/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2015-07-20 03:03:33 UTC
  • Revision ID: teddy@recompile.se-20150720030333-203m2aeblypcsfte
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.

The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string.  This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:

SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256

* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
  (/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
                                      instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python
 
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2010 Teddy Hogeborn
15
 
# Copyright © 2008-2010 Björn Påhlsson
 
14
# Copyright © 2008-2015 Teddy Hogeborn
 
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
 
from __future__ import division, with_statement, absolute_import
35
 
 
36
 
import SocketServer as socketserver
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
 
36
 
 
37
from future_builtins import *
 
38
 
 
39
try:
 
40
    import SocketServer as socketserver
 
41
except ImportError:
 
42
    import socketserver
37
43
import socket
38
 
import optparse
 
44
import argparse
39
45
import datetime
40
46
import errno
41
47
import gnutls.crypto
44
50
import gnutls.library.functions
45
51
import gnutls.library.constants
46
52
import gnutls.library.types
47
 
import ConfigParser as configparser
 
53
try:
 
54
    import ConfigParser as configparser
 
55
except ImportError:
 
56
    import configparser
48
57
import sys
49
58
import re
50
59
import os
59
68
import struct
60
69
import fcntl
61
70
import functools
62
 
import cPickle as pickle
 
71
try:
 
72
    import cPickle as pickle
 
73
except ImportError:
 
74
    import pickle
63
75
import multiprocessing
 
76
import types
 
77
import binascii
 
78
import tempfile
 
79
import itertools
 
80
import collections
 
81
import codecs
64
82
 
65
83
import dbus
66
84
import dbus.service
67
 
import gobject
 
85
try:
 
86
    import gobject
 
87
except ImportError:
 
88
    from gi.repository import GObject as gobject
68
89
import avahi
69
90
from dbus.mainloop.glib import DBusGMainLoop
70
91
import ctypes
80
101
    except ImportError:
81
102
        SO_BINDTODEVICE = None
82
103
 
83
 
 
84
 
version = "1.2"
85
 
 
86
 
#logger = logging.getLogger(u'mandos')
87
 
logger = logging.Logger(u'mandos')
88
 
syslogger = (logging.handlers.SysLogHandler
89
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
 
              address = "/dev/log"))
91
 
syslogger.setFormatter(logging.Formatter
92
 
                       (u'Mandos [%(process)d]: %(levelname)s:'
93
 
                        u' %(message)s'))
94
 
logger.addHandler(syslogger)
95
 
 
96
 
console = logging.StreamHandler()
97
 
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
 
                                       u' %(levelname)s:'
99
 
                                       u' %(message)s'))
100
 
logger.addHandler(console)
 
104
if sys.version_info.major == 2:
 
105
    str = unicode
 
106
 
 
107
version = "1.6.9"
 
108
stored_state_file = "clients.pickle"
 
109
 
 
110
logger = logging.getLogger()
 
111
syslogger = None
 
112
 
 
113
try:
 
114
    if_nametoindex = ctypes.cdll.LoadLibrary(
 
115
        ctypes.util.find_library("c")).if_nametoindex
 
116
except (OSError, AttributeError):
 
117
    
 
118
    def if_nametoindex(interface):
 
119
        "Get an interface index the hard way, i.e. using fcntl()"
 
120
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
121
        with contextlib.closing(socket.socket()) as s:
 
122
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
123
                                struct.pack(b"16s16x", interface))
 
124
        interface_index = struct.unpack("I", ifreq[16:20])[0]
 
125
        return interface_index
 
126
 
 
127
 
 
128
def initlogger(debug, level=logging.WARNING):
 
129
    """init logger and add loglevel"""
 
130
    
 
131
    global syslogger
 
132
    syslogger = (logging.handlers.SysLogHandler(
 
133
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
134
        address = "/dev/log"))
 
135
    syslogger.setFormatter(logging.Formatter
 
136
                           ('Mandos [%(process)d]: %(levelname)s:'
 
137
                            ' %(message)s'))
 
138
    logger.addHandler(syslogger)
 
139
    
 
140
    if debug:
 
141
        console = logging.StreamHandler()
 
142
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
143
                                               ' [%(process)d]:'
 
144
                                               ' %(levelname)s:'
 
145
                                               ' %(message)s'))
 
146
        logger.addHandler(console)
 
147
    logger.setLevel(level)
 
148
 
 
149
 
 
150
class PGPError(Exception):
 
151
    """Exception if encryption/decryption fails"""
 
152
    pass
 
153
 
 
154
 
 
155
class PGPEngine(object):
 
156
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
157
    
 
158
    def __init__(self):
 
159
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
160
        self.gnupgargs = ['--batch',
 
161
                          '--home', self.tempdir,
 
162
                          '--force-mdc',
 
163
                          '--quiet',
 
164
                          '--no-use-agent']
 
165
    
 
166
    def __enter__(self):
 
167
        return self
 
168
    
 
169
    def __exit__(self, exc_type, exc_value, traceback):
 
170
        self._cleanup()
 
171
        return False
 
172
    
 
173
    def __del__(self):
 
174
        self._cleanup()
 
175
    
 
176
    def _cleanup(self):
 
177
        if self.tempdir is not None:
 
178
            # Delete contents of tempdir
 
179
            for root, dirs, files in os.walk(self.tempdir,
 
180
                                             topdown = False):
 
181
                for filename in files:
 
182
                    os.remove(os.path.join(root, filename))
 
183
                for dirname in dirs:
 
184
                    os.rmdir(os.path.join(root, dirname))
 
185
            # Remove tempdir
 
186
            os.rmdir(self.tempdir)
 
187
            self.tempdir = None
 
188
    
 
189
    def password_encode(self, password):
 
190
        # Passphrase can not be empty and can not contain newlines or
 
191
        # NUL bytes.  So we prefix it and hex encode it.
 
192
        encoded = b"mandos" + binascii.hexlify(password)
 
193
        if len(encoded) > 2048:
 
194
            # GnuPG can't handle long passwords, so encode differently
 
195
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
196
                       .replace(b"\n", b"\\n")
 
197
                       .replace(b"\0", b"\\x00"))
 
198
        return encoded
 
199
    
 
200
    def encrypt(self, data, password):
 
201
        passphrase = self.password_encode(password)
 
202
        with tempfile.NamedTemporaryFile(
 
203
                dir=self.tempdir) as passfile:
 
204
            passfile.write(passphrase)
 
205
            passfile.flush()
 
206
            proc = subprocess.Popen(['gpg', '--symmetric',
 
207
                                     '--passphrase-file',
 
208
                                     passfile.name]
 
209
                                    + self.gnupgargs,
 
210
                                    stdin = subprocess.PIPE,
 
211
                                    stdout = subprocess.PIPE,
 
212
                                    stderr = subprocess.PIPE)
 
213
            ciphertext, err = proc.communicate(input = data)
 
214
        if proc.returncode != 0:
 
215
            raise PGPError(err)
 
216
        return ciphertext
 
217
    
 
218
    def decrypt(self, data, password):
 
219
        passphrase = self.password_encode(password)
 
220
        with tempfile.NamedTemporaryFile(
 
221
                dir = self.tempdir) as passfile:
 
222
            passfile.write(passphrase)
 
223
            passfile.flush()
 
224
            proc = subprocess.Popen(['gpg', '--decrypt',
 
225
                                     '--passphrase-file',
 
226
                                     passfile.name]
 
227
                                    + self.gnupgargs,
 
228
                                    stdin = subprocess.PIPE,
 
229
                                    stdout = subprocess.PIPE,
 
230
                                    stderr = subprocess.PIPE)
 
231
            decrypted_plaintext, err = proc.communicate(input = data)
 
232
        if proc.returncode != 0:
 
233
            raise PGPError(err)
 
234
        return decrypted_plaintext
 
235
 
101
236
 
102
237
class AvahiError(Exception):
103
238
    def __init__(self, value, *args, **kwargs):
104
239
        self.value = value
105
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
106
 
    def __unicode__(self):
107
 
        return unicode(repr(self.value))
 
240
        return super(AvahiError, self).__init__(value, *args,
 
241
                                                **kwargs)
 
242
 
108
243
 
109
244
class AvahiServiceError(AvahiError):
110
245
    pass
111
246
 
 
247
 
112
248
class AvahiGroupError(AvahiError):
113
249
    pass
114
250
 
119
255
    Attributes:
120
256
    interface: integer; avahi.IF_UNSPEC or an interface index.
121
257
               Used to optionally bind to the specified interface.
122
 
    name: string; Example: u'Mandos'
123
 
    type: string; Example: u'_mandos._tcp'.
124
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
258
    name: string; Example: 'Mandos'
 
259
    type: string; Example: '_mandos._tcp'.
 
