2006
1954
            else:
2007
1955
                try:
2008
 
                    self.socket.setsockopt(
2009
 
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
 
                        (self.interface + "\0").encode("utf-8"))
 
1956
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1957
                                           SO_BINDTODEVICE,
 
1958
                                           (self.interface + "\0")
 
1959
                                           .encode("utf-8"))
2011
1960
                except socket.error as error:
2012
1961
                    if error.errno == errno.EPERM:
2013
1962
                        logger.error("No permission to bind to"
2031
1980
                self.server_address = (any_address,
2032
1981
                                       self.server_address[1])
2033
1982
            elif not self.server_address[1]:
2034
 
                self.server_address = (self.server_address[0], 0)
 
1983
                self.server_address = (self.server_address[0],
 
1984
                                       0)
2035
1985
#                 if self.interface:
2036
1986
#                     self.server_address = (self.server_address[0],
2037
1987
#                                            0, # port
2051
2001
    
2052
2002
    Assumes a gobject.MainLoop event loop.
2053
2003
    """
2054
 
    
2055
2004
    def __init__(self, server_address, RequestHandlerClass,
2056
 
                 interface=None,
2057
 
                 use_ipv6=True,
2058
 
                 clients=None,
2059
 
                 gnutls_priority=None,
2060
 
                 use_dbus=True,
2061
 
                 socketfd=None):
 
2005
                 interface=None, use_ipv6=True, clients=None,
 
2006
                 gnutls_priority=None, use_dbus=True, socketfd=None):
2062
2007
        self.enabled = False
2063
2008
        self.clients = clients
2064
2009
        if self.clients is None:
2070
2015
                                interface = interface,
2071
2016
                                use_ipv6 = use_ipv6,
2072
2017
                                socketfd = socketfd)
2073
 
    
2074
2018
    def server_activate(self):
2075
2019
        if self.enabled:
2076
2020
            return socketserver.TCPServer.server_activate(self)
2080
2024
    
2081
2025
    def add_pipe(self, parent_pipe, proc):
2082
2026
        # Call "handle_ipc" for both data and EOF events
2083
 
        gobject.io_add_watch(
2084
 
            parent_pipe.fileno(),
2085
 
            gobject.IO_IN | gobject.IO_HUP,
2086
 
            functools.partial(self.handle_ipc,
2087
 
                              parent_pipe = parent_pipe,
2088
 
                              proc = proc))
 
2027
        gobject.io_add_watch(parent_pipe.fileno(),
 
2028
                             gobject.IO_IN | gobject.IO_HUP,
 
2029
                             functools.partial(self.handle_ipc,
 
2030
                                               parent_pipe =
 
2031
                                               parent_pipe,
 
2032
                                               proc = proc))
2089
2033
    
2090
 
    def handle_ipc(self, source, condition,
2091
 
                   parent_pipe=None,
2092
 
                   proc = None,
2093
 
                   client_object=None):
 
2034
    def handle_ipc(self, source, condition, parent_pipe=None,
 
2035
                   proc = None, client_object=None):
2094
2036
        # error, or the other end of multiprocessing.Pipe has closed
2095
2037
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
2096
2038
            # Wait for other process to exit
2119
2061
                parent_pipe.send(False)
2120
2062
                return False
2121
2063
            
2122
 
            gobject.io_add_watch(
2123
 
                parent_pipe.fileno(),
2124
 
                gobject.IO_IN | gobject.IO_HUP,
2125
 
                functools.partial(self.handle_ipc,
2126
 
                                  parent_pipe = parent_pipe,
2127
 
                                  proc = proc,
2128
 
                                  client_object = client))
 
2064
            gobject.io_add_watch(parent_pipe.fileno(),
 
2065
                                 gobject.IO_IN | gobject.IO_HUP,
 
2066
                                 functools.partial(self.handle_ipc,
 
2067
                                                   parent_pipe =
 
2068
                                                   parent_pipe,
 
2069
                                                   proc = proc,
 
2070
                                                   client_object =
 
2071
                                                   client))
2129
2072
            parent_pipe.send(True)
2130
2073
            # remove the old hook in favor of the new above hook on
2131
2074
            # same fileno
2137
2080
            
