/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2014-08-09 13:12:55 UTC
  • Revision ID: teddy@recompile.se-20140809131255-lp31j98u2pl0xpe6
mandos: Stop using str() and remove unnecessary unicode() calls.

* mandos (if_nametoindex): Use "bytes" literal instead of str().
  (initlogger): Use a unicode string for log device.
  (AvahiError.__unicode__): Removed.
  (DBusPropertyException.__unicode__): - '' -
  (ClientDBus.Secret_dbus_property): Use bytes() instead of str().
  (IPv6_TCPServer.server_bind): Use .encode() instead of str().
  (string_to_delta): Removed unnecessary unicode() call.
  (main): Use "isinstance(x, bytes)" instead of "type(x) is str", use
          .decode() instead of unicode(), and use .encode() instead of
          str().

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2015 Teddy Hogeborn
15
 
# Copyright © 2008-2015 Björn Påhlsson
 
14
# Copyright © 2008-2014 Teddy Hogeborn
 
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
 
37
37
from future_builtins import *
38
38
 
39
 
try:
40
 
    import SocketServer as socketserver
41
 
except ImportError:
42
 
    import socketserver
 
39
import SocketServer as socketserver
43
40
import socket
44
41
import argparse
45
42
import datetime
50
47
import gnutls.library.functions
51
48
import gnutls.library.constants
52
49
import gnutls.library.types
53
 
try:
54
 
    import ConfigParser as configparser
55
 
except ImportError:
56
 
    import configparser
 
50
import ConfigParser as configparser
57
51
import sys
58
52
import re
59
53
import os
68
62
import struct
69
63
import fcntl
70
64
import functools
71
 
try:
72
 
    import cPickle as pickle
73
 
except ImportError:
74
 
    import pickle
 
65
import cPickle as pickle
75
66
import multiprocessing
76
67
import types
77
68
import binascii
78
69
import tempfile
79
70
import itertools
80
71
import collections
81
 
import codecs
82
72
 
83
73
import dbus
84
74
import dbus.service
85
 
try:
86
 
    import gobject
87
 
except ImportError:
88
 
    from gi.repository import GObject as gobject
 
75
import gobject
89
76
import avahi
90
77
from dbus.mainloop.glib import DBusGMainLoop
91
78
import ctypes
101
88
    except ImportError:
102
89
        SO_BINDTODEVICE = None
103
90
 
104
 
if sys.version_info.major == 2:
105
 
    str = unicode
106
 
 
107
 
version = "1.6.9"
 
91
version = "1.6.8"
108
92
stored_state_file = "clients.pickle"
109
93
 
110
94
logger = logging.getLogger()
111
95
syslogger = None
112
96
 
113
97
try:
114
 
    if_nametoindex = ctypes.cdll.LoadLibrary(
115
 
        ctypes.util.find_library("c")).if_nametoindex
 
98
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
99
                      (ctypes.util.find_library("c"))
 
100
                      .if_nametoindex)
116
101
except (OSError, AttributeError):
117
 
    
118
102
    def if_nametoindex(interface):
119
103
        "Get an interface index the hard way, i.e. using fcntl()"
120
104
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
129
113
    """init logger and add loglevel"""
130
114
    
131
115
    global syslogger
132
 
    syslogger = (logging.handlers.SysLogHandler(
133
 
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
 
        address = "/dev/log"))
 
116
    syslogger = (logging.handlers.SysLogHandler
 
117
                 (facility =
 
118
                  logging.handlers.SysLogHandler.LOG_DAEMON,
 
119
                  address = "/dev/log"))
135
120
    syslogger.setFormatter(logging.Formatter
136
121
                           ('Mandos [%(process)d]: %(levelname)s:'
137
122
                            ' %(message)s'))
154
139
 
155
140
class PGPEngine(object):
156
141
    """A simple class for OpenPGP symmetric encryption & decryption"""
157
 
    
158
142
    def __init__(self):
159
143
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
144
        self.gnupgargs = ['--batch',
199
183
    
200
184
    def encrypt(self, data, password):
201
185
        passphrase = self.password_encode(password)
202
 
        with tempfile.NamedTemporaryFile(
203
 
                dir=self.tempdir) as passfile:
 
186
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
187
                                         ) as passfile:
204
188
            passfile.write(passphrase)
205
189
            passfile.flush()
206
190
            proc = subprocess.Popen(['gpg', '--symmetric',
217
201
    
218
202
    def decrypt(self, data, password):
219
203
        passphrase = self.password_encode(password)
220
 
        with tempfile.NamedTemporaryFile(
221
 
                dir = self.tempdir) as passfile:
 
204
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
205
                                         ) as passfile:
222
206
            passfile.write(passphrase)
223
207
            passfile.flush()
224
208
            proc = subprocess.Popen(['gpg', '--decrypt',
228
212
                                    stdin = subprocess.PIPE,
229
213
                                    stdout = subprocess.PIPE,
230
214
                                    stderr = subprocess.PIPE)
231
 
            decrypted_plaintext, err = proc.communicate(input = data)
 
215
            decrypted_plaintext, err = proc.communicate(input
 
216
                                                        = data)
232
217
        if proc.returncode != 0:
233
218
            raise PGPError(err)
234
219
        return decrypted_plaintext
240
225
        return super(AvahiError, self).__init__(value, *args,
241
226
                                                **kwargs)
242
227
 
243
 
 
244
228
class AvahiServiceError(AvahiError):
245
229
    pass
246
230
 
247
 
 
248
231
class AvahiGroupError(AvahiError):
249
232
    pass
250
233
 
270
253
    bus: dbus.SystemBus()
271
254
    """
272
255
    
273
 
    def __init__(self,
274
 
                 interface = avahi.IF_UNSPEC,
275
 
                 name = None,
276
 
                 servicetype = None,
277
 
                 port = None,
278
 
                 TXT = None,
279
 
                 domain = "",
280
 
                 host = "",
281
 
                 max_renames = 32768,
282
 
                 protocol = avahi.PROTO_UNSPEC,
283
 
                 bus = None):
 
256
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
257
                 servicetype = None, port = None, TXT = None,
 
258
                 domain = "", host = "", max_renames = 32768,
 
259
                 protocol = avahi.PROTO_UNSPEC, bus = None):
284
260
        self.interface = interface
285
261
        self.name = name
286
262
        self.type = servicetype
296
272
        self.bus = bus
297
273
        self.entry_group_state_changed_match = None
298
274
    
299
 
    def rename(self, remove=True):
 
275
    def rename(self):
300
276
        """Derived from the Avahi example code"""
301
277
        if self.rename_count >= self.max_renames:
302
278
            logger.critical("No suitable Zeroconf service name found"
303
279
                            " after %i retries, exiting.",
304
280
                            self.rename_count)
305
281
            raise AvahiServiceError("Too many renames")
306
 
        self.name = str(
307
 
            self.server.GetAlternativeServiceName(self.name))
308
 
        self.rename_count += 1
 
282
        self.name = unicode(self.server
 
283
                            .GetAlternativeServiceName(self.name))
309
284
        logger.info("Changing Zeroconf service name to %r ...",
310
285
                    self.name)
311
 
        if remove:
312
 
            self.remove()
 
286
        self.remove()
313
287
        try:
314
288
            self.add()
315
289
        except dbus.exceptions.DBusException as error:
316
 
            if (error.get_dbus_name()
317
 
                == "org.freedesktop.Avahi.CollisionError"):
318
 
                logger.info("Local Zeroconf service name collision.")
319
 
                return self.rename(remove=False)
320
 
            else:
321
 
                logger.critical("D-Bus Exception", exc_info=error)
322
 
                self.cleanup()
323
 
                os._exit(1)
 
290
            logger.critical("D-Bus Exception", exc_info=error)
 
291
            self.cleanup()
 
292
            os._exit(1)
 
293
        self.rename_count += 1
324
294
    
325
295
    def remove(self):
326
296
        """Derived from the Avahi example code"""
364
334
            self.rename()
365
335
        elif state == avahi.ENTRY_GROUP_FAILURE:
366
336
            logger.critical("Avahi: Error in group state changed %s",
367
 
                            str(error))
368
 
            raise AvahiGroupError("State changed: {!s}".format(error))
 
337
                            unicode(error))
 
338
            raise AvahiGroupError("State changed: {!s}"
 
339
                                  .format(error))
369
340
    
370
341
    def cleanup(self):
371
342
        """Derived from the Avahi example code"""
381
352
    def server_state_changed(self, state, error=None):
382
353
        """Derived from the Avahi example code"""
383
354
        logger.debug("Avahi server state change: %i", state)
384
 
        bad_states = {
385
 
            avahi.SERVER_INVALID: "Zeroconf server invalid",
386
 
            avahi.SERVER_REGISTERING: None,
387
 
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
 
            avahi.SERVER_FAILURE: "Zeroconf server failure",
389
 
        }
 
355
        bad_states = { avahi.SERVER_INVALID:
 
356
                           "Zeroconf server invalid",
 
357
                       avahi.SERVER_REGISTERING: None,
 
358
                       avahi.SERVER_COLLISION:
 
359
                           "Zeroconf server name collision",
 
360
                       avahi.SERVER_FAILURE:
 
361
                           "Zeroconf server failure" }
390
362
        if state in bad_states:
391
363
            if bad_states[state] is not None:
392
364
                if error is None:
395
367
                    logger.error(bad_states[state] + ": %r", error)
396
368
            self.cleanup()
397
369
        elif state == avahi.SERVER_RUNNING:
398
 
            try:
399
 
                self.add()
400
 
            except dbus.exceptions.DBusException as error:
401
 
                if (error.get_dbus_name()
402
 
                    == "org.freedesktop.Avahi.CollisionError"):
403
 
                    logger.info("Local Zeroconf service name"
404
 
                                " collision.")
405
 
                    return self.rename(remove=False)
406
 
                else:
407
 
                    logger.critical("D-Bus Exception", exc_info=error)
408
 
                    self.cleanup()
409
 
                    os._exit(1)
 
370
            self.add()
410
371
        else:
411
372
            if error is None:
412
373
                logger.debug("Unknown state: %r", state)
422
383
                                    follow_name_owner_changes=True),
423
384
                avahi.DBUS_INTERFACE_SERVER)
424
385
        self.server.connect_to_signal("StateChanged",
425
 
                                      self.server_state_changed)
 
386
                                 self.server_state_changed)
426
387
        self.server_state_changed(self.server.GetState())
427
388
 
428
389
 
429
390
class AvahiServiceToSyslog(AvahiService):
430
 
    def rename(self, *args, **kwargs):
 
391
    def rename(self):
431
392
        """Add the new name to the syslog messages"""
432
 
        ret = AvahiService.rename(self, *args, **kwargs)
433
 
        syslogger.setFormatter(logging.Formatter(
434
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
 
            .format(self.name)))
 