260
     See <https://www.iana.org/assignments/service-names-port-numbers>
125
261
    port: integer; what port to announce
126
262
    TXT: list of strings; TXT record for the service
127
263
    domain: string; Domain to publish on, default to .local if empty.
133
269
    server: D-Bus Server
134
270
    bus: dbus.SystemBus()
135
271
    """
136
 
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
137
 
                 servicetype = None, port = None, TXT = None,
138
 
                 domain = u"", host = u"", max_renames = 32768,
139
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
272
    
 
273
    def __init__(self,
 
274
                 interface = avahi.IF_UNSPEC,
 
275
                 name = None,
 
276
                 servicetype = None,
 
277
                 port = None,
 
278
                 TXT = None,
 
279
                 domain = "",
 
280
                 host = "",
 
281
                 max_renames = 32768,
 
282
                 protocol = avahi.PROTO_UNSPEC,
 
283
                 bus = None):
140
284
        self.interface = interface
141
285
        self.name = name
142
286
        self.type = servicetype
150
294
        self.group = None       # our entry group
151
295
        self.server = None
152
296
        self.bus = bus
153
 
    def rename(self):
 
297
        self.entry_group_state_changed_match = None
 
298
    
 
299
    def rename(self, remove=True):
154
300
        """Derived from the Avahi example code"""
155
301
        if self.rename_count >= self.max_renames:
156
 
            logger.critical(u"No suitable Zeroconf service name found"
157
 
                            u" after %i retries, exiting.",
 
302
            logger.critical("No suitable Zeroconf service name found"
 
303
                            " after %i retries, exiting.",
158
304
                            self.rename_count)
159
 
            raise AvahiServiceError(u"Too many renames")
160
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
 
        logger.info(u"Changing Zeroconf service name to %r ...",
 
305
            raise AvahiServiceError("Too many renames")
 
306
        self.name = str(
 
307
            self.server.GetAlternativeServiceName(self.name))
 
308
        self.rename_count += 1
 
309
        logger.info("Changing Zeroconf service name to %r ...",
162
310
                    self.name)
163
 
        syslogger.setFormatter(logging.Formatter
164
 
                               (u'Mandos (%s) [%%(process)d]:'
165
 
                                u' %%(levelname)s: %%(message)s'
166
 
                                % self.name))
167
 
        self.remove()
 
311
        if remove:
 
312
            self.remove()
168
313
        try:
169
314
            self.add()
170
 
        except dbus.exceptions.DBusException, error:
171
 
            logger.critical(u"DBusException: %s", error)
172
 
            self.cleanup()
173
 
            os._exit(1)
174
 
        self.rename_count += 1
 
315
        except dbus.exceptions.DBusException as error:
 
316
            if (error.get_dbus_name()
 
317
                == "org.freedesktop.Avahi.CollisionError"):
 
318
                logger.info("Local Zeroconf service name collision.")
 
319
                return self.rename(remove=False)
 
320
            else:
 
321
                logger.critical("D-Bus Exception", exc_info=error)
 
322
                self.cleanup()
 
323
                os._exit(1)
 
324
    
175
325
    def remove(self):
176
326
        """Derived from the Avahi example code"""
 
327
        if self.entry_group_state_changed_match is not None:
 
328
            self.entry_group_state_changed_match.remove()
 
329
            self.entry_group_state_changed_match = None
177
330
        if self.group is not None:
178
331
            self.group.Reset()
 
332
    
179
333
    def add(self):
180
334
        """Derived from the Avahi example code"""
 
335
        self.remove()
181
336
        if self.group is None:
182
337
            self.group = dbus.Interface(
183
338
                self.bus.get_object(avahi.DBUS_NAME,
184
339
                                    self.server.EntryGroupNew()),
185
340
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
186
 
            self.group.connect_to_signal('StateChanged',
187
 
                                         self
188
 
                                         .entry_group_state_changed)
189
 
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
 
341
        self.entry_group_state_changed_match = (
 
342
            self.group.connect_to_signal(
 
343
                'StateChanged', self.entry_group_state_changed))
 
344
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
190
345
                     self.name, self.type)
191
346
        self.group.AddService(
192
347
            self.interface,
197
352
            dbus.UInt16(self.port),
198
353
            avahi.string_array_to_txt_array(self.TXT))
199
354
        self.group.Commit()
 
355
    
200
356
    def entry_group_state_changed(self, state, error):
201
357
        """Derived from the Avahi example code"""
202
 
        logger.debug(u"Avahi entry group state change: %i", state)
 
358
        logger.debug("Avahi entry group state change: %i", state)
203
359
        
204
360
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
 
            logger.debug(u"Zeroconf service established.")
 
361
            logger.debug("Zeroconf service established.")
206
362
        elif state == avahi.ENTRY_GROUP_COLLISION:
207
 
            logger.warning(u"Zeroconf service name collision.")
 
363
            logger.info("Zeroconf service name collision.")
208
364
            self.rename()
209
365
        elif state == avahi.ENTRY_GROUP_FAILURE:
210
 
            logger.critical(u"Avahi: Error in group state changed %s",
211
 
                            unicode(error))
212
 
            raise AvahiGroupError(u"State changed: %s"
213
 
                                  % unicode(error))
 
366
            logger.critical("Avahi: Error in group state changed %s",
 
367
                            str(error))
 
368
            raise AvahiGroupError("State changed: {!s}".format(error))
 
369
    
214
370
    def cleanup(self):
215
371
        """Derived from the Avahi example code"""
216
372
        if self.group is not None:
217
 
            self.group.Free()
 
373
            try:
 
374
                self.group.Free()
 
375
            except (dbus.exceptions.UnknownMethodException,
 
376
                    dbus.exceptions.DBusException):
 
377
                pass
218
378
            self.group = None
219
 
    def server_state_changed(self, state):
 
379
        self.remove()
 
380
    
 
381
    def server_state_changed(self, state, error=None):
220
382
        """Derived from the Avahi example code"""
221
 
        logger.debug(u"Avahi server state change: %i", state)
222
 
        if state == avahi.SERVER_COLLISION:
223
 
            logger.error(u"Zeroconf server name collision")
224
 
            self.remove()
 
383
        logger.debug("Avahi server state change: %i", state)
 
384
        bad_states = {
 
385
            avahi.SERVER_INVALID: "Zeroconf server invalid",
 
386
            avahi.SERVER_REGISTERING: None,
 
387
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
 
388
            avahi.SERVER_FAILURE: "Zeroconf server failure",
 
389
        }
 
390
        if state in bad_states:
 
391
            if bad_states[state] is not None:
 
392
                if error is None:
 
393
                    logger.error(bad_states[state])
 
394
                else:
 
395
                    logger.error(bad_states[state] + ": %r", error)
 
396
            self.cleanup()
225
397
        elif state == avahi.SERVER_RUNNING:
226
 
            self.add()
 
398
            try:
 
399
                self.add()
 
400
            except dbus.exceptions.DBusException as error:
 
401
                if (error.get_dbus_name()
 
402
                    == "org.freedesktop.Avahi.CollisionError"):
 
403
                    logger.info("Local Zeroconf service name"
 
404
                                " collision.")
 
405
                    return self.rename(remove=False)
 
406
                else:
 
407
                    logger.critical("D-Bus Exception", exc_info=error)
 
408
                    self.cleanup()
 
409
                    os._exit(1)
 
410
        else:
 
411
            if error is None:
 
412
                logger.debug("Unknown state: %r", state)
 
413
            else:
 
414
                logger.debug("Unknown state: %r: %r", state, error)
 
415
    
227
416
    def activate(self):
228
417
        """Derived from the Avahi example code"""
229
418
        if self.server is None:
230
419
            self.server = dbus.Interface(
231
420
                self.bus.get_object(avahi.DBUS_NAME,
232
 
                                    avahi.DBUS_PATH_SERVER),
 
421
                                    avahi.DBUS_PATH_SERVER,
 
422
                                    follow_name_owner_changes=True),
233
423
                avahi.DBUS_INTERFACE_SERVER)
234
 
        self.server.connect_to_signal(u"StateChanged",
235
 
                                 self.server_state_changed)
 
424
        self.server.connect_to_signal("StateChanged",
 
425
                                      self.server_state_changed)
236
426
        self.server_state_changed(self.server.GetState())
237
427
 
238
428
 
 
429
class AvahiServiceToSyslog(AvahiService):
 
430
    def rename(self, *args, **kwargs):
 
431
        """Add the new name to the syslog messages"""
 
432
        ret = AvahiService.rename(self, *args, **kwargs)
 
433
        syslogger.setFormatter(logging.Formatter(
 
434
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
435
            .format(self.name)))
 
436
        return ret
 
437
 
 
438
def call_pipe(connection,       # : multiprocessing.Connection
 
439
              func, *args, **kwargs):
 
440
    """This function is meant to be called by multiprocessing.Process
 
441
    
 
442
    This function runs func(*args, **kwargs), and writes the resulting
 
443
    return value on the provided multiprocessing.Connection.
 
444
    """
 
445
    connection.send(func(*args, **kwargs))
 
446
    connection.close()
 
447
 
239
448
class Client(object):
240
449
    """A representation of a client host served by this server.
241
450
    
242
451
    Attributes:
243
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
452
    approved:   bool(); 'None' if not yet approved/disapproved
244
453
    approval_delay: datetime.timedelta(); Time to wait for approval
245
454
    approval_duration: datetime.timedelta(); Duration of one approval
246
455
    checker:    subprocess.Popen(); a running checker process used
253
462
                     instance %(name)s can be used in the command.
254
463
    checker_initiator_tag: a gobject event source tag, or None
255
464
    created:    datetime.datetime(); (UTC) object creation
 
465
    client_structure: Object describing what attributes a client has
 
466
                      and is used for storing the client at exit
256
467
    current_checker_command: string; current running checker_command
257
 
    disable_hook:  If set, called by disable() as disable_hook(self)
258
468
    disable_initiator_tag: a gobject event source tag, or None
259
469
    enabled:    bool()
260
470
    fingerprint: string (40 or 32 hexadecimal digits); used to
263
473
    interval:   datetime.timedelta(); How often to start a new checker
264
474
    last_approval_request: datetime.datetime(); (UTC) or None
265
475
    last_checked_ok: datetime.datetime(); (UTC) or None
266
 
    last_enabled: datetime.datetime(); (UTC)
 
476
    last_checker_status: integer between 0 and 255 reflecting exit
 
477
                         status of last checker. -1 reflects crashed
 
478
                         checker, -2 means no checker completed yet.
 
479
    last_checker_signal: The signal which killed the last checker, if
 
480
                         last_checker_status is -1
 
481
    last_enabled: datetime.datetime(); (UTC) or None
267
482
    name:       string; from the config file, used in log messages and
268
483
                        D-Bus identifiers
269
484
    secret:     bytestring; sent verbatim (over TLS) to client
270
485
    timeout:    datetime.timedelta(); How long from last_checked_ok
271
486
                                      until this client is disabled
 
487
    extended_timeout:   extra long timeout when secret has been sent
272
488
    runtime_expansions: Allowed attributes for runtime expansion.
 