2138
2081
            parent_pipe.send(('data', getattr(client_object,
2139
2082
                                              funcname)(*args,
2140
 
                                                        **kwargs)))
 
2083
                                                         **kwargs)))
2141
2084
        
2142
2085
        if command == 'getattr':
2143
2086
            attrname = request[1]
2144
 
            if isinstance(client_object.__getattribute__(attrname),
2145
 
                          collections.Callable):
2146
 
                parent_pipe.send(('function', ))
 
2087
            if callable(client_object.__getattribute__(attrname)):
 
2088
                parent_pipe.send(('function',))
2147
2089
            else:
2148
 
                parent_pipe.send((
2149
 
                    'data', client_object.__getattribute__(attrname)))
 
2090
                parent_pipe.send(('data', client_object
 
2091
                                  .__getattribute__(attrname)))
2150
2092
        
2151
2093
        if command == 'setattr':
2152
2094
            attrname = request[1]
2183
2125
    # avoid excessive use of external libraries.
2184
2126
    
2185
2127
    # New type for defining tokens, syntax, and semantics all-in-one
2186
 
    Token = collections.namedtuple("Token", (
2187
 
        "regexp",  # To match token; if "value" is not None, must have
2188
 
                   # a "group" containing digits
2189
 
        "value",   # datetime.timedelta or None
2190
 
        "followers"))           # Tokens valid after this token
 
2128
    Token = collections.namedtuple("Token",
 
2129
                                   ("regexp", # To match token; if
 
2130
                                              # "value" is not None,
 
2131
                                              # must have a "group"
 
2132
                                              # containing digits
 
2133
                                    "value",  # datetime.timedelta or
 
2134
                                              # None
 
2135
                                    "followers")) # Tokens valid after
 
2136
                                                  # this token
2191
2137
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2192
2138
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2193
2139
    token_end = Token(re.compile(r"$"), None, frozenset())
2194
2140
    token_second = Token(re.compile(r"(\d+)S"),
2195
2141
                         datetime.timedelta(seconds=1),
2196
 
                         frozenset((token_end, )))
 
2142
                         frozenset((token_end,)))
2197
2143
    token_minute = Token(re.compile(r"(\d+)M"),
2198
2144
                         datetime.timedelta(minutes=1),
2199
2145
                         frozenset((token_second, token_end)))
2215
2161
                       frozenset((token_month, token_end)))
2216
2162
    token_week = Token(re.compile(r"(\d+)W"),
2217
2163
                       datetime.timedelta(weeks=1),
2218
 
                       frozenset((token_end, )))
 
2164
                       frozenset((token_end,)))
2219
2165
    token_duration = Token(re.compile(r"P"), None,
2220
2166
                           frozenset((token_year, token_month,
2221
2167
                                      token_day, token_time,
2223
2169
    # Define starting values
2224
2170
    value = datetime.timedelta() # Value so far
2225
2171
    found_token = None
2226
 
    followers = frozenset((token_duration, )) # Following valid tokens
 
2172
    followers = frozenset((token_duration,)) # Following valid tokens
2227
2173
    s = duration                # String left to parse
2228
2174
    # Loop until end token is found
2229
2175
    while found_token is not token_end:
2246
2192
                break
2247
2193
        else:
2248
2194
            # No currently valid tokens were found
2249
 
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2250
 
                             .format(duration))
 
2195
            raise ValueError("Invalid RFC 3339 duration")
2251
2196
    # End token found
2252
2197
    return value
2253
2198
 
2290
2235
            elif suffix == "w":
2291
2236
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2292
2237
            else:
2293
 
                raise ValueError("Unknown suffix {!r}".format(suffix))
 
2238
                raise ValueError("Unknown suffix {!r}"
 
2239
                                 .format(suffix))
2294
2240
        except IndexError as e:
2295
2241
            raise ValueError(*(e.args))
2296
2242
        timevalue += delta
2312
2258
        # Close all standard open file descriptors
2313
2259
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2314
2260
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2315
 
            raise OSError(errno.ENODEV,
2316
 
                          "{} not a character device"
 