393
        ret = AvahiService.rename(self)
 
394
        syslogger.setFormatter(logging.Formatter
 
395
                               ('Mandos ({}) [%(process)d]:'
 
396
                                ' %(levelname)s: %(message)s'
 
397
                                .format(self.name)))
436
398
        return ret
437
399
 
438
 
def call_pipe(connection,       # : multiprocessing.Connection
439
 
              func, *args, **kwargs):
440
 
    """This function is meant to be called by multiprocessing.Process
441
 
    
442
 
    This function runs func(*args, **kwargs), and writes the resulting
443
 
    return value on the provided multiprocessing.Connection.
444
 
    """
445
 
    connection.send(func(*args, **kwargs))
446
 
    connection.close()
447
400
 
448
401
class Client(object):
449
402
    """A representation of a client host served by this server.
476
429
    last_checker_status: integer between 0 and 255 reflecting exit
477
430
                         status of last checker. -1 reflects crashed
478
431
                         checker, -2 means no checker completed yet.
479
 
    last_checker_signal: The signal which killed the last checker, if
480
 
                         last_checker_status is -1
481
432
    last_enabled: datetime.datetime(); (UTC) or None
482
433
    name:       string; from the config file, used in log messages and
483
434
                        D-Bus identifiers
496
447
                          "fingerprint", "host", "interval",
497
448
                          "last_approval_request", "last_checked_ok",
498
449
                          "last_enabled", "name", "timeout")
499
 
    client_defaults = {
500
 
        "timeout": "PT5M",
501
 
        "extended_timeout": "PT15M",
502
 
        "interval": "PT2M",
503
 
        "checker": "fping -q -- %%(host)s",
504
 
        "host": "",
505
 
        "approval_delay": "PT0S",
506
 
        "approval_duration": "PT1S",
507
 
        "approved_by_default": "True",
508
 
        "enabled": "True",
509
 
    }
 
450
    client_defaults = { "timeout": "PT5M",
 
451
                        "extended_timeout": "PT15M",
 
452
                        "interval": "PT2M",
 
453
                        "checker": "fping -q -- %%(host)s",
 
454
                        "host": "",
 
455
                        "approval_delay": "PT0S",
 
456
                        "approval_duration": "PT1S",
 
457
                        "approved_by_default": "True",
 
458
                        "enabled": "True",
 
459
                        }
510
460
    
511
461
    @staticmethod
512
462
    def config_parser(config):
528
478
            client["enabled"] = config.getboolean(client_name,
529
479
                                                  "enabled")
530
480
            
531
 
            # Uppercase and remove spaces from fingerprint for later
532
 
            # comparison purposes with return value from the
533
 
            # fingerprint() function
534
481
            client["fingerprint"] = (section["fingerprint"].upper()
535
482
                                     .replace(" ", ""))
536
483
            if "secret" in section:
578
525
            self.expires = None
579
526
        
580
527
        logger.debug("Creating client %r", self.name)
 
528
        # Uppercase and remove spaces from fingerprint for later
 
529
        # comparison purposes with return value from the fingerprint()
 
530
        # function
581
531
        logger.debug("  Fingerprint: %s", self.fingerprint)
582
532
        self.created = settings.get("created",
583
533
                                    datetime.datetime.utcnow())
590
540
        self.current_checker_command = None
591
541
        self.approved = None
592
542
        self.approvals_pending = 0
593
 
        self.changedstate = multiprocessing_manager.Condition(
594
 
            multiprocessing_manager.Lock())
595
 
        self.client_structure = [attr
596
 
                                 for attr in self.__dict__.iterkeys()
 
543
        self.changedstate = (multiprocessing_manager
 
544
                             .Condition(multiprocessing_manager
 
545
                                        .Lock()))
 
546
        self.client_structure = [attr for attr in
 
547
                                 self.__dict__.iterkeys()
597
548
                                 if not attr.startswith("_")]
598
549
        self.client_structure.append("client_structure")
599
550
        
600
 
        for name, t in inspect.getmembers(
601
 
                type(self), lambda obj: isinstance(obj, property)):
 
551
        for name, t in inspect.getmembers(type(self),
 
552
                                          lambda obj:
 
553
                                              isinstance(obj,
 
554
                                                         property)):
602
555
            if not name.startswith("_"):
603
556
                self.client_structure.append(name)
604
557
    
646
599
        # and every interval from then on.
647
600
        if self.checker_initiator_tag is not None:
648
601
            gobject.source_remove(self.checker_initiator_tag)
649
 
        self.checker_initiator_tag = gobject.timeout_add(
650
 
            int(self.interval.total_seconds() * 1000),
651
 
            self.start_checker)
 
602
        self.checker_initiator_tag = (gobject.timeout_add
 
603
                                      (int(self.interval
 
604
                                           .total_seconds() * 1000),
 
605
                                       self.start_checker))
652
606
        # Schedule a disable() when 'timeout' has passed
653
607
        if self.disable_initiator_tag is not None:
654
608
            gobject.source_remove(self.disable_initiator_tag)
655
 
        self.disable_initiator_tag = gobject.timeout_add(
656
 
            int(self.timeout.total_seconds() * 1000), self.disable)
 
609
        self.disable_initiator_tag = (gobject.timeout_add
 
610
                                      (int(self.timeout
 
611
                                           .total_seconds() * 1000),
 
612
                                       self.disable))
657
613
        # Also start a new checker *right now*.
658
614
        self.start_checker()
659
615
    
660
 
    def checker_callback(self, source, condition, connection,
661
 
                         command):
 
616
    def checker_callback(self, pid, condition, command):
662
617
        """The checker has completed, so take appropriate actions."""
663
618
        self.checker_callback_tag = None
664
619
        self.checker = None
665
 
        # Read return code from connection (see call_pipe)
666
 
        returncode = connection.recv()
667
 
        connection.close()
668
 
        
669
 
        if returncode >= 0:
670
 
            self.last_checker_status = returncode
671
 
            self.last_checker_signal = None
 
620
        if os.WIFEXITED(condition):
 
621
            self.last_checker_status = os.WEXITSTATUS(condition)
672
622
            if self.last_checker_status == 0:
673
623
                logger.info("Checker for %(name)s succeeded",
674
624
                            vars(self))
675
625
                self.checked_ok()
676
626
            else:
677
 
                logger.info("Checker for %(name)s failed", vars(self))
 
627
                logger.info("Checker for %(name)s failed",
 
628
                            vars(self))
678
629
        else:
679
630
            self.last_checker_status = -1
680
 
            self.last_checker_signal = -returncode
681
631
            logger.warning("Checker for %(name)s crashed?",
682
632
                           vars(self))
683
 
        return False
684
633
    
685
634
    def checked_ok(self):
686
635
        """Assert that the client has been seen, alive and well."""
687
636
        self.last_checked_ok = datetime.datetime.utcnow()
688
637
        self.last_checker_status = 0
689
 
        self.last_checker_signal = None
690
638
        self.bump_timeout()
691
639
    
692
640
    def bump_timeout(self, timeout=None):
697
645
            gobject.source_remove(self.disable_initiator_tag)
698
646
            self.disable_initiator_tag = None
699
647
        if getattr(self, "enabled", False):
700
 
            self.disable_initiator_tag = gobject.timeout_add(
701
 
                int(timeout.total_seconds() * 1000), self.disable)
 
648
            self.disable_initiator_tag = (gobject.timeout_add
 
649
                                          (int(timeout.total_seconds()
 
650
                                               * 1000), self.disable))
702
651
            self.expires = datetime.datetime.utcnow() + timeout
703
652
    
704
653
    def need_approval(self):
718
667
        # than 'timeout' for the client to be disabled, which is as it
719
668
        # should be.
720
669
        
721
 
        if self.checker is not None and not self.checker.is_alive():
722
 
            logger.warning("Checker was not alive; joining")
723
 
            self.checker.join()
724
 
            self.checker = None
 
670
        # If a checker exists, make sure it is not a zombie
 
671
        try:
 
672
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
673
        except AttributeError:
 
674
            pass
 
675
        except OSError as error:
 
676
            if error.errno != errno.ECHILD:
 
677
                raise
 
678
        else:
 
679
            if pid:
 
680
                logger.warning("Checker was a zombie")
 
681
                gobject.source_remove(self.checker_callback_tag)
 
682
                self.checker_callback(pid, status,
 
683
                                      self.current_checker_command)
725
684
        # Start a new checker if needed
726
685
        if self.checker is None:
727
686
            # Escape attributes for the shell
728
 
            escaped_attrs = {
729
 
                attr: re.escape(str(getattr(self, attr)))
730
 
                for attr in self.runtime_expansions }
 
687
            escaped_attrs = { attr:
 
688
                                  re.escape(unicode(getattr(self,
 
689
                                                            attr)))
 
690
                              for attr in self.runtime_expansions }
731
691
            try:
732
692
                command = self.checker_command % escaped_attrs
733
693
            except TypeError as error:
734
694
                logger.error('Could not format string "%s"',
735
 
                             self.checker_command,
 
695
                             self.checker_command, exc_info=error)
 
696
                return True # Try again later
 
697
            self.current_checker_command = command
 
698
            try:
 
699
                logger.info("Starting checker %r for %s",
 
700
                            command, self.name)
 
701
                # We don't need to redirect stdout and stderr, since
 
702
                # in normal mode, that is already done by daemon(),
 
703
                # and in debug mode we don't want to.  (Stdin is
 
704
                # always replaced by /dev/null.)
 
705
                # The exception is when not debugging but nevertheless
 
706
                # running in the foreground; use the previously
 
707
                # created wnull.
 
708
                popen_args = {}
 
709
                if (not self.server_settings["debug"]
 
710
                    and self.server_settings["foreground"]):
 
711
                    popen_args.update({"stdout": wnull,
 
712
                                       "stderr": wnull })
 
713
                self.checker = subprocess.Popen(command,
 
714
                                                close_fds=True,
 
715
                                                shell=True, cwd="/",
 
716
                                                **popen_args)
 
717
            except OSError as error:
 
718
                logger.error("Failed to start subprocess",
736
719
                             exc_info=error)
737
 
                return True     # Try again later
738
 
            self.current_checker_command = command
739
 
            logger.info("Starting checker %r for %s", command,
740
 
                        self.name)
741
 
            # We don't need to redirect stdout and stderr, since
742
 
            # in normal mode, that is already done by daemon(),
743
 
            # and in debug mode we don't want to.  (Stdin is
744
 
            # always replaced by /dev/null.)
745
 
            # The exception is when not debugging but nevertheless
746
 
            # running in the foreground; use the previously
747
 
            # created wnull.
748
 
            popen_args = { "close_fds": True,
749
 
                           "shell": True,
750
 
                           "cwd": "/" }
751
 
            if (not self.server_settings["debug"]
752
 
                and self.server_settings["foreground"]):
753
 
                popen_args.update({"stdout": wnull,
754
 
                                   "stderr": wnull })
755
 
            pipe = multiprocessing.Pipe(duplex = False)
756
 
            self.checker = multiprocessing.Process(
757
 
                target = call_pipe,
758
 
                args = (pipe[1], subprocess.call, command),
759
 
                kwargs = popen_args)
760
 
            self.checker.start()
761
 
            self.checker_callback_tag = gobject.io_add_watch(
762
 
                pipe[0].fileno(), gobject.IO_IN,
763
 
                self.checker_callback, pipe[0], command)
 
720
                return True
 
721
            self.checker_callback_tag = (gobject.child_watch_add
 
722
                                         (self.checker.pid,
 
723
                                          self.checker_callback,
 
724
                                          data=command))
 
725
            # The checker may have completed before the gobject
 
726
            # watch was added.  Check for this.
 