489
    expires:    datetime.datetime(); time (UTC) when a client will be
 
490
                disabled, or None
 
491
    server_settings: The server_settings dict from main()
273
492
    """
274
493
    
275
 
    runtime_expansions = (u"approval_delay", u"approval_duration",
276
 
                          u"created", u"enabled", u"fingerprint",
277
 
                          u"host", u"interval", u"last_checked_ok",
278
 
                          u"last_enabled", u"name", u"timeout")
 
494
    runtime_expansions = ("approval_delay", "approval_duration",
 
495
                          "created", "enabled", "expires",
 
496
                          "fingerprint", "host", "interval",
 
497
                          "last_approval_request", "last_checked_ok",
 
498
                          "last_enabled", "name", "timeout")
 
499
    client_defaults = {
 
500
        "timeout": "PT5M",
 
501
        "extended_timeout": "PT15M",
 
502
        "interval": "PT2M",
 
503
        "checker": "fping -q -- %%(host)s",
 
504
        "host": "",
 
505
        "approval_delay": "PT0S",
 
506
        "approval_duration": "PT1S",
 
507
        "approved_by_default": "True",
 
508
        "enabled": "True",
 
509
    }
279
510
    
280
511
    @staticmethod
281
 
    def _timedelta_to_milliseconds(td):
282
 
        "Convert a datetime.timedelta() to milliseconds"
283
 
        return ((td.days * 24 * 60 * 60 * 1000)
284
 
                + (td.seconds * 1000)
285
 
                + (td.microseconds // 1000))
286
 
    
287
 
    def timeout_milliseconds(self):
288
 
        "Return the 'timeout' attribute in milliseconds"
289
 
        return self._timedelta_to_milliseconds(self.timeout)
290
 
    
291
 
    def interval_milliseconds(self):
292
 
        "Return the 'interval' attribute in milliseconds"
293
 
        return self._timedelta_to_milliseconds(self.interval)
294
 
 
295
 
    def approval_delay_milliseconds(self):
296
 
        return self._timedelta_to_milliseconds(self.approval_delay)
297
 
    
298
 
    def __init__(self, name = None, disable_hook=None, config=None):
299
 
        """Note: the 'checker' key in 'config' sets the
300
 
        'checker_command' attribute and *not* the 'checker'
301
 
        attribute."""
 
512
    def config_parser(config):
 
513
        """Construct a new dict of client settings of this form:
 
514
        { client_name: {setting_name: value, ...}, ...}
 
515
        with exceptions for any special settings as defined above.
 
516
        NOTE: Must be a pure function. Must return the same result
 
517
        value given the same arguments.
 
518
        """
 
519
        settings = {}
 
520
        for client_name in config.sections():
 
521
            section = dict(config.items(client_name))
 
522
            client = settings[client_name] = {}
 
523
            
 
524
            client["host"] = section["host"]
 
525
            # Reformat values from string types to Python types
 
526
            client["approved_by_default"] = config.getboolean(
 
527
                client_name, "approved_by_default")
 
528
            client["enabled"] = config.getboolean(client_name,
 
529
                                                  "enabled")
 
530
            
 
531
            # Uppercase and remove spaces from fingerprint for later
 
532
            # comparison purposes with return value from the
 
533
            # fingerprint() function
 
534
            client["fingerprint"] = (section["fingerprint"].upper()
 
535
                                     .replace(" ", ""))
 
536
            if "secret" in section:
 
537
                client["secret"] = section["secret"].decode("base64")
 
538
            elif "secfile" in section:
 
539
                with open(os.path.expanduser(os.path.expandvars
 
540
                                             (section["secfile"])),
 
541
                          "rb") as secfile:
 
542
                    client["secret"] = secfile.read()
 
543
            else:
 
544
                raise TypeError("No secret or secfile for section {}"
 
545
                                .format(section))
 
546
            client["timeout"] = string_to_delta(section["timeout"])
 
547
            client["extended_timeout"] = string_to_delta(
 
548
                section["extended_timeout"])
 
549
            client["interval"] = string_to_delta(section["interval"])
 
550
            client["approval_delay"] = string_to_delta(
 
551
                section["approval_delay"])
 
552
            client["approval_duration"] = string_to_delta(
 
553
                section["approval_duration"])
 
554
            client["checker_command"] = section["checker"]
 
555
            client["last_approval_request"] = None
 
556
            client["last_checked_ok"] = None
 
557
            client["last_checker_status"] = -2
 
558
        
 
559
        return settings
 
560
    
 
561
    def __init__(self, settings, name = None, server_settings=None):
302
562
        self.name = name
303
 
        if config is None:
304
 
            config = {}
305
 
        logger.debug(u"Creating client %r", self.name)
306
 
        # Uppercase and remove spaces from fingerprint for later
307
 
        # comparison purposes with return value from the fingerprint()
308
 
        # function
309
 
        self.fingerprint = (config[u"fingerprint"].upper()
310
 
                            .replace(u" ", u""))
311
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
312
 
        if u"secret" in config:
313
 
            self.secret = config[u"secret"].decode(u"base64")
314
 
        elif u"secfile" in config:
315
 
            with open(os.path.expanduser(os.path.expandvars
316
 
                                         (config[u"secfile"])),
317
 
                      "rb") as secfile:
318
 
                self.secret = secfile.read()
 
563
        if server_settings is None:
 
564
            server_settings = {}
 
565
        self.server_settings = server_settings
 
566
        # adding all client settings
 
567
        for setting, value in settings.items():
 
568
            setattr(self, setting, value)
 
569
        
 
570
        if self.enabled:
 
571
            if not hasattr(self, "last_enabled"):
 
572
                self.last_enabled = datetime.datetime.utcnow()
 
573
            if not hasattr(self, "expires"):
 
574
                self.expires = (datetime.datetime.utcnow()
 
575
                                + self.timeout)
319
576
        else:
320
 
            raise TypeError(u"No secret or secfile for client %s"
321
 
                            % self.name)
322
 
        self.host = config.get(u"host", u"")
323
 
        self.created = datetime.datetime.utcnow()
324
 
        self.enabled = False
325
 
        self.last_approval_request = None
326
 
        self.last_enabled = None
327
 
        self.last_checked_ok = None
328
 
        self.timeout = string_to_delta(config[u"timeout"])
329
 
        self.interval = string_to_delta(config[u"interval"])
330
 
        self.disable_hook = disable_hook
 
577
            self.last_enabled = None
 
578
            self.expires = None
 
579
        
 
580
        logger.debug("Creating client %r", self.name)
 
581
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
582
        self.created = settings.get("created",
 
583
                                    datetime.datetime.utcnow())
 
584
        
 
585
        # attributes specific for this server instance
331
586
        self.checker = None
332
587
        self.checker_initiator_tag = None
333
588
        self.disable_initiator_tag = None
334
589
        self.checker_callback_tag = None
335
 
        self.checker_command = config[u"checker"]
336
590
        self.current_checker_command = None
337
 
        self.last_connect = None
338
 
        self._approved = None
339
 
        self.approved_by_default = config.get(u"approved_by_default",
340
 
                                              True)
 
591
        self.approved = None
341
592
        self.approvals_pending = 0
342
 
        self.approval_delay = string_to_delta(
343
 
            config[u"approval_delay"])
344
 
        self.approval_duration = string_to_delta(
345
 
            config[u"approval_duration"])
346
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
593
        self.changedstate = multiprocessing_manager.Condition(
 
594
            multiprocessing_manager.Lock())
 
595
        self.client_structure = [attr
 
596
                                 for attr in self.__dict__.iterkeys()
 
597
                                 if not attr.startswith("_")]
 
598
        self.client_structure.append("client_structure")
 
599
        
 
600
        for name, t in inspect.getmembers(
 
601
                type(self), lambda obj: isinstance(obj, property)):
 
602
            if not name.startswith("_"):
 
603
                self.client_structure.append(name)
347
604
    
 
605
    # Send notice to process children that client state has changed
348
606
    def send_changedstate(self):
349
 
        self.changedstate.acquire()
350
 
        self.changedstate.notify_all()
351
 
        self.changedstate.release()
352
 
        
 
607
        with self.changedstate:
 
608
            self.changedstate.notify_all()
 
609
    
353
610
    def enable(self):
354
611
        """Start this client's checker and timeout hooks"""
355
 
        if getattr(self, u"enabled", False):
 
612
        if getattr(self, "enabled", False):
356
613
            # Already enabled
357
614
            return
358
 
        self.send_changedstate()
 
615
        self.expires = datetime.datetime.utcnow() + self.timeout
 
616
        self.enabled = True
359
617
        self.last_enabled = datetime.datetime.utcnow()
360
 
        # Schedule a new checker to be started an 'interval' from now,
361
 
        # and every interval from then on.
362
 
        self.checker_initiator_tag = (gobject.timeout_add
363
 
                                      (self.interval_milliseconds(),
364
 
                                       self.start_checker))
365
 
        # Schedule a disable() when 'timeout' has passed
366
 
        self.disable_initiator_tag = (gobject.timeout_add
367
 
                                   (self.timeout_milliseconds(),
368
 
                                    self.disable))
369
 
        self.enabled = True
370
 
        # Also start a new checker *right now*.
371
 
        self.start_checker()
 
618
        self.init_checker()
 
619
        self.send_changedstate()
372
620
    
373
621
    def disable(self, quiet=True):
374
622
        """Disable this client."""
375
623
        if not getattr(self, "enabled", False):
376
624
            return False
377
625
        if not quiet:
 
626
            logger.info("Disabling client %s", self.name)
 
627
        if getattr(self, "disable_initiator_tag", None) is not None:
 
628
            gobject.source_remove(self.disable_initiator_tag)
 
629
            self.disable_initiator_tag = None
 
630
        self.expires = None
 
631
        if getattr(self, "checker_initiator_tag", None) is not None:
 
632
            gobject.source_remove(self.checker_initiator_tag)
 
633
            self.checker_initiator_tag = None
 
634
        self.stop_checker()
 
635
        self.enabled = False
 
636
        if not quiet:
378
637
            self.send_changedstate()
379
 
        if not quiet:
380
 
            logger.info(u"Disabling client %s", self.name)
381
 
        if getattr(self, u"disable_initiator_tag", False):
382
 
            gobject.source_remove(self.disable_initiator_tag)
383
 
            self.disable_initiator_tag = None
384
 
        if getattr(self, u"checker_initiator_tag", False):
385
 
            gobject.source_remove(self.checker_initiator_tag)
386
 
            self.checker_initiator_tag = None
387
 
        self.stop_checker()
388
 
        if self.disable_hook:
389
 
            self.disable_hook(self)
390
 
        self.enabled = False
391
638
        # Do not run this again if called by a gobject.timeout_add
392
639
        return False
393
640
    
394
641
    def __del__(self):
395
 
        self.disable_hook = None
396
642
        self.disable()
397
643
    
398
 
    def checker_callback(self, pid, condition, command):
 
644
    def init_checker(self):
 
645
        # Schedule a new checker to be started an 'interval' from now,
 
646
        # and every interval from then on.
 