2261
            raise OSError(errno.ENODEV, "{} not a character device"
2317
2262
                          .format(os.devnull))
2318
2263
        os.dup2(null, sys.stdin.fileno())
2319
2264
        os.dup2(null, sys.stdout.fileno())
2385
2330
                        "port": "",
2386
2331
                        "debug": "False",
2387
2332
                        "priority":
2388
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2389
 
                        ":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
 
2333
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2390
2334
                        "servicename": "Mandos",
2391
2335
                        "use_dbus": "True",
2392
2336
                        "use_ipv6": "True",
2396
2340
                        "statedir": "/var/lib/mandos",
2397
2341
                        "foreground": "False",
2398
2342
                        "zeroconf": "True",
2399
 
                    }
 
2343
                        }
2400
2344
    
2401
2345
    # Parse config file for server-global settings
2402
2346
    server_config = configparser.SafeConfigParser(server_defaults)
2403
2347
    del server_defaults
2404
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
2348
    server_config.read(os.path.join(options.configdir,
 
2349
                                    "mandos.conf"))
2405
2350
    # Convert the SafeConfigParser object to a dict
2406
2351
    server_settings = server_config.defaults()
2407
2352
    # Use the appropriate methods on the non-string config options
2425
2370
    # Override the settings from the config file with command line
2426
2371
    # options, if set.
2427
2372
    for option in ("interface", "address", "port", "debug",
2428
 
                   "priority", "servicename", "configdir", "use_dbus",
2429
 
                   "use_ipv6", "debuglevel", "restore", "statedir",
2430
 
                   "socket", "foreground", "zeroconf"):
 
2373
                   "priority", "servicename", "configdir",
 
2374
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2375
                   "statedir", "socket", "foreground", "zeroconf"):
2431
2376
        value = getattr(options, option)
2432
2377
        if value is not None:
2433
2378
            server_settings[option] = value
2448
2393
    
2449
2394
    ##################################################################
2450
2395
    
2451
 
    if (not server_settings["zeroconf"]
2452
 
        and not (server_settings["port"]
2453
 
                 or server_settings["socket"] != "")):
2454
 
        parser.error("Needs port or socket to work without Zeroconf")
 
2396
    if (not server_settings["zeroconf"] and
 
2397
        not (server_settings["port"]
 
2398
             or server_settings["socket"] != "")):
 
2399
            parser.error("Needs port or socket to work without"
 
2400
                         " Zeroconf")
2455
2401
    
2456
2402
    # For convenience
2457
2403
    debug = server_settings["debug"]
2473
2419
            initlogger(debug, level)
2474
2420
    
2475
2421
    if server_settings["servicename"] != "Mandos":
2476
 
        syslogger.setFormatter(
2477
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
2478
 
                              ' %(levelname)s: %(message)s'.format(
2479
 
                                  server_settings["servicename"])))
 
2422
        syslogger.setFormatter(logging.Formatter
 
2423
                               ('Mandos ({}) [%(process)d]:'
 
2424
                                ' %(levelname)s: %(message)s'
 
2425
                                .format(server_settings
 
2426
                                        ["servicename"])))
2480
2427
    
2481
2428
    # Parse config file with clients
2482
2429
    client_config = configparser.SafeConfigParser(Client
2490
2437
    socketfd = None
2491
2438
    if server_settings["socket"] != "":
2492
2439
        socketfd = server_settings["socket"]
2493
 
    tcp_server = MandosServer(
2494
 
        (server_settings["address"], server_settings["port"]),
2495
 
        ClientHandler,
2496
 
        interface=(server_settings["interface"] or None),
2497
 
        use_ipv6=use_ipv6,
2498
 
        gnutls_priority=server_settings["priority"],
2499
 
        use_dbus=use_dbus,
2500
 
        socketfd=socketfd)
 
2440
    tcp_server = MandosServer((server_settings["address"],
 
2441
                               server_settings["port"]),
 
2442
                              ClientHandler,
 
2443
                              interface=(server_settings["interface"]
 