727
            try:
 
728
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
729
            except OSError as error:
 
730
                if error.errno == errno.ECHILD:
 
731
                    # This should never happen
 
732
                    logger.error("Child process vanished",
 
733
                                 exc_info=error)
 
734
                    return True
 
735
                raise
 
736
            if pid:
 
737
                gobject.source_remove(self.checker_callback_tag)
 
738
                self.checker_callback(pid, status, command)
764
739
        # Re-run this periodically if run by gobject.timeout_add
765
740
        return True
766
741
    
772
747
        if getattr(self, "checker", None) is None:
773
748
            return
774
749
        logger.debug("Stopping checker for %(name)s", vars(self))
775
 
        self.checker.terminate()
 
750
        try:
 
751
            self.checker.terminate()
 
752
            #time.sleep(0.5)
 
753
            #if self.checker.poll() is None:
 
754
            #    self.checker.kill()
 
755
        except OSError as error:
 
756
            if error.errno != errno.ESRCH: # No such process
 
757
                raise
776
758
        self.checker = None
777
759
 
778
760
 
779
 
def dbus_service_property(dbus_interface,
780
 
                          signature="v",
781
 
                          access="readwrite",
782
 
                          byte_arrays=False):
 
761
def dbus_service_property(dbus_interface, signature="v",
 
762
                          access="readwrite", byte_arrays=False):
783
763
    """Decorators for marking methods of a DBusObjectWithProperties to
784
764
    become properties on the D-Bus.
785
765
    
795
775
    if byte_arrays and signature != "ay":
796
776
        raise ValueError("Byte arrays not supported for non-'ay'"
797
777
                         " signature {!r}".format(signature))
798
 
    
799
778
    def decorator(func):
800
779
        func._dbus_is_property = True
801
780
        func._dbus_interface = dbus_interface
806
785
            func._dbus_name = func._dbus_name[:-14]
807
786
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
808
787
        return func
809
 
    
810
788
    return decorator
811
789
 
812
790
 
821
799
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
822
800
                    "false"}
823
801
    """
824
 
    
825
802
    def decorator(func):
826
803
        func._dbus_is_interface = True
827
804
        func._dbus_interface = dbus_interface
828
805
        func._dbus_name = dbus_interface
829
806
        return func
830
 
    
831
807
    return decorator
832
808
 
833
809
 
835
811
    """Decorator to annotate D-Bus methods, signals or properties
836
812
    Usage:
837
813
    
838
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
 
                       "org.freedesktop.DBus.Property."
840
 
                       "EmitsChangedSignal": "false"})
841
814
    @dbus_service_property("org.example.Interface", signature="b",
842
815
                           access="r")
 
816
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
817
                        "org.freedesktop.DBus.Property."
 
818
                        "EmitsChangedSignal": "false"})
843
819
    def Property_dbus_property(self):
844
820
        return dbus.Boolean(False)
845
821
    """
846
 
    
847
822
    def decorator(func):
848
823
        func._dbus_annotations = annotations
849
824
        return func
850
 
    
851
825
    return decorator
852
826
 
853
827
 
856
830
    """
857
831
    pass
858
832
 
859
 
 
860
833
class DBusPropertyAccessException(DBusPropertyException):
861
834
    """A property's access permissions disallows an operation.
862
835
    """
890
863
    def _get_all_dbus_things(self, thing):
891
864
        """Returns a generator of (name, attribute) pairs
892
865
        """
893
 
        return ((getattr(athing.__get__(self), "_dbus_name", name),
 
866
        return ((getattr(athing.__get__(self), "_dbus_name",
 
867
                         name),
894
868
                 athing.__get__(self))
895
869
                for cls in self.__class__.__mro__
896
870
                for name, athing in
897
 
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
871
                inspect.getmembers(cls,
 
872
                                   self._is_dbus_thing(thing)))
898
873
    
899
874
    def _get_dbus_property(self, interface_name, property_name):
900
875
        """Returns a bound method if one exists which is a D-Bus
901
876
        property with the specified name and interface.
902
877
        """
903
 
        for cls in self.__class__.__mro__:
904
 
            for name, value in inspect.getmembers(
905
 
                    cls, self._is_dbus_thing("property")):
 
878
        for cls in  self.__class__.__mro__:
 
879
            for name, value in (inspect.getmembers
 
880
                                (cls,
 
881
                                 self._is_dbus_thing("property"))):
906
882
                if (value._dbus_name == property_name
907
883
                    and value._dbus_interface == interface_name):
908
884
                    return value.__get__(self)
909
885
        
910
886
        # No such property
911
 
        raise DBusPropertyNotFound("{}:{}.{}".format(
912
 
            self.dbus_object_path, interface_name, property_name))
 
887
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
888
                                   + interface_name + "."
 
889
                                   + property_name)
913
890
    
914
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
915
 
                         in_signature="ss",
 
891
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
916
892
                         out_signature="v")
917
893
    def Get(self, interface_name, property_name):
918
894
        """Standard D-Bus property Get() method, see D-Bus standard.
943
919
                                            for byte in value))
944
920
        prop(value)
945
921
    
946
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
947
 
                         in_signature="s",
 
922
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
948
923
                         out_signature="a{sv}")
949
924
    def GetAll(self, interface_name):
950
925
        """Standard D-Bus property GetAll() method, see D-Bus
965
940
            if not hasattr(value, "variant_level"):
966
941
                properties[name] = value
967
942
                continue
968
 
            properties[name] = type(value)(
969
 
                value, variant_level = value.variant_level + 1)
 
943
            properties[name] = type(value)(value, variant_level=
 
944
                                           value.variant_level+1)
970
945
        return dbus.Dictionary(properties, signature="sv")
971
946
    
972
 
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
 
    def PropertiesChanged(self, interface_name, changed_properties,
974
 
                          invalidated_properties):
975
 
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
976
 
        standard.
977
 
        """
978
 
        pass
979
 
    
980
947
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
981
948
                         out_signature="s",
982
949
                         path_keyword='object_path',
990
957
                                                   connection)
991
958
        try:
992
959
            document = xml.dom.minidom.parseString(xmlstring)
993
 
            
994
960
            def make_tag(document, name, prop):
995
961
                e = document.createElement("property")
996
962
                e.setAttribute("name", name)
997
963
                e.setAttribute("type", prop._dbus_signature)
998
964
                e.setAttribute("access", prop._dbus_access)
999
965
                return e
1000
 
            
1001
966
            for if_tag in document.getElementsByTagName("interface"):
1002
967
                # Add property tags
1003
968
                for tag in (make_tag(document, name, prop)
1015
980
                            if (name == tag.getAttribute("name")
1016
981
                                and prop._dbus_interface
1017
982
                                == if_tag.getAttribute("name")):
1018
 
                                annots.update(getattr(
1019
 
                                    prop, "_dbus_annotations", {}))
 
983
                                annots.update(getattr
 
984
                                              (prop,
 
985
                                               "_dbus_annotations",
 
986
                                               {}))
1020
987
                        for name, value in annots.items():
1021
988
                            ann_tag = document.createElement(
1022
989
                                "annotation")
1027
994
                for annotation, value in dict(
1028
995
                    itertools.chain.from_iterable(
1029
996
                        annotations().items()
1030
 
                        for name, annotations
1031
 
                        in self._get_all_dbus_things("interface")
 
997
                        for name, annotations in
 
998
                        self._get_all_dbus_things("interface")
1032
999
                        if name == if_tag.getAttribute("name")
1033
1000
                        )).items():
1034
1001
                    ann_tag = document.createElement("annotation")
1063
1030
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1064
1031
    if dt is None:
1065
1032
        return dbus.String("", variant_level = variant_level)
1066
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
 
1033
    return dbus.String(dt.isoformat(),
 
1034
                       variant_level=variant_level)
1067
1035
 
1068
1036
 
1069
1037
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1089
1057
    (from DBusObjectWithProperties) and interfaces (from the
1090
1058
    dbus_interface_annotations decorator).
1091
1059
    """
1092
 
    
1093
1060
    def wrapper(cls):
1094
1061
        for orig_interface_name, alt_interface_name in (
1095
 
                alt_interface_names.items()):
 
1062
            alt_interface_names.items()):
1096
1063
            attr = {}
1097
1064
            interface_names = set()
1098
1065
            # Go though all attributes of the class
1100
1067
                # Ignore non-D-Bus attributes, and D-Bus attributes
1101
1068
                # with the wrong interface name
1102
1069
                if (not hasattr(attribute, "_dbus_interface")
1103
 
                    or not attribute._dbus_interface.startswith(
1104
 
                        orig_interface_name)):
 
1070
                    or not attribute._dbus_interface
 
1071
                    .startswith(orig_interface_name)):
1105
1072
                    continue
1106
1073
                # Create an alternate D-Bus interface name based on
1107
1074
                # the current name
1108
 
                alt_interface = attribute._dbus_interface.replace(
1109
 
                    orig_interface_name, alt_interface_name)
 
1075
                alt_interface = (attribute._dbus_interface
 
1076
                                 .replace(orig_interface_name,
 
1077
                                          alt_interface_name))
1110
1078
                interface_names.add(alt_interface)
1111
1079
                # Is this a D-Bus signal?
1112
1080
                if getattr(attribute, "_dbus_is_signal", False):
1113
 
                    if sys.version_info.major == 2:
1114
 
                        # Extract the original non-method undecorated
1115
 
                        # function by black magic
1116
 
                        nonmethod_func = (dict(
 
1081
                    # Extract the original non-method undecorated
 
1082
                    # function by black magic
 
1083
                    nonmethod_func = (dict(
1117
1084
                            zip(attribute.func_code.co_freevars,
1118
 
                                attribute.__closure__))
1119
 
                                          ["func"].cell_contents)
1120
 
                    else:
1121
 
                        nonmethod_func = attribute
 
1085
                                attribute.__closure__))["func"]
 