647
        if self.checker_initiator_tag is not None:
 
648
            gobject.source_remove(self.checker_initiator_tag)
 
649
        self.checker_initiator_tag = gobject.timeout_add(
 
650
            int(self.interval.total_seconds() * 1000),
 
651
            self.start_checker)
 
652
        # Schedule a disable() when 'timeout' has passed
 
653
        if self.disable_initiator_tag is not None:
 
654
            gobject.source_remove(self.disable_initiator_tag)
 
655
        self.disable_initiator_tag = gobject.timeout_add(
 
656
            int(self.timeout.total_seconds() * 1000), self.disable)
 
657
        # Also start a new checker *right now*.
 
658
        self.start_checker()
 
659
    
 
660
    def checker_callback(self, source, condition, connection,
 
661
                         command):
399
662
        """The checker has completed, so take appropriate actions."""
400
663
        self.checker_callback_tag = None
401
664
        self.checker = None
402
 
        if os.WIFEXITED(condition):
403
 
            exitstatus = os.WEXITSTATUS(condition)
404
 
            if exitstatus == 0:
405
 
                logger.info(u"Checker for %(name)s succeeded",
 
665
        # Read return code from connection (see call_pipe)
 
666
        returncode = connection.recv()
 
667
        connection.close()
 
668
        
 
669
        if returncode >= 0:
 
670
            self.last_checker_status = returncode
 
671
            self.last_checker_signal = None
 
672
            if self.last_checker_status == 0:
 
673
                logger.info("Checker for %(name)s succeeded",
406
674
                            vars(self))
407
675
                self.checked_ok()
408
676
            else:
409
 
                logger.info(u"Checker for %(name)s failed",
410
 
                            vars(self))
 
677
                logger.info("Checker for %(name)s failed", vars(self))
411
678
        else:
412
 
            logger.warning(u"Checker for %(name)s crashed?",
 
679
            self.last_checker_status = -1
 
680
            self.last_checker_signal = -returncode
 
681
            logger.warning("Checker for %(name)s crashed?",
413
682
                           vars(self))
 
683
        return False
414
684
    
415
685
    def checked_ok(self):
416
 
        """Bump up the timeout for this client.
417
 
        
418
 
        This should only be called when the client has been seen,
419
 
        alive and well.
420
 
        """
 
686
        """Assert that the client has been seen, alive and well."""
421
687
        self.last_checked_ok = datetime.datetime.utcnow()
422
 
        gobject.source_remove(self.disable_initiator_tag)
423
 
        self.disable_initiator_tag = (gobject.timeout_add
424
 
                                      (self.timeout_milliseconds(),
425
 
                                       self.disable))
 
688
        self.last_checker_status = 0
 
689
        self.last_checker_signal = None
 
690
        self.bump_timeout()
 
691
    
 
692
    def bump_timeout(self, timeout=None):
 
693
        """Bump up the timeout for this client."""
 
694
        if timeout is None:
 
695
            timeout = self.timeout
 
696
        if self.disable_initiator_tag is not None:
 
697
            gobject.source_remove(self.disable_initiator_tag)
 
698
            self.disable_initiator_tag = None
 
699
        if getattr(self, "enabled", False):
 
700
            self.disable_initiator_tag = gobject.timeout_add(
 
701
                int(timeout.total_seconds() * 1000), self.disable)
 
702
            self.expires = datetime.datetime.utcnow() + timeout
426
703
    
427
704
    def need_approval(self):
428
705
        self.last_approval_request = datetime.datetime.utcnow()
433
710
        If a checker already exists, leave it running and do
434
711
        nothing."""
435
712
        # The reason for not killing a running checker is that if we
436
 
        # did that, then if a checker (for some reason) started
437
 
        # running slowly and taking more than 'interval' time, the
438
 
        # client would inevitably timeout, since no checker would get
439
 
        # a chance to run to completion.  If we instead leave running
 
713
        # did that, and if a checker (for some reason) started running
 
714
        # slowly and taking more than 'interval' time, then the client
 
715
        # would inevitably timeout, since no checker would get a
 
716
        # chance to run to completion.  If we instead leave running
440
717
        # checkers alone, the checker would have to take more time
441
718
        # than 'timeout' for the client to be disabled, which is as it
442
719
        # should be.
443
720
        
444
 
        # If a checker exists, make sure it is not a zombie
445
 
        try:
446
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
447
 
        except (AttributeError, OSError), error:
448
 
            if (isinstance(error, OSError)
449
 
                and error.errno != errno.ECHILD):
450
 
                raise error
451
 
        else:
452
 
            if pid:
453
 
                logger.warning(u"Checker was a zombie")
454
 
                gobject.source_remove(self.checker_callback_tag)
455
 
                self.checker_callback(pid, status,
456
 
                                      self.current_checker_command)
 
721
        if self.checker is not None and not self.checker.is_alive():
 
722
            logger.warning("Checker was not alive; joining")
 
723
            self.checker.join()
 
724
            self.checker = None
457
725
        # Start a new checker if needed
458
726
        if self.checker is None:
 
727
            # Escape attributes for the shell
 
728
            escaped_attrs = {
 
729
                attr: re.escape(str(getattr(self, attr)))
 
730
                for attr in self.runtime_expansions }
459
731
            try:
460
 
                # In case checker_command has exactly one % operator
461
 
                command = self.checker_command % self.host
462
 
            except TypeError:
463
 
                # Escape attributes for the shell
464
 
                escaped_attrs = dict(
465
 
                    (attr,
466
 
                     re.escape(unicode(str(getattr(self, attr, u"")),
467
 
                                       errors=
468
 
                                       u'replace')))
469
 
                    for attr in
470
 
                    self.runtime_expansions)
471
 
 
472
 
                try:
473
 
                    command = self.checker_command % escaped_attrs
474
 
                except TypeError, error:
475
 
                    logger.error(u'Could not format string "%s":'
476
 
                                 u' %s', self.checker_command, error)
477
 
                    return True # Try again later
 
732
                command = self.checker_command % escaped_attrs
 
733
            except TypeError as error:
 
734
                logger.error('Could not format string "%s"',
 
735
                             self.checker_command,
 
736
                             exc_info=error)
 
737
                return True     # Try again later
478
738
            self.current_checker_command = command
479
 
            try:
480
 
                logger.info(u"Starting checker %r for %s",
481
 
                            command, self.name)
482
 
                # We don't need to redirect stdout and stderr, since
483
 
                # in normal mode, that is already done by daemon(),
484
 
                # and in debug mode we don't want to.  (Stdin is
485
 
                # always replaced by /dev/null.)
486
 
                self.checker = subprocess.Popen(command,
487
 
                                                close_fds=True,
488
 
                                                shell=True, cwd=u"/")
489
 
                self.checker_callback_tag = (gobject.child_watch_add
490
 
                                             (self.checker.pid,
491
 
                                              self.checker_callback,
492
 
                                              data=command))
493
 
                # The checker may have completed before the gobject
494
 
                # watch was added.  Check for this.
495
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
496
 
                if pid:
497
 
                    gobject.source_remove(self.checker_callback_tag)
498
 
                    self.checker_callback(pid, status, command)
499
 
            except OSError, error:
500
 
                logger.error(u"Failed to start subprocess: %s",
501
 
                             error)
 
739
            logger.info("Starting checker %r for %s", command,
 
740
                        self.name)
 
741
            # We don't need to redirect stdout and stderr, since
 
742
            # in normal mode, that is already done by daemon(),
 
743
            # and in debug mode we don't want to.  (Stdin is
 
744
            # always replaced by /dev/null.)
 
745
            # The exception is when not debugging but nevertheless
 
746
            # running in the foreground; use the previously
 
747
            # created wnull.
 
748
            popen_args = { "close_fds": True,
 
749
                           "shell": True,
 
750
                           "cwd": "/" }
 
751
            if (not self.server_settings["debug"]
 
752
                and self.server_settings["foreground"]):
 
753
                popen_args.update({"stdout": wnull,
 
754
                                   "stderr": wnull })
 
755
            pipe = multiprocessing.Pipe(duplex = False)
 
756
            self.checker = multiprocessing.Process(
 
757
                target = call_pipe,
 
758
                args = (pipe[1], subprocess.call, command),
 
759
                kwargs = popen_args)
 
760
            self.checker.start()
 
761
            self.checker_callback_tag = gobject.io_add_watch(
 
762
                pipe[0].fileno(), gobject.IO_IN,
 
763
                self.checker_callback, pipe[0], command)
502
764
        # Re-run this periodically if run by gobject.timeout_add
503
765
        return True
504
766
    
507
769
        if self.checker_callback_tag:
508
770
            gobject.source_remove(self.checker_callback_tag)
509
771
            self.checker_callback_tag = None
510
 
        if getattr(self, u"checker", None) is None:
 
772
        if getattr(self, "checker", None) is None:
511
773
            return
512
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
513
 
        try:
514
 
            os.kill(self.checker.pid, signal.SIGTERM)
515
 
            #time.sleep(0.5)
516
 
            #if self.checker.poll() is None:
517
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
518
 
        except OSError, error:
519
 
            if error.errno != errno.ESRCH: # No such process
520
 
                raise
 
774
        logger.debug("Stopping checker for %(name)s", vars(self))
 
775
        self.checker.terminate()
521
776
        self.checker = None
522
777
 
523
 
def dbus_service_property(dbus_interface, signature=u"v",
524
 
                          access=u"readwrite", byte_arrays=False):
 