2444
                                         or None),
 
2445
                              use_ipv6=use_ipv6,
 
2446
                              gnutls_priority=
 
2447
                              server_settings["priority"],
 
2448
                              use_dbus=use_dbus,
 
2449
                              socketfd=socketfd)
2501
2450
    if not foreground:
2502
2451
        pidfilename = "/run/mandos.pid"
2503
2452
        if not os.path.isdir("/run/."):
2504
2453
            pidfilename = "/var/run/mandos.pid"
2505
2454
        pidfile = None
2506
2455
        try:
2507
 
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
 
2456
            pidfile = open(pidfilename, "w")
2508
2457
        except IOError as e:
2509
2458
            logger.error("Could not open file %r", pidfilename,
2510
2459
                         exc_info=e)
2537
2486
        def debug_gnutls(level, string):
2538
2487
            logger.debug("GnuTLS: %s", string[:-1])
2539
2488
        
2540
 
        gnutls.library.functions.gnutls_global_set_log_function(
2541
 
            debug_gnutls)
 
2489
        (gnutls.library.functions
 
2490
         .gnutls_global_set_log_function(debug_gnutls))
2542
2491
        
2543
2492
        # Redirect stdin so all checkers get /dev/null
2544
2493
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2564
2513
    if use_dbus:
2565
2514
        try:
2566
2515
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2567
 
                                            bus,
2568
 
                                            do_not_queue=True)
2569
 
            old_bus_name = dbus.service.BusName(
2570
 
                "se.bsnet.fukt.Mandos", bus,
2571
 
                do_not_queue=True)
2572
 
        except dbus.exceptions.DBusException as e:
 
2516
                                            bus, do_not_queue=True)
 
2517
            old_bus_name = (dbus.service.BusName
 
2518
                            ("se.bsnet.fukt.Mandos", bus,
 
2519
                             do_not_queue=True))
 
2520
        except dbus.exceptions.NameExistsException as e:
2573
2521
            logger.error("Disabling D-Bus:", exc_info=e)
2574
2522
            use_dbus = False
2575
2523
            server_settings["use_dbus"] = False
2576
2524
            tcp_server.use_dbus = False
2577
2525
    if zeroconf:
2578
2526
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2579
 
        service = AvahiServiceToSyslog(
2580
 
            name = server_settings["servicename"],
2581
 
            servicetype = "_mandos._tcp",
2582
 
            protocol = protocol,
2583
 
            bus = bus)
 
2527
        service = AvahiServiceToSyslog(name =
 
2528
                                       server_settings["servicename"],
 
2529
                                       servicetype = "_mandos._tcp",
 
2530
                                       protocol = protocol, bus = bus)
2584
2531
        if server_settings["interface"]:
2585
 
            service.interface = if_nametoindex(
2586
 
                server_settings["interface"].encode("utf-8"))
 
2532
            service.interface = (if_nametoindex
 
2533
                                 (server_settings["interface"]
 
2534
                                  .encode("utf-8")))
2587
2535
    
2588
2536
    global multiprocessing_manager
2589
2537
    multiprocessing_manager = multiprocessing.Manager()
2608
2556
    if server_settings["restore"]:
2609
2557
        try:
2610
2558
            with open(stored_state_path, "rb") as stored_state:
2611
 
                clients_data, old_client_settings = pickle.load(
2612
 
                    stored_state)
 
2559
                clients_data, old_client_settings = (pickle.load
 
2560
                                                     (stored_state))
2613
2561
            os.remove(stored_state_path)
2614
2562
        except IOError as e:
2615
2563
            if e.errno == errno.ENOENT:
2616
 
                logger.warning("Could not load persistent state:"
2617
 
                               " {}".format(os.strerror(e.errno)))
 
2564
                logger.warning("Could not load persistent state: {}"
 
2565
                                .format(os.strerror(e.errno)))
2618
2566
            else:
2619
2567
                logger.critical("Could not load persistent state:",
2620
2568
                                exc_info=e)
2621
2569
                raise
2622
2570
        except EOFError as e:
2623
2571
            logger.warning("Could not load persistent state: "
2624
 
                           "EOFError:",
2625
 
                           exc_info=e)
 