1086
                                      .cell_contents)
1122
1087
                    # Create a new, but exactly alike, function
1123
1088
                    # object, and decorate it to be a new D-Bus signal
1124
1089
                    # with the alternate D-Bus interface name
1125
 
                    if sys.version_info.major == 2:
1126
 
                        new_function = types.FunctionType(
1127
 
                            nonmethod_func.func_code,
1128
 
                            nonmethod_func.func_globals,
1129
 
                            nonmethod_func.func_name,
1130
 
                            nonmethod_func.func_defaults,
1131
 
                            nonmethod_func.func_closure)
1132
 
                    else:
1133
 
                        new_function = types.FunctionType(
1134
 
                            nonmethod_func.__code__,
1135
 
                            nonmethod_func.__globals__,
1136
 
                            nonmethod_func.__name__,
1137
 
                            nonmethod_func.__defaults__,
1138
 
                            nonmethod_func.__closure__)
1139
 
                    new_function = (dbus.service.signal(
1140
 
                        alt_interface,
1141
 
                        attribute._dbus_signature)(new_function))
 
1090
                    new_function = (dbus.service.signal
 
1091
                                    (alt_interface,
 
1092
                                     attribute._dbus_signature)
 
1093
                                    (types.FunctionType(
 
1094
                                nonmethod_func.func_code,
 
1095
                                nonmethod_func.func_globals,
 
1096
                                nonmethod_func.func_name,
 
1097
                                nonmethod_func.func_defaults,
 
1098
                                nonmethod_func.func_closure)))
1142
1099
                    # Copy annotations, if any
1143
1100
                    try:
1144
 
                        new_function._dbus_annotations = dict(
1145
 
                            attribute._dbus_annotations)
 
1101
                        new_function._dbus_annotations = (
 
1102
                            dict(attribute._dbus_annotations))
1146
1103
                    except AttributeError:
1147
1104
                        pass
1148
1105
                    # Define a creator of a function to call both the
1153
1110
                        """This function is a scope container to pass
1154
1111
                        func1 and func2 to the "call_both" function
1155
1112
                        outside of its arguments"""
1156
 
                        
1157
1113
                        def call_both(*args, **kwargs):
1158
1114
                            """This function will emit two D-Bus
1159
1115
                            signals by calling func1 and func2"""
1160
1116
                            func1(*args, **kwargs)
1161
1117
                            func2(*args, **kwargs)
1162
 
                        
1163
1118
                        return call_both
1164
1119
                    # Create the "call_both" function and add it to
1165
1120
                    # the class
1170
1125
                    # object.  Decorate it to be a new D-Bus method
1171
1126
                    # with the alternate D-Bus interface name.  Add it
1172
1127
                    # to the class.
1173
 
                    attr[attrname] = (
1174
 
                        dbus.service.method(
1175
 
                            alt_interface,
1176
 
                            attribute._dbus_in_signature,
1177
 
                            attribute._dbus_out_signature)
1178
 
                        (types.FunctionType(attribute.func_code,
1179
 
                                            attribute.func_globals,
1180
 
                                            attribute.func_name,
1181
 
                                            attribute.func_defaults,
1182
 
                                            attribute.func_closure)))
 
1128
                    attr[attrname] = (dbus.service.method
 
1129
                                      (alt_interface,
 
1130
                                       attribute._dbus_in_signature,
 
1131
                                       attribute._dbus_out_signature)
 
1132
                                      (types.FunctionType
 
1133
                                       (attribute.func_code,
 
1134
                                        attribute.func_globals,
 
1135
                                        attribute.func_name,
 
1136
                                        attribute.func_defaults,
 
1137
                                        attribute.func_closure)))
1183
1138
                    # Copy annotations, if any
1184
1139
                    try:
1185
 
                        attr[attrname]._dbus_annotations = dict(
1186
 
                            attribute._dbus_annotations)
 
1140
                        attr[attrname]._dbus_annotations = (
 
1141
                            dict(attribute._dbus_annotations))
1187
1142
                    except AttributeError:
1188
1143
                        pass
1189
1144
                # Is this a D-Bus property?
1192
1147
                    # object, and decorate it to be a new D-Bus
1193
1148
                    # property with the alternate D-Bus interface
1194
1149
                    # name.  Add it to the class.
1195
 
                    attr[attrname] = (dbus_service_property(
1196
 
                        alt_interface, attribute._dbus_signature,
1197
 
                        attribute._dbus_access,
1198
 
                        attribute._dbus_get_args_options
1199
 
                        ["byte_arrays"])
1200
 
                                      (types.FunctionType(
1201
 
                                          attribute.func_code,
1202
 
                                          attribute.func_globals,
1203
 
                                          attribute.func_name,
1204
 
                                          attribute.func_defaults,
1205
 
                                          attribute.func_closure)))
 
1150
                    attr[attrname] = (dbus_service_property
 
1151
                                      (alt_interface,
 
1152
                                       attribute._dbus_signature,
 
1153
                                       attribute._dbus_access,
 
1154
                                       attribute
 
1155
                                       ._dbus_get_args_options
 
1156
                                       ["byte_arrays"])
 
1157
                                      (types.FunctionType
 
1158
                                       (attribute.func_code,
 
1159
                                        attribute.func_globals,
 
1160
                                        attribute.func_name,
 
1161
                                        attribute.func_defaults,
 
1162
                                        attribute.func_closure)))
1206
1163
                    # Copy annotations, if any
1207
1164
                    try:
1208
 
                        attr[attrname]._dbus_annotations = dict(
1209
 
                            attribute._dbus_annotations)
 
1165
                        attr[attrname]._dbus_annotations = (
 
1166
                            dict(attribute._dbus_annotations))
1210
1167
                    except AttributeError:
1211
1168
                        pass
1212
1169
                # Is this a D-Bus interface?
1215
1172
                    # object.  Decorate it to be a new D-Bus interface
1216
1173
                    # with the alternate D-Bus interface name.  Add it
1217
1174
                    # to the class.
1218
 
                    attr[attrname] = (
1219
 
                        dbus_interface_annotations(alt_interface)
1220
 
                        (types.FunctionType(attribute.func_code,
1221
 
                                            attribute.func_globals,
1222
 
                                            attribute.func_name,
1223
 
                                            attribute.func_defaults,
1224
 
                                            attribute.func_closure)))
 
1175
                    attr[attrname] = (dbus_interface_annotations
 
1176
                                      (alt_interface)
 
1177
                                      (types.FunctionType
 
1178
                                       (attribute.func_code,
 
1179
                                        attribute.func_globals,
 
1180
                                        attribute.func_name,
 
1181
                                        attribute.func_defaults,
 
1182
                                        attribute.func_closure)))
1225
1183
            if deprecate:
1226
1184
                # Deprecate all alternate interfaces
1227
1185
                iname="_AlternateDBusNames_interface_annotation{}"
1228
1186
                for interface_name in interface_names:
1229
 
                    
1230
1187
                    @dbus_interface_annotations(interface_name)
1231
1188
                    def func(self):
1232
1189
                        return { "org.freedesktop.DBus.Deprecated":
1233
 
                                 "true" }
 
1190
                                     "true" }
1234
1191
                    # Find an unused name
1235
1192
                    for aname in (iname.format(i)
1236
1193
                                  for i in itertools.count()):
1241
1198
                # Replace the class with a new subclass of it with
1242
1199
                # methods, signals, etc. as created above.
1243
1200
                cls = type(b"{}Alternate".format(cls.__name__),
1244
 
                           (cls, ), attr)
 
1201
                           (cls,), attr)
1245
1202
        return cls
1246
 
    
1247
1203
    return wrapper
1248
1204
 
1249
1205
 
1250
1206
@alternate_dbus_interfaces({"se.recompile.Mandos":
1251
 
                            "se.bsnet.fukt.Mandos"})
 
1207
                                "se.bsnet.fukt.Mandos"})
1252
1208
class ClientDBus(Client, DBusObjectWithProperties):
1253
1209
    """A Client class using D-Bus
1254
1210
    
1258
1214
    """
1259
1215
    
1260
1216
    runtime_expansions = (Client.runtime_expansions
1261
 
                          + ("dbus_object_path", ))
1262
 
    
1263
 
    _interface = "se.recompile.Mandos.Client"
 
1217
                          + ("dbus_object_path",))
1264
1218
    
1265
1219
    # dbus.service.Object doesn't use super(), so we can't either.
1266
1220
    
1269
1223
        Client.__init__(self, *args, **kwargs)
1270
1224
        # Only now, when this client is initialized, can it show up on
1271
1225
        # the D-Bus
1272
 
        client_object_name = str(self.name).translate(
 
1226
        client_object_name = unicode(self.name).translate(
1273
1227
            {ord("."): ord("_"),
1274
1228
             ord("-"): ord("_")})
1275
 
        self.dbus_object_path = dbus.ObjectPath(
1276
 
            "/clients/" + client_object_name)
 
1229
        self.dbus_object_path = (dbus.ObjectPath
 
1230
                                 ("/clients/" + client_object_name))
1277
1231
        DBusObjectWithProperties.__init__(self, self.bus,
1278
1232
                                          self.dbus_object_path)
1279
1233
    
1280
 
    def notifychangeproperty(transform_func, dbus_name,
1281
 
                             type_func=lambda x: x,
1282
 
                             variant_level=1,
1283
 
                             invalidate_only=False,
1284
 
                             _interface=_interface):
 
1234
    def notifychangeproperty(transform_func,
 
1235
                             dbus_name, type_func=lambda x: x,
 
1236
                             variant_level=1):
1285
1237
        """ Modify a variable so that it's a property which announces
1286
1238
        its changes to DBus.
1287
1239
        
1293
1245
        variant_level: D-Bus variant level.  Default: 1
1294
1246
        """
1295
1247
        attrname = "_{}".format(dbus_name)
1296
 
        
1297
1248
        def setter(self, value):
1298
1249
            if hasattr(self, "dbus_object_path"):
1299
1250
                if (not hasattr(self, attrname) or
1300
1251
                    type_func(getattr(self, attrname, None))
1301
1252
                    != type_func(value)):
1302
 
                    if invalidate_only:
1303
 
                        self.PropertiesChanged(
1304
 
                            _interface, dbus.Dictionary(),
1305
 
                            dbus.Array((dbus_name, )))
1306
 
                    else:
1307
 
                        dbus_value = transform_func(
1308
 
                            type_func(value),
1309
 
                            variant_level = variant_level)
1310
 
                        self.PropertyChanged(dbus.String(dbus_name),
1311
 
                                             dbus_value)
1312
 
                        self.PropertiesChanged(
1313
 
                            _interface,
1314
 
                            dbus.Dictionary({ dbus.String(dbus_name):
1315
 
                                              dbus_value }),
1316
 
                            dbus.Array())
 
1253
                    dbus_value = transform_func(type_func(value),
 
1254
                                                variant_level
 
1255
                                                =variant_level)
 