778
 
 
779
def dbus_service_property(dbus_interface,
 
780
                          signature="v",
 
781
                          access="readwrite",
 
782
                          byte_arrays=False):
525
783
    """Decorators for marking methods of a DBusObjectWithProperties to
526
784
    become properties on the D-Bus.
527
785
    
534
792
    """
535
793
    # Encoding deeply encoded byte arrays is not supported yet by the
536
794
    # "Set" method, so we fail early here:
537
 
    if byte_arrays and signature != u"ay":
538
 
        raise ValueError(u"Byte arrays not supported for non-'ay'"
539
 
                         u" signature %r" % signature)
 
795
    if byte_arrays and signature != "ay":
 
796
        raise ValueError("Byte arrays not supported for non-'ay'"
 
797
                         " signature {!r}".format(signature))
 
798
    
540
799
    def decorator(func):
541
800
        func._dbus_is_property = True
542
801
        func._dbus_interface = dbus_interface
543
802
        func._dbus_signature = signature
544
803
        func._dbus_access = access
545
804
        func._dbus_name = func.__name__
546
 
        if func._dbus_name.endswith(u"_dbus_property"):
 
805
        if func._dbus_name.endswith("_dbus_property"):
547
806
            func._dbus_name = func._dbus_name[:-14]
548
 
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
549
 
        return func
 
807
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
808
        return func
 
809
    
 
810
    return decorator
 
811
 
 
812
 
 
813
def dbus_interface_annotations(dbus_interface):
 
814
    """Decorator for marking functions returning interface annotations
 
815
    
 
816
    Usage:
 
817
    
 
818
    @dbus_interface_annotations("org.example.Interface")
 
819
    def _foo(self):  # Function name does not matter
 
820
        return {"org.freedesktop.DBus.Deprecated": "true",
 
821
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
822
                    "false"}
 
823
    """
 
824
    
 
825
    def decorator(func):
 
826
        func._dbus_is_interface = True
 
827
        func._dbus_interface = dbus_interface
 
828
        func._dbus_name = dbus_interface
 
829
        return func
 
830
    
 
831
    return decorator
 
832
 
 
833
 
 
834
def dbus_annotations(annotations):
 
835
    """Decorator to annotate D-Bus methods, signals or properties
 
836
    Usage:
 
837
    
 
838
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
 
839
                       "org.freedesktop.DBus.Property."
 
840
                       "EmitsChangedSignal": "false"})
 
841
    @dbus_service_property("org.example.Interface", signature="b",
 
842
                           access="r")
 
843
    def Property_dbus_property(self):
 
844
        return dbus.Boolean(False)
 
845
    """
 
846
    
 
847
    def decorator(func):
 
848
        func._dbus_annotations = annotations
 
849
        return func
 
850
    
550
851
    return decorator
551
852
 
552
853
 
553
854
class DBusPropertyException(dbus.exceptions.DBusException):
554
855
    """A base class for D-Bus property-related exceptions
555
856
    """
556
 
    def __unicode__(self):
557
 
        return unicode(str(self))
 
857
    pass
558
858
 
559
859
 
560
860
class DBusPropertyAccessException(DBusPropertyException):
571
871
 
572
872
class DBusObjectWithProperties(dbus.service.Object):
573
873
    """A D-Bus object with properties.
574
 
 
 
874
    
575
875
    Classes inheriting from this can use the dbus_service_property
576
876
    decorator to expose methods as D-Bus properties.  It exposes the
577
877
    standard Get(), Set(), and GetAll() methods on the D-Bus.
578
878
    """
579
879
    
580
880
    @staticmethod
581
 
    def _is_dbus_property(obj):
582
 
        return getattr(obj, u"_dbus_is_property", False)
 
881
    def _is_dbus_thing(thing):
 
882
        """Returns a function testing if an attribute is a D-Bus thing
 
883
        
 
884
        If called like _is_dbus_thing("method") it returns a function
 
885
        suitable for use as predicate to inspect.getmembers().
 
886
        """
 
887
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
 
888
                                   False)
583
889
    
584
 
    def _get_all_dbus_properties(self):
 
890
    def _get_all_dbus_things(self, thing):
585
891
        """Returns a generator of (name, attribute) pairs
586
892
        """
587
 
        return ((prop._dbus_name, prop)
588
 
                for name, prop in
589
 
                inspect.getmembers(self, self._is_dbus_property))
 
893
        return ((getattr(athing.__get__(self), "_dbus_name", name),
 
894
                 athing.__get__(self))
 
895
                for cls in self.__class__.__mro__
 
896
                for name, athing in
 
897
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
590
898
    
591
899
    def _get_dbus_property(self, interface_name, property_name):
592
900
        """Returns a bound method if one exists which is a D-Bus
593
901
        property with the specified name and interface.
594
902
        """
595
 
        for name in (property_name,
596
 
                     property_name + u"_dbus_property"):
597
 
            prop = getattr(self, name, None)
598
 
            if (prop is None
599
 
                or not self._is_dbus_property(prop)
600
 
                or prop._dbus_name != property_name
601
 
                or (interface_name and prop._dbus_interface
602
 
                    and interface_name != prop._dbus_interface)):
603
 
                continue
604
 
            return prop
 
903
        for cls in self.__class__.__mro__:
 
904
            for name, value in inspect.getmembers(
 
905
                    cls, self._is_dbus_thing("property")):
 
906
                if (value._dbus_name == property_name
 
907
                    and value._dbus_interface == interface_name):
 
908
                    return value.__get__(self)
 
909
        
605
910
        # No such property
606
 
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
607
 
                                   + interface_name + u"."
608
 
                                   + property_name)
 
911
        raise DBusPropertyNotFound("{}:{}.{}".format(
 
912
            self.dbus_object_path, interface_name, property_name))
609
913
    
610
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
611
 
                         out_signature=u"v")
 
914
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
915
                         in_signature="ss",
 
916
                         out_signature="v")
612
917
    def Get(self, interface_name, property_name):
613
918
        """Standard D-Bus property Get() method, see D-Bus standard.
614
919
        """
615
920
        prop = self._get_dbus_property(interface_name, property_name)
616
 
        if prop._dbus_access == u"write":
 
921
        if prop._dbus_access == "write":
617
922
            raise DBusPropertyAccessException(property_name)
618
923
        value = prop()
619
 
        if not hasattr(value, u"variant_level"):
 
924
        if not hasattr(value, "variant_level"):
620
925
            return value
621
926
        return type(value)(value, variant_level=value.variant_level+1)
622
927
    
623
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
 
928
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
624
929
    def Set(self, interface_name, property_name, value):
625
930
        """Standard D-Bus property Set() method, see D-Bus standard.
626
931
        """
627
932
        prop = self._get_dbus_property(interface_name, property_name)
628
 
        if prop._dbus_access == u"read":
 
933
        if prop._dbus_access == "read":
629
934
            raise DBusPropertyAccessException(property_name)
630
 
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
935
        if prop._dbus_get_args_options["byte_arrays"]:
631
936
            # The byte_arrays option is not supported yet on
632
937
            # signatures other than "ay".
633
 
            if prop._dbus_signature != u"ay":
634
 
                raise ValueError
635
 
            value = dbus.ByteArray(''.join(unichr(byte)
636
 
                                           for byte in value))
 
938
            if prop._dbus_signature != "ay":
 
939
                raise ValueError("Byte arrays not supported for non-"
 
940
                                 "'ay' signature {!r}"
 
941
                                 .format(prop._dbus_signature))
 
942
            value = dbus.ByteArray(b''.join(chr(byte)
 
943
                                            for byte in value))
637
944
        prop(value)
638
945
    
639
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
640
 
                         out_signature=u"a{sv}")
 
946
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
947
                         in_signature="s",
 
948
                         out_signature="a{sv}")
641
949
    def GetAll(self, interface_name):
642
950
        """Standard D-Bus property GetAll() method, see D-Bus
643
951
        standard.
644
 
 
 
952
        
645
953
        Note: Will not include properties with access="write".
646
954
        """
647
 
        all = {}
648
 
        for name, prop in self._get_all_dbus_properties():
 
955
        properties = {}
 
956
        for name, prop in self._get_all_dbus_things("property"):
649
957
            if (interface_name
650
958
                and interface_name != prop._dbus_interface):
651
959
                # Interface non-empty but did not match
652
960
                continue
653
961
            # Ignore write-only properties
654
 
            if prop._dbus_access == u"write":
 
962
            if prop._dbus_access == "write":
655
963
                continue
656
964
            value = prop()
657
 
            if not hasattr(value, u"variant_level"):
658
 
                all[name] = value
 
965
            if not hasattr(value, "variant_level"):
 
966
                properties[name] = value
659
967
                continue
660
 
            all[name] = type(value)(value, variant_level=
661
 
                                    value.variant_level+1)
662
 
        return dbus.Dictionary(all, signature=u"sv")
 
968
            properties[name] = type(value)(
 
969
                value, variant_level = value.variant_level + 1)
 
970
        return dbus.Dictionary(properties, signature="sv")
 
971
    
 
972
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
 
973
    def PropertiesChanged(self, interface_name, changed_properties,
 
974
                          invalidated_properties):
 
975
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
 
976
        standard.
 
977
        """
 
978
        pass
663
979
    
664
980
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
665
 
                         out_signature=u"s",
 
981
                         out_signature="s",
666
982
                         path_keyword='object_path',
667
983
                         connection_keyword='connection')
668
984
    def Introspect(self, object_path, connection):
669
 
        """Standard D-Bus method, overloaded to insert property tags.
 
985
        """Overloading of standard D-Bus method.
 