2572
                           "EOFError:", exc_info=e)
2626
2573
    
2627
2574
    with PGPEngine() as pgp:
2628
2575
        for client_name, client in clients_data.items():
2640
2587
                    # For each value in new config, check if it
2641
2588
                    # differs from the old config value (Except for
2642
2589
                    # the "secret" attribute)
2643
 
                    if (name != "secret"
2644
 
                        and (value !=
2645
 
                             old_client_settings[client_name][name])):
 
2590
                    if (name != "secret" and
 
2591
                        value != old_client_settings[client_name]
 
2592
                        [name]):
2646
2593
                        client[name] = value
2647
2594
                except KeyError:
2648
2595
                    pass
2649
2596
            
2650
2597
            # Clients who has passed its expire date can still be
2651
 
            # enabled if its last checker was successful.  A Client
 
2598
            # enabled if its last checker was successful.  Clients
2652
2599
            # whose checker succeeded before we stored its state is
2653
2600
            # assumed to have successfully run all checkers during
2654
2601
            # downtime.
2657
2604
                    if not client["last_checked_ok"]:
2658
2605
                        logger.warning(
2659
2606
                            "disabling client {} - Client never "
2660
 
                            "performed a successful checker".format(
2661
 
                                client_name))
 
2607
                            "performed a successful checker"
 
2608
                            .format(client_name))
2662
2609
                        client["enabled"] = False
2663
2610
                    elif client["last_checker_status"] != 0:
2664
2611
                        logger.warning(
2665
2612
                            "disabling client {} - Client last"
2666
 
                            " checker failed with error code"
2667
 
                            " {}".format(
2668
 
                                client_name,
2669
 
                                client["last_checker_status"]))
 
2613
                            " checker failed with error code {}"
 
2614
                            .format(client_name,
 
2615
                                    client["last_checker_status"]))
2670
2616
                        client["enabled"] = False
2671
2617
                    else:
2672
 
                        client["expires"] = (
2673
 
                            datetime.datetime.utcnow()
2674
 
                            + client["timeout"])
 
2618
                        client["expires"] = (datetime.datetime
 
2619
                                             .utcnow()
 
2620
                                             + client["timeout"])
2675
2621
                        logger.debug("Last checker succeeded,"
2676
 
                                     " keeping {} enabled".format(
2677
 
                                         client_name))
 
2622
                                     " keeping {} enabled"
 
2623
                                     .format(client_name))
2678
2624
            try:
2679
 
                client["secret"] = pgp.decrypt(
2680
 
                    client["encrypted_secret"],
2681
 
                    client_settings[client_name]["secret"])
 
2625
                client["secret"] = (
 
2626
                    pgp.decrypt(client["encrypted_secret"],
 
2627
                                client_settings[client_name]
 
2628
                                ["secret"]))
2682
2629
            except PGPError:
2683
2630
                # If decryption fails, we use secret from new settings
2684
 
                logger.debug("Failed to decrypt {} old secret".format(
2685
 
                    client_name))
2686
 
                client["secret"] = (client_settings[client_name]
2687
 
                                    ["secret"])
 
2631
                logger.debug("Failed to decrypt {} old secret"
 
2632
                             .format(client_name))
 
2633
                client["secret"] = (
 
2634
                    client_settings[client_name]["secret"])
2688
2635
    
2689
2636
    # Add/remove clients based on new changes made to config
2690
2637
    for client_name in (set(old_client_settings)
2697
2644
    # Create all client objects
2698
2645
    for client_name, client in clients_data.items():
2699
2646
        tcp_server.clients[client_name] = client_class(
2700
 
            name = client_name,
2701
 
            settings = client,
 
2647
            name = client_name, settings = client,
2702
2648
            server_settings = server_settings)
2703
2649
    
2704
2650
    if not tcp_server.clients:
2706
2652
    
2707
2653
    if not foreground:
2708
2654
        if pidfile is not None:
2709
 
            pid = os.getpid()
2710
2655
            try:
2711
2656
                with pidfile:
2712
 
                    print(pid, file=pidfile)
 
2657
                    pid = os.getpid()
 
2658
                    pidfile.write("{}\n".format(pid).encode("utf-8"))
2713
2659
            except IOError:
2714
2660
                logger.error("Could not write to file %r with PID %d",
2715
2661
                             pidfilename, pid)
2720
2666
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2721
2667
    