1256
                    self.PropertyChanged(dbus.String(dbus_name),
 
1257
                                         dbus_value)
1317
1258
            setattr(self, attrname, value)
1318
1259
        
1319
1260
        return property(lambda self: getattr(self, attrname), setter)
1325
1266
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1326
1267
    last_enabled = notifychangeproperty(datetime_to_dbus,
1327
1268
                                        "LastEnabled")
1328
 
    checker = notifychangeproperty(
1329
 
        dbus.Boolean, "CheckerRunning",
1330
 
        type_func = lambda checker: checker is not None)
 
1269
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1270
                                   type_func = lambda checker:
 
1271
                                       checker is not None)
1331
1272
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1332
1273
                                           "LastCheckedOK")
1333
1274
    last_checker_status = notifychangeproperty(dbus.Int16,
1336
1277
        datetime_to_dbus, "LastApprovalRequest")
1337
1278
    approved_by_default = notifychangeproperty(dbus.Boolean,
1338
1279
                                               "ApprovedByDefault")
1339
 
    approval_delay = notifychangeproperty(
1340
 
        dbus.UInt64, "ApprovalDelay",
1341
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1280
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1281
                                          "ApprovalDelay",
 
1282
                                          type_func =
 
1283
                                          lambda td: td.total_seconds()
 
1284
                                          * 1000)
1342
1285
    approval_duration = notifychangeproperty(
1343
1286
        dbus.UInt64, "ApprovalDuration",
1344
1287
        type_func = lambda td: td.total_seconds() * 1000)
1345
1288
    host = notifychangeproperty(dbus.String, "Host")
1346
 
    timeout = notifychangeproperty(
1347
 
        dbus.UInt64, "Timeout",
1348
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1289
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1290
                                   type_func = lambda td:
 
1291
                                       td.total_seconds() * 1000)
1349
1292
    extended_timeout = notifychangeproperty(
1350
1293
        dbus.UInt64, "ExtendedTimeout",
1351
1294
        type_func = lambda td: td.total_seconds() * 1000)
1352
 
    interval = notifychangeproperty(
1353
 
        dbus.UInt64, "Interval",
1354
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1295
    interval = notifychangeproperty(dbus.UInt64,
 
1296
                                    "Interval",
 
1297
                                    type_func =
 
1298
                                    lambda td: td.total_seconds()
 
1299
                                    * 1000)
1355
1300
    checker_command = notifychangeproperty(dbus.String, "Checker")
1356
 
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1357
 
                                  invalidate_only=True)
1358
1301
    
1359
1302
    del notifychangeproperty
1360
1303
    
1367
1310
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1368
1311
        Client.__del__(self, *args, **kwargs)
1369
1312
    
1370
 
    def checker_callback(self, source, condition,
1371
 
                         connection, command, *args, **kwargs):
1372
 
        ret = Client.checker_callback(self, source, condition,
1373
 
                                      connection, command, *args,
1374
 
                                      **kwargs)
1375
 
        exitstatus = self.last_checker_status
1376
 
        if exitstatus >= 0:
 
1313
    def checker_callback(self, pid, condition, command,
 
1314
                         *args, **kwargs):
 
1315
        self.checker_callback_tag = None
 
1316
        self.checker = None
 
1317
        if os.WIFEXITED(condition):
 
1318
            exitstatus = os.WEXITSTATUS(condition)
1377
1319
            # Emit D-Bus signal
1378
1320
            self.CheckerCompleted(dbus.Int16(exitstatus),
1379
 
                                  dbus.Int64(0),
 
1321
                                  dbus.Int64(condition),
1380
1322
                                  dbus.String(command))
1381
1323
        else:
1382
1324
            # Emit D-Bus signal
1383
1325
            self.CheckerCompleted(dbus.Int16(-1),
1384
 
                                  dbus.Int64(
1385
 
                                      self.last_checker_signal),
 
1326
                                  dbus.Int64(condition),
1386
1327
                                  dbus.String(command))
1387
 
        return ret
 
1328
        
 
1329
        return Client.checker_callback(self, pid, condition, command,
 
1330
                                       *args, **kwargs)
1388
1331
    
1389
1332
    def start_checker(self, *args, **kwargs):
1390
1333
        old_checker_pid = getattr(self.checker, "pid", None)
1407
1350
        self.send_changedstate()
1408
1351
    
1409
1352
    ## D-Bus methods, signals & properties
 
1353
    _interface = "se.recompile.Mandos.Client"
1410
1354
    
1411
1355
    ## Interfaces
1412
1356
    
 
1357
    @dbus_interface_annotations(_interface)
 
1358
    def _foo(self):
 
1359
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1360
                     "false"}
 
1361
    
1413
1362
    ## Signals
1414
1363
    
1415
1364
    # CheckerCompleted - signal
1425
1374
        pass
1426
1375
    
1427
1376
    # PropertyChanged - signal
1428
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1429
1377
    @dbus.service.signal(_interface, signature="sv")
1430
1378
    def PropertyChanged(self, property, value):
1431
1379
        "D-Bus signal"
1495
1443
        return dbus.Boolean(bool(self.approvals_pending))
1496
1444
    
1497
1445
    # ApprovedByDefault - property
1498
 
    @dbus_service_property(_interface,
1499
 
                           signature="b",
 
1446
    @dbus_service_property(_interface, signature="b",
1500
1447
                           access="readwrite")
1501
1448
    def ApprovedByDefault_dbus_property(self, value=None):
1502
1449
        if value is None:       # get
1504
1451
        self.approved_by_default = bool(value)
1505
1452
    
1506
1453
    # ApprovalDelay - property
1507
 
    @dbus_service_property(_interface,
1508
 
                           signature="t",
 
1454
    @dbus_service_property(_interface, signature="t",
1509
1455
                           access="readwrite")
1510
1456
    def ApprovalDelay_dbus_property(self, value=None):
1511
1457
        if value is None:       # get
1514
1460
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1515
1461
    
1516
1462
    # ApprovalDuration - property
1517
 
    @dbus_service_property(_interface,
1518
 
                           signature="t",
 
1463
    @dbus_service_property(_interface, signature="t",
1519
1464
                           access="readwrite")
1520
1465
    def ApprovalDuration_dbus_property(self, value=None):
1521
1466
        if value is None:       # get
1534
1479
        return dbus.String(self.fingerprint)
1535
1480
    
1536
1481
    # Host - property
1537
 
    @dbus_service_property(_interface,
1538
 
                           signature="s",
 
1482
    @dbus_service_property(_interface, signature="s",
1539
1483
                           access="readwrite")
1540
1484
    def Host_dbus_property(self, value=None):
1541
1485
        if value is None:       # get
1542
1486
            return dbus.String(self.host)
1543
 
        self.host = str(value)
 
1487
        self.host = unicode(value)
1544
1488
    
1545
1489
    # Created - property
1546
1490
    @dbus_service_property(_interface, signature="s", access="read")
1553
1497
        return datetime_to_dbus(self.last_enabled)
1554
1498
    
1555
1499
    # Enabled - property
1556
 
    @dbus_service_property(_interface,
1557
 
                           signature="b",
 
1500
    @dbus_service_property(_interface, signature="b",
1558
1501
                           access="readwrite")
1559
1502
    def Enabled_dbus_property(self, value=None):
1560
1503
        if value is None:       # get
1565
1508
            self.disable()
1566
1509
    
1567
1510
    # LastCheckedOK - property
1568
 
    @dbus_service_property(_interface,
1569
 
                           signature="s",
 
1511
    @dbus_service_property(_interface, signature="s",
1570
1512
                           access="readwrite")
1571
1513
    def LastCheckedOK_dbus_property(self, value=None):
1572
1514
        if value is not None:
1575
1517
        return datetime_to_dbus(self.last_checked_ok)
1576
1518
    
1577
1519
    # LastCheckerStatus - property
1578
 
    @dbus_service_property(_interface, signature="n", access="read")
 
1520
    @dbus_service_property(_interface, signature="n",
 
1521
                           access="read")
1579
1522
    def LastCheckerStatus_dbus_property(self):
1580
1523
        return dbus.Int16(self.last_checker_status)
1581
1524
    
1590
1533
        return datetime_to_dbus(self.last_approval_request)
1591
1534
    
1592
1535
    # Timeout - property
1593
 
    @dbus_service_property(_interface,
1594
 
                           signature="t",
 
1536
    @dbus_service_property(_interface, signature="t",
1595
1537
                           access="readwrite")
1596
1538
    def Timeout_dbus_property(self, value=None):
1597
1539
        if value is None:       # get
1610
1552
                    is None):
1611
1553
                    return
1612
1554
                gobject.source_remove(self.disable_initiator_tag)
1613
 
                self.disable_initiator_tag = gobject.timeout_add(
1614
 
                    int((self.expires - now).total_seconds() * 1000),
1615
 
                    self.disable)
 
1555
                self.disable_initiator_tag = (
 
1556
                    gobject.timeout_add(
 
1557
                        int((self.expires - now).total_seconds()
 
1558
                            * 1000), self.disable))
1616
1559
    
1617
1560
    # ExtendedTimeout - property
1618
 
    @dbus_service_property(_interface,
1619
 
                           signature="t",
 
1561
    @dbus_service_property(_interface, signature="t",
1620
1562
                           access="readwrite")
1621
1563
    def ExtendedTimeout_dbus_property(self, value=None):
1622
1564
        if value is None:       # get
1625
1567
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1626
1568
    
1627
1569
    # Interval - property
1628
 
    @dbus_service_property(_interface,
1629
 
                           signature="t",
 
1570
    @dbus_service_property(_interface, signature="t",
1630
1571
                           access="readwrite")
1631
1572
    def Interval_dbus_property(self, value=None):
1632
1573
        if value is None:       # get
1637
1578
        if self.enabled:
1638
1579
            # Reschedule checker run
1639
1580
            gobject.source_remove(self.checker_initiator_tag)
1640
 
            self.checker_initiator_tag = gobject.timeout_add(
1641
 
                value, self.start_checker)
1642
 
            self.start_checker() # Start one now, too
 
1581
            self.checker_initiator_tag = (gobject.timeout_add
 
1582
                                          (value, self.start_checker))
 
1583
            self.start_checker()    # Start one now, too
1643
1584
    
1644
1585
    # Checker - property
1645
 
    @dbus_service_property(_interface,
1646
 
                           signature="s",
 
1586
    @dbus_service_property(_interface, signature="s",
1647
1587
                           access="readwrite")
1648
1588
    def Checker_dbus_property(self, value=None):
1649
1589
        if value is None:       # get
1650
1590
            return dbus.String(self.checker_command)
1651
 
        self.checker_command = str(value)
 