986
        
 
987
        Inserts property tags and interface annotation tags.
670
988
        """
671
989
        xmlstring = dbus.service.Object.Introspect(self, object_path,
672
990
                                                   connection)
673
991
        try:
674
992
            document = xml.dom.minidom.parseString(xmlstring)
 
993
            
675
994
            def make_tag(document, name, prop):
676
 
                e = document.createElement(u"property")
677
 
                e.setAttribute(u"name", name)
678
 
                e.setAttribute(u"type", prop._dbus_signature)
679
 
                e.setAttribute(u"access", prop._dbus_access)
 
995
                e = document.createElement("property")
 
996
                e.setAttribute("name", name)
 
997
                e.setAttribute("type", prop._dbus_signature)
 
998
                e.setAttribute("access", prop._dbus_access)
680
999
                return e
681
 
            for if_tag in document.getElementsByTagName(u"interface"):
 
1000
            
 
1001
            for if_tag in document.getElementsByTagName("interface"):
 
1002
                # Add property tags
682
1003
                for tag in (make_tag(document, name, prop)
683
1004
                            for name, prop
684
 
                            in self._get_all_dbus_properties()
 
1005
                            in self._get_all_dbus_things("property")
685
1006
                            if prop._dbus_interface
686
 
                            == if_tag.getAttribute(u"name")):
 
1007
                            == if_tag.getAttribute("name")):
687
1008
                    if_tag.appendChild(tag)
 
1009
                # Add annotation tags
 
1010
                for typ in ("method", "signal", "property"):
 
1011
                    for tag in if_tag.getElementsByTagName(typ):
 
1012
                        annots = dict()
 
1013
                        for name, prop in (self.
 
1014
                                           _get_all_dbus_things(typ)):
 
1015
                            if (name == tag.getAttribute("name")
 
1016
                                and prop._dbus_interface
 
1017
                                == if_tag.getAttribute("name")):
 
1018
                                annots.update(getattr(
 
1019
                                    prop, "_dbus_annotations", {}))
 
1020
                        for name, value in annots.items():
 
1021
                            ann_tag = document.createElement(
 
1022
                                "annotation")
 
1023
                            ann_tag.setAttribute("name", name)
 
1024
                            ann_tag.setAttribute("value", value)
 
1025
                            tag.appendChild(ann_tag)
 
1026
                # Add interface annotation tags
 
1027
                for annotation, value in dict(
 
1028
                    itertools.chain.from_iterable(
 
1029
                        annotations().items()
 
1030
                        for name, annotations
 
1031
                        in self._get_all_dbus_things("interface")
 
1032
                        if name == if_tag.getAttribute("name")
 
1033
                        )).items():
 
1034
                    ann_tag = document.createElement("annotation")
 
1035
                    ann_tag.setAttribute("name", annotation)
 
1036
                    ann_tag.setAttribute("value", value)
 
1037
                    if_tag.appendChild(ann_tag)
688
1038
                # Add the names to the return values for the
689
1039
                # "org.freedesktop.DBus.Properties" methods
690
 
                if (if_tag.getAttribute(u"name")
691
 
                    == u"org.freedesktop.DBus.Properties"):
692
 
                    for cn in if_tag.getElementsByTagName(u"method"):
693
 
                        if cn.getAttribute(u"name") == u"Get":
694
 
                            for arg in cn.getElementsByTagName(u"arg"):
695
 
                                if (arg.getAttribute(u"direction")
696
 
                                    == u"out"):
697
 
                                    arg.setAttribute(u"name", u"value")
698
 
                        elif cn.getAttribute(u"name") == u"GetAll":
699
 
                            for arg in cn.getElementsByTagName(u"arg"):
700
 
                                if (arg.getAttribute(u"direction")
701
 
                                    == u"out"):
702
 
                                    arg.setAttribute(u"name", u"props")
703
 
            xmlstring = document.toxml(u"utf-8")
 
1040
                if (if_tag.getAttribute("name")
 
1041
                    == "org.freedesktop.DBus.Properties"):
 
1042
                    for cn in if_tag.getElementsByTagName("method"):
 
1043
                        if cn.getAttribute("name") == "Get":
 
1044
                            for arg in cn.getElementsByTagName("arg"):
 
1045
                                if (arg.getAttribute("direction")
 
1046
                                    == "out"):
 
1047
                                    arg.setAttribute("name", "value")
 
1048
                        elif cn.getAttribute("name") == "GetAll":
 
1049
                            for arg in cn.getElementsByTagName("arg"):
 
1050
                                if (arg.getAttribute("direction")
 
1051
                                    == "out"):
 
1052
                                    arg.setAttribute("name", "props")
 
1053
            xmlstring = document.toxml("utf-8")
704
1054
            document.unlink()
705
1055
        except (AttributeError, xml.dom.DOMException,
706
 
                xml.parsers.expat.ExpatError), error:
707
 
            logger.error(u"Failed to override Introspection method",
708
 
                         error)
 
1056
                xml.parsers.expat.ExpatError) as error:
 
1057
            logger.error("Failed to override Introspection method",
 
1058
                         exc_info=error)
709
1059
        return xmlstring
710
1060
 
711
1061
 
 
1062
def datetime_to_dbus(dt, variant_level=0):
 
1063
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
1064
    if dt is None:
 
1065
        return dbus.String("", variant_level = variant_level)
 
1066
    return dbus.String(dt.isoformat(), variant_level=variant_level)
 
1067
 
 
1068
 
 
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1070
    """A class decorator; applied to a subclass of
 
1071
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1072
    interface names according to the "alt_interface_names" mapping.
 
1073
    Usage:
 
1074
    
 
1075
    @alternate_dbus_interfaces({"org.example.Interface":
 
1076
                                    "net.example.AlternateInterface"})
 
1077
    class SampleDBusObject(dbus.service.Object):
 
1078
        @dbus.service.method("org.example.Interface")
 
1079
        def SampleDBusMethod():
 
1080
            pass
 
1081
    
 
1082
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1083
    reachable via two interfaces: "org.example.Interface" and
 
1084
    "net.example.AlternateInterface", the latter of which will have
 
1085
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1086
    "true", unless "deprecate" is passed with a False value.
 
1087
    
 
1088
    This works for methods and signals, and also for D-Bus properties
 
1089
    (from DBusObjectWithProperties) and interfaces (from the
 
1090
    dbus_interface_annotations decorator).
 
1091
    """
 
1092
    
 
1093
    def wrapper(cls):
 
1094
        for orig_interface_name, alt_interface_name in (
 
1095
                alt_interface_names.items()):
 
1096
            attr = {}
 
1097
            interface_names = set()
 
1098
            # Go though all attributes of the class
 
1099
            for attrname, attribute in inspect.getmembers(cls):
 
1100
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
1101
                # with the wrong interface name
 
1102
                if (not hasattr(attribute, "_dbus_interface")
 
1103
                    or not attribute._dbus_interface.startswith(
 
1104
                        orig_interface_name)):
 
1105
                    continue
 
1106
                # Create an alternate D-Bus interface name based on
 
1107
                # the current name
 
1108
                alt_interface = attribute._dbus_interface.replace(
 
1109
                    orig_interface_name, alt_interface_name)
 
1110
                interface_names.add(alt_interface)
 
1111
                # Is this a D-Bus signal?
 
1112
                if getattr(attribute, "_dbus_is_signal", False):
 
1113
                    if sys.version_info.major == 2:
 
1114
                        # Extract the original non-method undecorated
 
1115
                        # function by black magic
 
1116
                        nonmethod_func = (dict(
 
1117
                            zip(attribute.func_code.co_freevars,
 
1118
                                attribute.__closure__))
 
1119
                                          ["func"].cell_contents)
 
1120
                    else:
 
1121
                        nonmethod_func = attribute
 
1122
                    # Create a new, but exactly alike, function
 
1123
                    # object, and decorate it to be a new D-Bus signal
 
1124
                    # with the alternate D-Bus interface name
 
1125
                    if sys.version_info.major == 2:
 
1126
                        new_function = types.FunctionType(
 
1127
                            nonmethod_func.func_code,
 
1128
                            nonmethod_func.func_globals,
 
1129
                            nonmethod_func.func_name,
 
1130
                            nonmethod_func.func_defaults,
 
1131
                            nonmethod_func.func_closure)
 
1132
                    else:
 
1133
                        new_function = types.FunctionType(
 
1134
                            nonmethod_func.__code__,
 
1135
                            nonmethod_func.__globals__,
 
1136
                            nonmethod_func.__name__,
 
1137
                            nonmethod_func.__defaults__,
 
1138
                            nonmethod_func.__closure__)
 
1139
                    new_function = (dbus.service.signal(
 
1140
                        alt_interface,
 
1141
                        attribute._dbus_signature)(new_function))
 
1142
                    # Copy annotations, if any
 
1143
                    try:
 
1144
                        new_function._dbus_annotations = dict(
 
1145
                            attribute._dbus_annotations)
 
1146
                    except AttributeError:
 
1147
                        pass
 
1148
                    # Define a creator of a function to call both the
 
1149
                    # original and alternate functions, so both the
 
1150
                    # original and alternate signals gets sent when
 
1151
                    # the function is called
 
1152
                    def fixscope(func1, func2):
 
1153
                        """This function is a scope container to pass
 
1154
                        func1 and func2 to the "call_both" function
 
1155
                        outside of its arguments"""
 
1156
                        
 
1157
                        def call_both(*args, **kwargs):
 
1158
                            """This function will emit two D-Bus
 
1159
                            signals by calling func1 and func2"""
 
1160
                            func1(*args, **kwargs)
 
1161
                            func2(*args, **kwargs)
 
1162
                        
 
1163
                        return call_both
 
1164
                    # Create the "call_both" function and add it to
 
1165
                    # the class
 
1166
                    attr[attrname] = fixscope(attribute, new_function)
 
1167
                # Is this a D-Bus method?
 
1168
                elif getattr(attribute, "_dbus_is_method", False):
 
1169
                    # Create a new, but exactly alike, function
 
1170
                    # object.  Decorate it to be a new D-Bus method
 
1171
                    # with the alternate D-Bus interface name.  Add it
 
1172
                    # to the class.
 
1173
                    attr[attrname] = (
 
1174
                        dbus.service.method(
 
1175
                            alt_interface,
 
1176
                            attribute._dbus_in_signature,
 
1177
                            attribute._dbus_out_signature)
 
1178
                        (types.FunctionType(attribute.func_code,
 
1179
                                            attribute.func_globals,
 
1180
                                            attribute.func_name,
 
1181
                                            attribute.func_defaults,
 
1182
                                            attribute.func_closure)))
 
1183
                    # Copy annotations, if any
 
1184
                    try:
 
1185
                        attr[attrname]._dbus_annotations = dict(
 
1186
                            attribute._dbus_annotations)
 
1187
                    except AttributeError:
 
1188
                        pass
 
1189
                # Is this a D-Bus property?
 