2722
2668
    if use_dbus:
2723
 
        
2724
 
        @alternate_dbus_interfaces(
2725
 
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
 
2669
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2670
                                        "se.bsnet.fukt.Mandos"})
2726
2671
        class MandosDBusService(DBusObjectWithProperties):
2727
2672
            """A D-Bus proxy object"""
2728
 
            
2729
2673
            def __init__(self):
2730
2674
                dbus.service.Object.__init__(self, bus, "/")
2731
 
            
2732
2675
            _interface = "se.recompile.Mandos"
2733
2676
            
2734
2677
            @dbus_interface_annotations(_interface)
2735
2678
            def _foo(self):
2736
 
                return {
2737
 
                    "org.freedesktop.DBus.Property.EmitsChangedSignal":
2738
 
                    "false" }
 
2679
                return { "org.freedesktop.DBus.Property"
 
2680
                         ".EmitsChangedSignal":
 
2681
                             "false"}
2739
2682
            
2740
2683
            @dbus.service.signal(_interface, signature="o")
2741
2684
            def ClientAdded(self, objpath):
2755
2698
            @dbus.service.method(_interface, out_signature="ao")
2756
2699
            def GetAllClients(self):
2757
2700
                "D-Bus method"
2758
 
                return dbus.Array(c.dbus_object_path for c in
 
2701
                return dbus.Array(c.dbus_object_path
 
2702
                                  for c in
2759
2703
                                  tcp_server.clients.itervalues())
2760
2704
            
2761
2705
            @dbus.service.method(_interface,
2763
2707
            def GetAllClientsWithProperties(self):
2764
2708
                "D-Bus method"
2765
2709
                return dbus.Dictionary(
2766
 
                    { c.dbus_object_path: c.GetAll("")
2767
 
                      for c in tcp_server.clients.itervalues() },
 
2710
                    ((c.dbus_object_path, c.GetAll(""))
 
2711
                     for c in tcp_server.clients.itervalues()),
2768
2712
                    signature="oa{sv}")
2769
2713
            
2770
2714
            @dbus.service.method(_interface, in_signature="o")
2810
2754
                # + secret.
2811
2755
                exclude = { "bus", "changedstate", "secret",
2812
2756
                            "checker", "server_settings" }
2813
 
                for name, typ in inspect.getmembers(dbus.service
2814
 
                                                    .Object):
 
2757
                for name, typ in (inspect.getmembers
 
2758
                                  (dbus.service.Object)):
2815
2759
                    exclude.add(name)
2816
2760
                
2817
2761
                client_dict["encrypted_secret"] = (client
2824
2768
                del client_settings[client.name]["secret"]
2825
2769
        
2826
2770
        try:
2827
 
            with tempfile.NamedTemporaryFile(
2828
 
                    mode='wb',
2829
 
                    suffix=".pickle",
2830
 
                    prefix='clients-',
2831
 
                    dir=os.path.dirname(stored_state_path),
2832
 
                    delete=False) as stored_state:
 
2771
            with (tempfile.NamedTemporaryFile
 
2772
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2773
                   dir=os.path.dirname(stored_state_path),
 
2774
                   delete=False)) as stored_state:
2833
2775
                pickle.dump((clients, client_settings), stored_state)
2834
 
                tempname = stored_state.name
 
2776
                tempname=stored_state.name
2835
2777
            os.rename(tempname, stored_state_path)
2836
2778
        except (IOError, OSError) as e:
2837
2779
            if not debug:
2856
2798
            client.disable(quiet=True)
2857
2799
            if use_dbus:
2858
2800
                # Emit D-Bus signal
2859
 
                mandos_dbus_service.ClientRemoved(
2860
 
                    client.dbus_object_path, client.name)
 
2801
                mandos_dbus_service.ClientRemoved(client
 
2802
                                                  .dbus_object_path,
 
2803
                                                  client.name)
2861
2804
        client_settings.clear()
2862
2805
    
2863
2806
    atexit.register(cleanup)
2916
2859
    # Must run before the D-Bus bus name gets deregistered
2917
2860
    cleanup()
2918
2861
 
2919
 
 
2920
2862
if __name__ == '__main__':
2921
2863
    main()