1591
        self.checker_command = unicode(value)
1652
1592
    
1653
1593
    # CheckerRunning - property
1654
 
    @dbus_service_property(_interface,
1655
 
                           signature="b",
 
1594
    @dbus_service_property(_interface, signature="b",
1656
1595
                           access="readwrite")
1657
1596
    def CheckerRunning_dbus_property(self, value=None):
1658
1597
        if value is None:       # get
1668
1607
        return self.dbus_object_path # is already a dbus.ObjectPath
1669
1608
    
1670
1609
    # Secret = property
1671
 
    @dbus_service_property(_interface,
1672
 
                           signature="ay",
1673
 
                           access="write",
1674
 
                           byte_arrays=True)
 
1610
    @dbus_service_property(_interface, signature="ay",
 
1611
                           access="write", byte_arrays=True)
1675
1612
    def Secret_dbus_property(self, value):
1676
1613
        self.secret = bytes(value)
1677
1614
    
1683
1620
        self._pipe = child_pipe
1684
1621
        self._pipe.send(('init', fpr, address))
1685
1622
        if not self._pipe.recv():
1686
 
            raise KeyError(fpr)
 
1623
            raise KeyError()
1687
1624
    
1688
1625
    def __getattribute__(self, name):
1689
1626
        if name == '_pipe':
1693
1630
        if data[0] == 'data':
1694
1631
            return data[1]
1695
1632
        if data[0] == 'function':
1696
 
            
1697
1633
            def func(*args, **kwargs):
1698
1634
                self._pipe.send(('funcall', name, args, kwargs))
1699
1635
                return self._pipe.recv()[1]
1700
 
            
1701
1636
            return func
1702
1637
    
1703
1638
    def __setattr__(self, name, value):
1715
1650
    def handle(self):
1716
1651
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1717
1652
            logger.info("TCP connection from: %s",
1718
 
                        str(self.client_address))
 
1653
                        unicode(self.client_address))
1719
1654
            logger.debug("Pipe FD: %d",
1720
1655
                         self.server.child_pipe.fileno())
1721
1656
            
1722
 
            session = gnutls.connection.ClientSession(
1723
 
                self.request, gnutls.connection .X509Credentials())
 
1657
            session = (gnutls.connection
 
1658
                       .ClientSession(self.request,
 
1659
                                      gnutls.connection
 
1660
                                      .X509Credentials()))
1724
1661
            
1725
1662
            # Note: gnutls.connection.X509Credentials is really a
1726
1663
            # generic GnuTLS certificate credentials object so long as
1735
1672
            priority = self.server.gnutls_priority
1736
1673
            if priority is None:
1737
1674
                priority = "NORMAL"
1738
 
            gnutls.library.functions.gnutls_priority_set_direct(
1739
 
                session._c_object, priority, None)
 
1675
            (gnutls.library.functions
 
1676
             .gnutls_priority_set_direct(session._c_object,
 
1677
                                         priority, None))
1740
1678
            
1741
1679
            # Start communication using the Mandos protocol
1742
1680
            # Get protocol number
1762
1700
            approval_required = False
1763
1701
            try:
1764
1702
                try:
1765
 
                    fpr = self.fingerprint(
1766
 
                        self.peer_certificate(session))
 
1703
                    fpr = self.fingerprint(self.peer_certificate
 
1704
                                           (session))
1767
1705
                except (TypeError,
1768
1706
                        gnutls.errors.GNUTLSError) as error:
1769
1707
                    logger.warning("Bad certificate: %s", error)
1784
1722
                while True:
1785
1723
                    if not client.enabled:
1786
1724
                        logger.info("Client %s is disabled",
1787
 
                                    client.name)
 
1725
                                       client.name)
1788
1726
                        if self.server.use_dbus:
1789
1727
                            # Emit D-Bus signal
1790
1728
                            client.Rejected("Disabled")
1837
1775
                        logger.warning("gnutls send failed",
1838
1776
                                       exc_info=error)
1839
1777
                        return
1840
 
                    logger.debug("Sent: %d, remaining: %d", sent,
1841
 
                                 len(client.secret) - (sent_size
1842
 
                                                       + sent))
 
1778
                    logger.debug("Sent: %d, remaining: %d",
 
1779
                                 sent, len(client.secret)
 
1780
                                 - (sent_size + sent))
1843
1781
                    sent_size += sent
1844
1782
                
1845
1783
                logger.info("Sending secret to %s", client.name)
1862
1800
    def peer_certificate(session):
1863
1801
        "Return the peer's OpenPGP certificate as a bytestring"
1864
1802
        # If not an OpenPGP certificate...
1865
 
        if (gnutls.library.functions.gnutls_certificate_type_get(
1866
 
                session._c_object)
 
1803
        if (gnutls.library.functions
 
1804
            .gnutls_certificate_type_get(session._c_object)
1867
1805
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1868
1806
            # ...do the normal thing
1869
1807
            return session.peer_certificate
1883
1821
    def fingerprint(openpgp):
1884
1822
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1885
1823
        # New GnuTLS "datum" with the OpenPGP public key
1886
 
        datum = gnutls.library.types.gnutls_datum_t(
1887
 
            ctypes.cast(ctypes.c_char_p(openpgp),
1888
 
                        ctypes.POINTER(ctypes.c_ubyte)),
1889
 
            ctypes.c_uint(len(openpgp)))
 
1824
        datum = (gnutls.library.types
 
1825
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1826
                                             ctypes.POINTER
 
1827
                                             (ctypes.c_ubyte)),
 
1828
                                 ctypes.c_uint(len(openpgp))))
1890
1829
        # New empty GnuTLS certificate
1891
1830
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1892
 
        gnutls.library.functions.gnutls_openpgp_crt_init(
1893
 
            ctypes.byref(crt))
 
1831
        (gnutls.library.functions
 
1832
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1894
1833
        # Import the OpenPGP public key into the certificate
1895
 
        gnutls.library.functions.gnutls_openpgp_crt_import(
1896
 
            crt, ctypes.byref(datum),
1897
 
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
1834
        (gnutls.library.functions
 
1835
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1836
                                    gnutls.library.constants
 
1837
                                    .GNUTLS_OPENPGP_FMT_RAW))
1898
1838
        # Verify the self signature in the key
1899
1839
        crtverify = ctypes.c_uint()
1900
 
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1901
 
            crt, 0, ctypes.byref(crtverify))
 
1840
        (gnutls.library.functions
 
1841
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1842
                                         ctypes.byref(crtverify)))
1902
1843
        if crtverify.value != 0:
1903
1844
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1904
 
            raise gnutls.errors.CertificateSecurityError(
1905
 
                "Verify failed")
 
1845
            raise (gnutls.errors.CertificateSecurityError
 
1846
                   ("Verify failed"))
1906
1847
        # New buffer for the fingerprint
1907
1848
        buf = ctypes.create_string_buffer(20)
1908
1849
        buf_len = ctypes.c_size_t()
1909
1850
        # Get the fingerprint from the certificate into the buffer
1910
 
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1911
 
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
 
1851
        (gnutls.library.functions
 
1852
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1853
                                             ctypes.byref(buf_len)))
1912
1854
        # Deinit the certificate
1913
1855
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1914
1856
        # Convert the buffer to a Python bytestring
1920
1862
 
1921
1863
class MultiprocessingMixIn(object):
1922
1864
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1923
 
    
1924
1865
    def sub_process_main(self, request, address):
1925
1866
        try:
1926
1867
            self.finish_request(request, address)
1938
1879
 
1939
1880
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1940
1881
    """ adds a pipe to the MixIn """
1941
 
    
1942
1882
    def process_request(self, request, client_address):
1943
1883
        """Overrides and wraps the original process_request().
1944
1884
        
1965
1905
        interface:      None or a network interface name (string)
1966
1906
        use_ipv6:       Boolean; to use IPv6 or not
1967
1907
    """
1968
 
    
1969
1908
    def __init__(self, server_address, RequestHandlerClass,
1970
 
                 interface=None,
1971
 
                 use_ipv6=True,
1972
 
                 socketfd=None):
 
1909
                 interface=None, use_ipv6=True, socketfd=None):
1973
1910
        """If socketfd is set, use that file descriptor instead of
1974
1911
        creating a new one with socket.socket().
1975
1912
        """
2016
1953
                             self.interface)
2017
1954
            else:
2018
1955
                try:
2019
 
                    self.socket.setsockopt(
2020
 
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
2021
 
                        (self.interface + "\0").encode("utf-8"))
 
1956
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1957
                                           SO_BINDTODEVICE,
 
1958
                                           (self.interface + "\0")
 
1959
                                           .encode("utf-8"))
2022
1960
                except socket.error as error:
2023
1961
                    if error.errno == errno.EPERM:
2024
1962
                        logger.error("No permission to bind to"
2042
1980
                self.server_address = (any_address,
2043
1981
                                       self.server_address[1])
2044
1982
            elif not self.server_address[1]:
2045
 
                self.server_address = (self.server_address[0], 0)
 
1983
                self.server_address = (self.server_address[0],
 
1984
                                       0)
2046
1985
#                 if self.interface:
2047
1986
#                     self.server_address = (self.server_address[0],
2048
1987
#                                            0, # port
2062
2001
    
2063
2002
    Assumes a gobject.MainLoop event loop.
2064
2003
    """
2065
 
    
2066
2004
    def __init__(self, server_address, RequestHandlerClass,
2067
 
                 interface=None,
2068
 
                 use_ipv6=True,
2069
 
                 clients=None,
2070
 
                 gnutls_priority=None,
2071
 
                 use_dbus=True,
2072
 
                 socketfd=None):
 
2005
                 interface=None, use_ipv6=True, clients=None,
 
2006
                 gnutls_priority=None, use_dbus=True, socketfd=None):
2073
2007
        self.enabled = False
2074
2008
        self.clients = clients
2075
2009
        if self.clients is None:
2081
2015
                                interface = interface,
2082
2016
                                use_ipv6 = use_ipv6,
2083
2017
                                socketfd = socketfd)
2084
 
    
2085
2018
    def server_activate(self):
2086
2019
        if self.enabled:
2087
2020
            return socketserver.TCPServer.server_activate(self)
2091
2024
    
2092
2025
    def add_pipe(self, parent_pipe, proc):
2093
2026
        # Call "handle_ipc" for both data and EOF events
2094
 
        gobject.io_add_watch(
2095
 
            parent_pipe.fileno(),
2096
 
            gobject.IO_IN | gobject.IO_HUP,
2097
 
            functools.partial(self.handle_ipc,
2098
 
                              parent_pipe = parent_pipe,
2099
 
                              proc = proc))
 
2027
        gobject.io_add_watch(parent_pipe.fileno(),
 
2028
                             gobject.IO_IN | gobject.IO_HUP,
 
2029
                             functools.partial(self.handle_ipc,
 
2030
                                               parent_pipe =
 
2031
                                               parent_pipe,
 
2032
                                               proc = proc))
2100
2033
    
2101
 
    def handle_ipc(self, source, condition,
2102
 
                   parent_pipe=None,
2103
 
                   proc = None,
2104
 
                   client_object=None):
 