1190
                elif getattr(attribute, "_dbus_is_property", False):
 
1191
                    # Create a new, but exactly alike, function
 
1192
                    # object, and decorate it to be a new D-Bus
 
1193
                    # property with the alternate D-Bus interface
 
1194
                    # name.  Add it to the class.
 
1195
                    attr[attrname] = (dbus_service_property(
 
1196
                        alt_interface, attribute._dbus_signature,
 
1197
                        attribute._dbus_access,
 
1198
                        attribute._dbus_get_args_options
 
1199
                        ["byte_arrays"])
 
1200
                                      (types.FunctionType(
 
1201
                                          attribute.func_code,
 
1202
                                          attribute.func_globals,
 
1203
                                          attribute.func_name,
 
1204
                                          attribute.func_defaults,
 
1205
                                          attribute.func_closure)))
 
1206
                    # Copy annotations, if any
 
1207
                    try:
 
1208
                        attr[attrname]._dbus_annotations = dict(
 
1209
                            attribute._dbus_annotations)
 
1210
                    except AttributeError:
 
1211
                        pass
 
1212
                # Is this a D-Bus interface?
 
1213
                elif getattr(attribute, "_dbus_is_interface", False):
 
1214
                    # Create a new, but exactly alike, function
 
1215
                    # object.  Decorate it to be a new D-Bus interface
 
1216
                    # with the alternate D-Bus interface name.  Add it
 
1217
                    # to the class.
 
1218
                    attr[attrname] = (
 
1219
                        dbus_interface_annotations(alt_interface)
 
1220
                        (types.FunctionType(attribute.func_code,
 
1221
                                            attribute.func_globals,
 
1222
                                            attribute.func_name,
 
1223
                                            attribute.func_defaults,
 
1224
                                            attribute.func_closure)))
 
1225
            if deprecate:
 
1226
                # Deprecate all alternate interfaces
 
1227
                iname="_AlternateDBusNames_interface_annotation{}"
 
1228
                for interface_name in interface_names:
 
1229
                    
 
1230
                    @dbus_interface_annotations(interface_name)
 
1231
                    def func(self):
 
1232
                        return { "org.freedesktop.DBus.Deprecated":
 
1233
                                 "true" }
 
1234
                    # Find an unused name
 
1235
                    for aname in (iname.format(i)
 
1236
                                  for i in itertools.count()):
 
1237
                        if aname not in attr:
 
1238
                            attr[aname] = func
 
1239
                            break
 
1240
            if interface_names:
 
1241
                # Replace the class with a new subclass of it with
 
1242
                # methods, signals, etc. as created above.
 
1243
                cls = type(b"{}Alternate".format(cls.__name__),
 
1244
                           (cls, ), attr)
 
1245
        return cls
 
1246
    
 
1247
    return wrapper
 
1248
 
 
1249
 
 
1250
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1251
                            "se.bsnet.fukt.Mandos"})
712
1252
class ClientDBus(Client, DBusObjectWithProperties):
713
1253
    """A Client class using D-Bus
714
1254
    
718
1258
    """
719
1259
    
720
1260
    runtime_expansions = (Client.runtime_expansions
721
 
                          + (u"dbus_object_path",))
 
1261
                          + ("dbus_object_path", ))
 
1262
    
 
1263
    _interface = "se.recompile.Mandos.Client"
722
1264
    
723
1265
    # dbus.service.Object doesn't use super(), so we can't either.
724
1266
    
725
1267
    def __init__(self, bus = None, *args, **kwargs):
726
 
        self._approvals_pending = 0
727
1268
        self.bus = bus
728
1269
        Client.__init__(self, *args, **kwargs)
729
1270
        # Only now, when this client is initialized, can it show up on
730
1271
        # the D-Bus
731
 
        client_object_name = unicode(self.name).translate(
732
 
            {ord(u"."): ord(u"_"),
733
 
             ord(u"-"): ord(u"_")})
734
 
        self.dbus_object_path = (dbus.ObjectPath
735
 
                                 (u"/clients/" + client_object_name))
 
1272
        client_object_name = str(self.name).translate(
 
1273
            {ord("."): ord("_"),
 
1274
             ord("-"): ord("_")})
 
1275
        self.dbus_object_path = dbus.ObjectPath(
 
1276
            "/clients/" + client_object_name)
736
1277
        DBusObjectWithProperties.__init__(self, self.bus,
737
1278
                                          self.dbus_object_path)
738
 
        
739
 
    def _get_approvals_pending(self):
740
 
        return self._approvals_pending
741
 
    def _set_approvals_pending(self, value):
742
 
        old_value = self._approvals_pending
743
 
        self._approvals_pending = value
744
 
        bval = bool(value)
745
 
        if (hasattr(self, "dbus_object_path")
746
 
            and bval is not bool(old_value)):
747
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
748
 
            self.PropertyChanged(dbus.String(u"ApprovalPending"),
749
 
                                 dbus_bool)
750
 
 
751
 
    approvals_pending = property(_get_approvals_pending,
752
 
                                 _set_approvals_pending)
753
 
    del _get_approvals_pending, _set_approvals_pending
754
 
    
755
 
    @staticmethod
756
 
    def _datetime_to_dbus(dt, variant_level=0):
757
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
758
 
        return dbus.String(dt.isoformat(),
759
 
                           variant_level=variant_level)
760
 
    
761
 
    def enable(self):
762
 
        oldstate = getattr(self, u"enabled", False)
763
 
        r = Client.enable(self)
764
 
        if oldstate != self.enabled:
765
 
            # Emit D-Bus signals
766
 
            self.PropertyChanged(dbus.String(u"Enabled"),
767
 
                                 dbus.Boolean(True, variant_level=1))
768
 
            self.PropertyChanged(
769
 
                dbus.String(u"LastEnabled"),
770
 
                self._datetime_to_dbus(self.last_enabled,
771
 
                                       variant_level=1))
772
 
        return r
773
 
    
774
 
    def disable(self, quiet = False):
775
 
        oldstate = getattr(self, u"enabled", False)
776
 
        r = Client.disable(self, quiet=quiet)
777
 
        if not quiet and oldstate != self.enabled:
778
 
            # Emit D-Bus signal
779
 
            self.PropertyChanged(dbus.String(u"Enabled"),
780
 
                                 dbus.Boolean(False, variant_level=1))
781
 
        return r
 
1279
    
 
1280
    def notifychangeproperty(transform_func, dbus_name,
 
1281
                             type_func=lambda x: x,
 
1282
                             variant_level=1,
 
1283
                             invalidate_only=False,
 
1284
                             _interface=_interface):
 
1285
        """ Modify a variable so that it's a property which announces
 
1286
        its changes to DBus.
 
1287
        
 
1288
        transform_fun: Function that takes a value and a variant_level
 
1289
                       and transforms it to a D-Bus type.
 
1290
        dbus_name: D-Bus name of the variable
 
1291
        type_func: Function that transform the value before sending it
 
1292
                   to the D-Bus.  Default: no transform
 
1293
        variant_level: D-Bus variant level.  Default: 1
 
1294
        """
 
1295
        attrname = "_{}".format(dbus_name)
 
1296
        
 
1297
        def setter(self, value):
 
1298
            if hasattr(self, "dbus_object_path"):
 
1299
                if (not hasattr(self, attrname) or
 
1300
                    type_func(getattr(self, attrname, None))
 
1301
                    != type_func(value)):
 
1302
                    if invalidate_only:
 
1303
                        self.PropertiesChanged(
 
1304
                            _interface, dbus.Dictionary(),
 
1305
                            dbus.Array((dbus_name, )))
 
1306
                    else:
 
1307
                        dbus_value = transform_func(
 
1308
                            type_func(value),
 
1309
                            variant_level = variant_level)
 
1310
                        self.PropertyChanged(dbus.String(dbus_name),
 
1311
                                             dbus_value)
 
1312
                        self.PropertiesChanged(
 
1313
                            _interface,
 
1314
                            dbus.Dictionary({ dbus.String(dbus_name):
 
1315
                                              dbus_value }),
 
1316
                            dbus.Array())
 
1317
            setattr(self, attrname, value)
 
1318
        
 
1319
        return property(lambda self: getattr(self, attrname), setter)
 
1320
    
 
1321
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1322
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1323
                                             "ApprovalPending",
 
1324
                                             type_func = bool)
 
1325
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1326
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1327
                                        "LastEnabled")
 
1328
    checker = notifychangeproperty(
 
1329
        dbus.Boolean, "CheckerRunning",
 
1330
        type_func = lambda checker: checker is not None)
 
1331
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1332
                                           "LastCheckedOK")
 
1333
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1334
                                               "LastCheckerStatus")
 
1335
    last_approval_request = notifychangeproperty(
 
1336
        datetime_to_dbus, "LastApprovalRequest")
 
1337
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1338
                                               "ApprovedByDefault")
 
1339
    approval_delay = notifychangeproperty(
 
1340
        dbus.UInt64, "ApprovalDelay",
 
1341
        type_func = lambda td: td.total_seconds() * 1000)
 
1342
    approval_duration = notifychangeproperty(
 
1343
        dbus.UInt64, "ApprovalDuration",
 
1344
        type_func = lambda td: td.total_seconds() * 1000)
 
1345
    host = notifychangeproperty(dbus.String, "Host")
 
1346
    timeout = notifychangeproperty(
 
1347
        dbus.UInt64, "Timeout",
 
1348
        type_func = lambda td: td.total_seconds() * 1000)
 
1349
    extended_timeout = notifychangeproperty(
 
1350
        dbus.UInt64, "ExtendedTimeout",
 
1351
        type_func = lambda td: td.total_seconds() * 1000)
 
1352
    interval = notifychangeproperty(
 
1353
        dbus.UInt64, "Interval",
 
1354
        type_func = lambda td: td.total_seconds() * 1000)
 