2034
    def handle_ipc(self, source, condition, parent_pipe=None,
 
2035
                   proc = None, client_object=None):
2105
2036
        # error, or the other end of multiprocessing.Pipe has closed
2106
2037
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
2107
2038
            # Wait for other process to exit
2130
2061
                parent_pipe.send(False)
2131
2062
                return False
2132
2063
            
2133
 
            gobject.io_add_watch(
2134
 
                parent_pipe.fileno(),
2135
 
                gobject.IO_IN | gobject.IO_HUP,
2136
 
                functools.partial(self.handle_ipc,
2137
 
                                  parent_pipe = parent_pipe,
2138
 
                                  proc = proc,
2139
 
                                  client_object = client))
 
2064
            gobject.io_add_watch(parent_pipe.fileno(),
 
2065
                                 gobject.IO_IN | gobject.IO_HUP,
 
2066
                                 functools.partial(self.handle_ipc,
 
2067
                                                   parent_pipe =
 
2068
                                                   parent_pipe,
 
2069
                                                   proc = proc,
 
2070
                                                   client_object =
 
2071
                                                   client))
2140
2072
            parent_pipe.send(True)
2141
2073
            # remove the old hook in favor of the new above hook on
2142
2074
            # same fileno
2148
2080
            
2149
2081
            parent_pipe.send(('data', getattr(client_object,
2150
2082
                                              funcname)(*args,
2151
 
                                                        **kwargs)))
 
2083
                                                         **kwargs)))
2152
2084
        
2153
2085
        if command == 'getattr':
2154
2086
            attrname = request[1]
2155
 
            if isinstance(client_object.__getattribute__(attrname),
2156
 
                          collections.Callable):
2157
 
                parent_pipe.send(('function', ))
 
2087
            if callable(client_object.__getattribute__(attrname)):
 
2088
                parent_pipe.send(('function',))
2158
2089
            else:
2159
 
                parent_pipe.send((
2160
 
                    'data', client_object.__getattribute__(attrname)))
 
2090
                parent_pipe.send(('data', client_object
 
2091
                                  .__getattribute__(attrname)))
2161
2092
        
2162
2093
        if command == 'setattr':
2163
2094
            attrname = request[1]
2194
2125
    # avoid excessive use of external libraries.
2195
2126
    
2196
2127
    # New type for defining tokens, syntax, and semantics all-in-one
2197
 
    Token = collections.namedtuple("Token", (
2198
 
        "regexp",  # To match token; if "value" is not None, must have
2199
 
                   # a "group" containing digits
2200
 
        "value",   # datetime.timedelta or None
2201
 
        "followers"))           # Tokens valid after this token
 
2128
    Token = collections.namedtuple("Token",
 
2129
                                   ("regexp", # To match token; if
 
2130
                                              # "value" is not None,
 
2131
                                              # must have a "group"
 
2132
                                              # containing digits
 
2133
                                    "value",  # datetime.timedelta or
 
2134
                                              # None
 
2135
                                    "followers")) # Tokens valid after
 
2136
                                                  # this token
2202
2137
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2203
2138
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2204
2139
    token_end = Token(re.compile(r"$"), None, frozenset())
2205
2140
    token_second = Token(re.compile(r"(\d+)S"),
2206
2141
                         datetime.timedelta(seconds=1),
2207
 
                         frozenset((token_end, )))
 
2142
                         frozenset((token_end,)))
2208
2143
    token_minute = Token(re.compile(r"(\d+)M"),
2209
2144
                         datetime.timedelta(minutes=1),
2210
2145
                         frozenset((token_second, token_end)))
2226
2161
                       frozenset((token_month, token_end)))
2227
2162
    token_week = Token(re.compile(r"(\d+)W"),
2228
2163
                       datetime.timedelta(weeks=1),
2229
 
                       frozenset((token_end, )))
 
2164
                       frozenset((token_end,)))
2230
2165
    token_duration = Token(re.compile(r"P"), None,
2231
2166
                           frozenset((token_year, token_month,
2232
2167
                                      token_day, token_time,
2234
2169
    # Define starting values
2235
2170
    value = datetime.timedelta() # Value so far
2236
2171
    found_token = None
2237
 
    followers = frozenset((token_duration, )) # Following valid tokens
 
2172
    followers = frozenset((token_duration,)) # Following valid tokens
2238
2173
    s = duration                # String left to parse
2239
2174
    # Loop until end token is found
2240
2175
    while found_token is not token_end:
2257
2192
                break
2258
2193
        else:
2259
2194
            # No currently valid tokens were found
2260
 
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2261
 
                             .format(duration))
 
2195
            raise ValueError("Invalid RFC 3339 duration")
2262
2196
    # End token found
2263
2197
    return value
2264
2198
 
2301
2235
            elif suffix == "w":
2302
2236
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2303
2237
            else:
2304
 
                raise ValueError("Unknown suffix {!r}".format(suffix))
 
2238
                raise ValueError("Unknown suffix {!r}"
 
2239
                                 .format(suffix))
2305
2240
        except IndexError as e:
2306
2241
            raise ValueError(*(e.args))
2307
2242
        timevalue += delta
2323
2258
        # Close all standard open file descriptors
2324
2259
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2325
2260
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2326
 
            raise OSError(errno.ENODEV,
2327
 
                          "{} not a character device"
 
2261
            raise OSError(errno.ENODEV, "{} not a character device"
2328
2262
                          .format(os.devnull))
2329
2263
        os.dup2(null, sys.stdin.fileno())
2330
2264
        os.dup2(null, sys.stdout.fileno())
2396
2330
                        "port": "",
2397
2331
                        "debug": "False",
2398
2332
                        "priority":
2399
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2400
 
                        ":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
 
2333
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2401
2334
                        "servicename": "Mandos",
2402
2335
                        "use_dbus": "True",
2403
2336
                        "use_ipv6": "True",
2407
2340
                        "statedir": "/var/lib/mandos",
2408
2341
                        "foreground": "False",
2409
2342
                        "zeroconf": "True",
2410
 
                    }
 
2343
                        }
2411
2344
    
2412
2345
    # Parse config file for server-global settings
2413
2346
    server_config = configparser.SafeConfigParser(server_defaults)
2414
2347
    del server_defaults
2415
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
2348
    server_config.read(os.path.join(options.configdir,
 
2349
                                    "mandos.conf"))
2416
2350
    # Convert the SafeConfigParser object to a dict
2417
2351
    server_settings = server_config.defaults()
2418
2352
    # Use the appropriate methods on the non-string config options
2436
2370
    # Override the settings from the config file with command line
2437
2371
    # options, if set.
2438
2372
    for option in ("interface", "address", "port", "debug",
2439
 
                   "priority", "servicename", "configdir", "use_dbus",
2440
 
                   "use_ipv6", "debuglevel", "restore", "statedir",
2441
 
                   "socket", "foreground", "zeroconf"):
 
2373
                   "priority", "servicename", "configdir",
 
2374
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2375
                   "statedir", "socket", "foreground", "zeroconf"):
2442
2376
        value = getattr(options, option)
2443
2377
        if value is not None:
2444
2378
            server_settings[option] = value
2459
2393
    
2460
2394
    ##################################################################
2461
2395
    
2462
 
    if (not server_settings["zeroconf"]
2463
 
        and not (server_settings["port"]
2464
 
                 or server_settings["socket"] != "")):
2465
 
        parser.error("Needs port or socket to work without Zeroconf")
 
2396
    if (not server_settings["zeroconf"] and
 
2397
        not (server_settings["port"]
 
2398
             or server_settings["socket"] != "")):
 
2399
            parser.error("Needs port or socket to work without"
 
2400
                         " Zeroconf")
2466
2401
    
2467
2402
    # For convenience
2468
2403
    debug = server_settings["debug"]
2484
2419
            initlogger(debug, level)
2485
2420
    
2486
2421
    if server_settings["servicename"] != "Mandos":
2487
 
        syslogger.setFormatter(
2488
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
2489
 
                              ' %(levelname)s: %(message)s'.format(
2490
 
                                  server_settings["servicename"])))
 
2422
        syslogger.setFormatter(logging.Formatter
 
2423
                               ('Mandos ({}) [%(process)d]:'
 
2424
                                ' %(levelname)s: %(message)s'
 
2425
                                .format(server_settings
 
2426
                                        ["servicename"])))
2491
2427
    
2492
2428
    # Parse config file with clients
2493
2429
    client_config = configparser.SafeConfigParser(Client
2501
2437
    socketfd = None
2502
2438
    if server_settings["socket"] != "":
2503
2439
        socketfd = server_settings["socket"]
2504
 
    tcp_server = MandosServer(
2505
 
        (server_settings["address"], server_settings["port"]),
2506
 
        ClientHandler,
2507
 
        interface=(server_settings["interface"] or None),
2508
 
        use_ipv6=use_ipv6,
2509
 
        gnutls_priority=server_settings["priority"],
2510
 
        use_dbus=use_dbus,
2511
 
        socketfd=socketfd)
 
2440
    tcp_server = MandosServer((server_settings["address"],
 
2441
                               server_settings["port"]),
 
2442
                              ClientHandler,
 
2443
                              interface=(server_settings["interface"]
 
2444
                                         or None),
 
2445
                              use_ipv6=use_ipv6,
 
2446
                              gnutls_priority=
 
2447
                              server_settings["priority"],
 
2448
                              use_dbus=use_dbus,
 
2449
                              socketfd=socketfd)
2512
2450
    if not foreground:
2513
2451
        pidfilename = "/run/mandos.pid"
2514
2452
        if not os.path.isdir("/run/."):
2515
2453
            pidfilename = "/var/run/mandos.pid"
2516
2454
        pidfile = None
2517
2455
        try:
2518
 
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
 
2456
            pidfile = open(pidfilename, "w")
2519
2457
        except IOError as e:
2520
2458
            logger.error("Could not open file %r", pidfilename,
2521
2459
                         exc_info=e)
2548
2486
        def debug_gnutls(level, string):
2549
2487
            logger.debug("GnuTLS: %s", string[:-1])
2550
2488
        
2551
 
        gnutls.library.functions.gnutls_global_set_log_function(
2552
 
            debug_gnutls)
 
2489
        (gnutls.library.functions
 
2490
         .gnutls_global_set_log_function(debug_gnutls))
2553
2491
        
2554
2492
        # Redirect stdin so all checkers get /dev/null
2555
2493
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2575
2513
    if use_dbus:
2576
2514
        try:
2577
2515
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2578
 
                                            bus,
2579
 
                                            do_not_queue=True)
2580
 
            old_bus_name = dbus.service.BusName(
2581
 
                "se.bsnet.fukt.Mandos", bus,
2582
 
                do_not_queue=True)
2583
 
        except dbus.exceptions.DBusException as e:
 
2516
                                            bus, do_not_queue=True)
 
2517
            old_bus_name = (dbus.service.BusName
 
2518
                            ("se.bsnet.fukt.Mandos", bus,
 
2519
                             do_not_queue=True))
 
2520
        except dbus.exceptions.NameExistsException as e:
2584
2521
            logger.error("Disabling D-Bus:", exc_info=e)
2585
2522
            use_dbus = False
2586
2523
            server_settings["use_dbus"] = False
2587
2524
            tcp_server.use_dbus = False
2588
2525
    if zeroconf:
2589
2526
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2590
 
        service = AvahiServiceToSyslog(
2591
 
            name = server_settings["servicename"],
2592
 
            servicetype = "_mandos._tcp",
2593
 
            protocol = protocol,
2594
 
            bus = bus)
 
2527
        service = AvahiServiceToSyslog(name =
 
2528
                                       server_settings["servicename"],
 
2529
                                       servicetype = "_mandos._tcp",
 
2530
                                       protocol = protocol, bus = bus)
2595
2531
        if server_settings["interface"]:
2596
 
            service.interface = if_nametoindex(
2597
 
                server_settings["interface"].encode("utf-8"))
 
2532
            service.interface = (if_nametoindex
 
2533
                                 (server_settings["interface"]
 
2534
                                  .encode("utf-8")))
2598
2535
    
2599
2536
    global multiprocessing_manager
2600
2537
    multiprocessing_manager = multiprocessing.Manager()
2619
2556
    if server_settings["restore"]:
2620
2557
        try:
2621
2558
            with open(stored_state_path, "rb") as stored_state:
2622
 
                clients_data, old_client_settings = pickle.load(
2623
 
                    stored_state)
 
2559
                clients_data, old_client_settings = (pickle.load
 
2560
                                                     (stored_state))
2624
2561
            os.remove(stored_state_path)
2625
2562
        except IOError as e:
2626
2563
            if e.errno == errno.ENOENT:
2627
 
                logger.warning("Could not load persistent state:"
2628
 
                               " {}".format(os.strerror(e.errno)))
 
2564
                logger.warning("Could not load persistent state: {}"
 
2565
                                .format(os.strerror(e.errno)))
2629
2566
            else:
2630
2567
                logger.critical("Could not load persistent state:",
2631
2568
                                exc_info=e)
2632
2569
                raise
2633
2570
        except EOFError as e:
2634
2571
            logger.warning("Could not load persistent state: "
2635
 
                           "EOFError:",
2636
 
                           exc_info=e)
 
2572
                           "EOFError:", exc_info=e)
2637
2573
    
2638
2574
    with PGPEngine() as pgp:
2639
2575
        for client_name, client in clients_data.items():
2651
2587
                    # For each value in new config, check if it
2652
2588
                    # differs from the old config value (Except for
2653
2589
                    # the "secret" attribute)
2654
 
                    if (name != "secret"
2655
 
                        and (value !=
2656
 
                             old_client_settings[client_name][name])):
 
2590
                    if (name != "secret" and
 
2591
                        value != old_client_settings[client_name]
 
2592
                        [name]):
2657
2593
                        client[name] = value
2658
2594
                except KeyError:
2659
2595
                    pass
2660
2596
            
2661
2597
            # Clients who has passed its expire date can still be
2662
 
            # enabled if its last checker was successful.  A Client
 
2598
            # enabled if its last checker was successful.  Clients
2663
2599
            # whose checker succeeded before we stored its state is
2664
2600
            # assumed to have successfully run all checkers during
2665
2601
            # downtime.
2668
2604
                    if not client["last_checked_ok"]:
2669
2605
                        logger.warning(
2670
2606
                            "disabling client {} - Client never "
2671
 
                            "performed a successful checker".format(
2672
 
                                client_name))
 
2607
                            "performed a successful checker"
 
2608
                            .format(client_name))
2673
2609
                        client["enabled"] = False
2674
2610
                    elif client["last_checker_status"] != 0:
2675
2611
                        logger.warning(
2676
2612
                            "disabling client {} - Client last"
2677
 
                            " checker failed with error code"
2678
 
                            " {}".format(
2679
 
                                client_name,
2680
 
                                client["last_checker_status"]))
 
2613
                            " checker failed with error code {}"
 
2614
                            .format(client_name,
 
2615
                                    client["last_checker_status"]))
2681
2616
                        client["enabled"] = False
2682
2617
                    else:
2683
 
                        client["expires"] = (
2684
 
                            datetime.datetime.utcnow()
2685
 
                            + client["timeout"])
 
2618
                        client["expires"] = (datetime.datetime
 
2619
                                             .utcnow()
 
2620
                                             + client["timeout"])
2686
2621
                        logger.debug("Last checker succeeded,"
2687
 
                                     " keeping {} enabled".format(
2688
 
                                         client_name))
 
2622
                                     " keeping {} enabled"
 
2623
                                     .format(client_name))
2689
2624
            try:
2690
 
                client["secret"] = pgp.decrypt(
2691
 
                    client["encrypted_secret"],
2692
 
                    client_settings[client_name]["secret"])
 
2625
                client["secret"] = (
 
2626
                    pgp.decrypt(client["encrypted_secret"],
 
2627
                                client_settings[client_name]
 
2628
                                ["secret"]))
2693
2629
            except PGPError:
2694
2630
                # If decryption fails, we use secret from new settings
2695
 
                logger.debug("Failed to decrypt {} old secret".format(
2696
 
                    client_name))
2697
 
                client["secret"] = (client_settings[client_name]
2698
 
                                    ["secret"])
 
2631
                logger.debug("Failed to decrypt {} old secret"
 
2632
                             .format(client_name))
 
2633
                client["secret"] = (
 
2634
                    client_settings[client_name]["secret"])
2699
2635
    
2700
2636
    # Add/remove clients based on new changes made to config
2701
2637
    for client_name in (set(old_client_settings)
2708
2644
    # Create all client objects
2709
2645
    for client_name, client in clients_data.items():
2710
2646
        tcp_server.clients[client_name] = client_class(
2711
 
            name = client_name,
2712
 
            settings = client,
 
2647
            name = client_name, settings = client,
2713
2648
            server_settings = server_settings)
2714
2649
    
2715
2650
    if not tcp_server.clients:
2717
2652
    
2718
2653
    if not foreground:
2719
2654
        if pidfile is not None:
2720
 
            pid = os.getpid()
2721
2655
            try:
2722
2656
                with pidfile:
2723
 
                    print(pid, file=pidfile)
 
2657
                    pid = os.getpid()
 
2658
                    pidfile.write("{}\n".format(pid).encode("utf-8"))
2724
2659
            except IOError:
2725
2660
                logger.error("Could not write to file %r with PID %d",
2726
2661
                             pidfilename, pid)
2731
2666
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2732
2667
    
2733
2668
    if use_dbus:
2734
 
        
2735
 
        @alternate_dbus_interfaces(
2736
 
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
 
2669
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2670
                                        "se.bsnet.fukt.Mandos"})
2737
2671
        class MandosDBusService(DBusObjectWithProperties):
2738
2672
            """A D-Bus proxy object"""
2739
 
            
2740
2673
            def __init__(self):
2741
2674
                dbus.service.Object.__init__(self, bus, "/")
2742
 
            
2743
2675
            _interface = "se.recompile.Mandos"
2744
2676
            
2745
2677
            @dbus_interface_annotations(_interface)
2746
2678
            def _foo(self):
2747
 
                return {
2748
 
                    "org.freedesktop.DBus.Property.EmitsChangedSignal":
2749
 
                    "false" }
 
2679
                return { "org.freedesktop.DBus.Property"
 
2680
                         ".EmitsChangedSignal":
 
2681
                             "false"}
2750
2682
            
2751
2683
            @dbus.service.signal(_interface, signature="o")
2752
2684
            def ClientAdded(self, objpath):
2766
2698
            @dbus.service.method(_interface, out_signature="ao")
2767
2699
            def GetAllClients(self):
2768
2700
                "D-Bus method"
2769
 
                return dbus.Array(c.dbus_object_path for c in
 
2701
                return dbus.Array(c.dbus_object_path
 
2702
                                  for c in
2770
2703
                                  tcp_server.clients.itervalues())
2771
2704
            
2772
2705
            @dbus.service.method(_interface,
2774
2707
            def GetAllClientsWithProperties(self):
2775
2708
                "D-Bus method"
2776
2709
                return dbus.Dictionary(
2777
 
                    { c.dbus_object_path: c.GetAll("")
2778
 
                      for c in tcp_server.clients.itervalues() },
 
2710
                    ((c.dbus_object_path, c.GetAll(""))
 
2711
                     for c in tcp_server.clients.itervalues()),
2779
2712
                    signature="oa{sv}")
2780
2713
            
2781
2714
            @dbus.service.method(_interface, in_signature="o")
2821
2754
                # + secret.
2822
2755
                exclude = { "bus", "changedstate", "secret",
2823
2756
                            "checker", "server_settings" }
2824
 
                for name, typ in inspect.getmembers(dbus.service
2825
 
                                                    .Object):
 
2757
                for name, typ in (inspect.getmembers
 
2758
                                  (dbus.service.Object)):
2826
2759
                    exclude.add(name)
2827
2760
                
2828
2761
                client_dict["encrypted_secret"] = (client
2835
2768
                del client_settings[client.name]["secret"]
2836
2769
        
2837
2770
        try:
2838
 
            with tempfile.NamedTemporaryFile(
2839
 
                    mode='wb',
2840
 
                    suffix=".pickle",
2841
 
                    prefix='clients-',
2842
 
                    dir=os.path.dirname(stored_state_path),
2843
 
                    delete=False) as stored_state:
 
2771
            with (tempfile.NamedTemporaryFile
 
2772
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2773
                   dir=os.path.dirname(stored_state_path),
 
2774
                   delete=False)) as stored_state:
2844
2775
                pickle.dump((clients, client_settings), stored_state)
2845
 
                tempname = stored_state.name
 
2776
                tempname=stored_state.name
2846
2777
            os.rename(tempname, stored_state_path)
2847
2778
        except (IOError, OSError) as e:
2848
2779
            if not debug:
2867
2798
            client.disable(quiet=True)
2868
2799
            if use_dbus:
2869
2800
                # Emit D-Bus signal
2870
 
                mandos_dbus_service.ClientRemoved(
2871
 
                    client.dbus_object_path, client.name)
 
2801
                mandos_dbus_service.ClientRemoved(client
 
2802
                                                  .dbus_object_path,
 
2803
                                                  client.name)
2872
2804
        client_settings.clear()
2873
2805
    
2874
2806
    atexit.register(cleanup)
2927
2859
    # Must run before the D-Bus bus name gets deregistered
2928
2860
    cleanup()
2929
2861
 
2930
 
 
2931
2862
if __name__ == '__main__':
2932
2863
    main()