1355
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1356
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
 
1357
                                  invalidate_only=True)
 
1358
    
 
1359
    del notifychangeproperty
782
1360
    
783
1361
    def __del__(self, *args, **kwargs):
784
1362
        try:
785
1363
            self.remove_from_connection()
786
1364
        except LookupError:
787
1365
            pass
788
 
        if hasattr(DBusObjectWithProperties, u"__del__"):
 
1366
        if hasattr(DBusObjectWithProperties, "__del__"):
789
1367
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
790
1368
        Client.__del__(self, *args, **kwargs)
791
1369
    
792
 
    def checker_callback(self, pid, condition, command,
793
 
                         *args, **kwargs):
794
 
        self.checker_callback_tag = None
795
 
        self.checker = None
796
 
        # Emit D-Bus signal
797
 
        self.PropertyChanged(dbus.String(u"CheckerRunning"),
798
 
                             dbus.Boolean(False, variant_level=1))
799
 
        if os.WIFEXITED(condition):
800
 
            exitstatus = os.WEXITSTATUS(condition)
 
1370
    def checker_callback(self, source, condition,
 
1371
                         connection, command, *args, **kwargs):
 
1372
        ret = Client.checker_callback(self, source, condition,
 
1373
                                      connection, command, *args,
 
1374
                                      **kwargs)
 
1375
        exitstatus = self.last_checker_status
 
1376
        if exitstatus >= 0:
801
1377
            # Emit D-Bus signal
802
1378
            self.CheckerCompleted(dbus.Int16(exitstatus),
803
 
                                  dbus.Int64(condition),
 
1379
                                  dbus.Int64(0),
804
1380
                                  dbus.String(command))
805
1381
        else:
806
1382
            # Emit D-Bus signal
807
1383
            self.CheckerCompleted(dbus.Int16(-1),
808
 
                                  dbus.Int64(condition),
 
1384
                                  dbus.Int64(
 
1385
                                      self.last_checker_signal),
809
1386
                                  dbus.String(command))
810
 
        
811
 
        return Client.checker_callback(self, pid, condition, command,
812
 
                                       *args, **kwargs)
813
 
    
814
 
    def checked_ok(self, *args, **kwargs):
815
 
        r = Client.checked_ok(self, *args, **kwargs)
816
 
        # Emit D-Bus signal
817
 
        self.PropertyChanged(
818
 
            dbus.String(u"LastCheckedOK"),
819
 
            (self._datetime_to_dbus(self.last_checked_ok,
820
 
                                    variant_level=1)))
821
 
        return r
822
 
    
823
 
    def need_approval(self, *args, **kwargs):
824
 
        r = Client.need_approval(self, *args, **kwargs)
825
 
        # Emit D-Bus signal
826
 
        self.PropertyChanged(
827
 
            dbus.String(u"LastApprovalRequest"),
828
 
            (self._datetime_to_dbus(self.last_approval_request,
829
 
                                    variant_level=1)))
830
 
        return r
 
1387
        return ret
831
1388
    
832
1389
    def start_checker(self, *args, **kwargs):
833
 
        old_checker = self.checker
834
 
        if self.checker is not None:
835
 
            old_checker_pid = self.checker.pid
836
 
        else:
837
 
            old_checker_pid = None
 
1390
        old_checker_pid = getattr(self.checker, "pid", None)
838
1391
        r = Client.start_checker(self, *args, **kwargs)
839
1392
        # Only if new checker process was started
840
1393
        if (self.checker is not None
841
1394
            and old_checker_pid != self.checker.pid):
842
1395
            # Emit D-Bus signal
843
1396
            self.CheckerStarted(self.current_checker_command)
844
 
            self.PropertyChanged(
845
 
                dbus.String(u"CheckerRunning"),
846
 
                dbus.Boolean(True, variant_level=1))
847
1397
        return r
848
1398
    
849
 
    def stop_checker(self, *args, **kwargs):
850
 
        old_checker = getattr(self, u"checker", None)
851
 
        r = Client.stop_checker(self, *args, **kwargs)
852
 
        if (old_checker is not None
853
 
            and getattr(self, u"checker", None) is None):
854
 
            self.PropertyChanged(dbus.String(u"CheckerRunning"),
855
 
                                 dbus.Boolean(False, variant_level=1))
856
 
        return r
857
 
 
858
1399
    def _reset_approved(self):
859
 
        self._approved = None
 
1400
        self.approved = None
860
1401
        return False
861
1402
    
862
1403
    def approve(self, value=True):
 
1404
        self.approved = value
 
1405
        gobject.timeout_add(int(self.approval_duration.total_seconds()
 
1406
                                * 1000), self._reset_approved)
863
1407
        self.send_changedstate()
864
 
        self._approved = value
865
 
        gobject.timeout_add(self._timedelta_to_milliseconds
866
 
                            (self.approval_duration),
867
 
                            self._reset_approved)
868
 
    
869
1408
    
870
1409
    ## D-Bus methods, signals & properties
871
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
 
1410
    
 
1411
    ## Interfaces
872
1412
    
873
1413
    ## Signals
874
1414
    
875
1415
    # CheckerCompleted - signal
876
 
    @dbus.service.signal(_interface, signature=u"nxs")
 
1416
    @dbus.service.signal(_interface, signature="nxs")
877
1417
    def CheckerCompleted(self, exitcode, waitstatus, command):
878
1418
        "D-Bus signal"
879
1419
        pass
880
1420
    
881
1421
    # CheckerStarted - signal
882
 
    @dbus.service.signal(_interface, signature=u"s")
 
1422
    @dbus.service.signal(_interface, signature="s")
883
1423
    def CheckerStarted(self, command):
884
1424
        "D-Bus signal"
885
1425
        pass
886
1426
    
887
1427
    # PropertyChanged - signal
888
 
    @dbus.service.signal(_interface, signature=u"sv")
 
1428
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
 
1429
    @dbus.service.signal(_interface, signature="sv")
889
1430
    def PropertyChanged(self, property, value):
890
1431
        "D-Bus signal"
891
1432
        pass
900
1441
        pass
901
1442
    
902
1443
    # Rejected - signal
903
 
    @dbus.service.signal(_interface, signature=u"s")
 
1444
    @dbus.service.signal(_interface, signature="s")
904
1445
    def Rejected(self, reason):
905
1446
        "D-Bus signal"
906
1447
        pass
907
1448
    
908
1449
    # NeedApproval - signal
909
 
    @dbus.service.signal(_interface, signature=u"tb")
 
1450
    @dbus.service.signal(_interface, signature="tb")
910
1451
    def NeedApproval(self, timeout, default):
911
1452
        "D-Bus signal"
912
1453
        return self.need_approval()
914
1455
    ## Methods
915
1456
    
916
1457
    # Approve - method
917
 
    @dbus.service.method(_interface, in_signature=u"b")
 
1458
    @dbus.service.method(_interface, in_signature="b")
918
1459
    def Approve(self, value):
919
1460
        self.approve(value)
920
1461
    
921
1462
    # CheckedOK - method
922
1463
    @dbus.service.method(_interface)
923
1464
    def CheckedOK(self):
924
 
        return self.checked_ok()
 
1465
        self.checked_ok()
925
1466
    
926
1467
    # Enable - method
927
1468
    @dbus.service.method(_interface)
949
1490
    ## Properties
950
1491
    
951
1492
    # ApprovalPending - property
952
 
    @dbus_service_property(_interface, signature=u"b", access=u"read")
 
1493
    @dbus_service_property(_interface, signature="b", access="read")
953
1494
    def ApprovalPending_dbus_property(self):
954
1495
        return dbus.Boolean(bool(self.approvals_pending))
955
1496
    
956
1497
    # ApprovedByDefault - property
957
 
    @dbus_service_property(_interface, signature=u"b",
958
 
                           access=u"readwrite")
 
1498
    @dbus_service_property(_interface,
 
1499
                           signature="b",
 
1500
                           access="readwrite")
959
1501
    def ApprovedByDefault_dbus_property(self, value=None):
960
1502
        if value is None:       # get
961
1503
            return dbus.Boolean(self.approved_by_default)
962
1504
        self.approved_by_default = bool(value)
963
 
        # Emit D-Bus signal
964
 
        self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
965
 
                             dbus.Boolean(value, variant_level=1))
966
1505
    
967
1506
    # ApprovalDelay - property
968
 
    @dbus_service_property(_interface, signature=u"t",
969
 
                           access=u"readwrite")
 
1507
    @dbus_service_property(_interface,
 
1508
                           signature="t",
 
1509
                           access="readwrite")
970
1510
    def ApprovalDelay_dbus_property(self, value=None):
971
1511
        if value is None:       # get
972
 
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1512
            return dbus.UInt64(self.approval_delay.total_seconds()
 
1513
                               * 1000)
973
1514
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
974
 
        # Emit D-Bus signal
975
 
        self.PropertyChanged(dbus.String(u"ApprovalDelay"),
976
 
                             dbus.UInt64(value, variant_level=1))
977
1515
    
978
1516
    # ApprovalDuration - property
979
 
    @dbus_service_property(_interface, signature=u"t",
980
 
                           access=u"readwrite")
 
1517
    @dbus_service_property(_interface,
 
1518
                           signature="t",
 
1519
                           access="readwrite")
981
1520
    def ApprovalDuration_dbus_property(self, value=None):
982
1521
        if value is None:       # get
983
 
            return dbus.UInt64(self._timedelta_to_milliseconds(
984
 
                    self.approval_duration))
 
1522
            return dbus.UInt64(self.approval_duration.total_seconds()
 
1523
                               * 1000)
985
1524
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
986
 
        # Emit D-Bus signal
987
 
        self.PropertyChanged(dbus.String(u"ApprovalDuration"),
988
 
                             dbus.UInt64(value, variant_level=1))
989
1525
    
990
1526
    # Name - property
991
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1527
    @dbus_service_property(_interface, signature="s", access="read")
992
1528
    def Name_dbus_property(self):
993
1529
        return dbus.String(self.name)
994
1530
    
995
1531
    # Fingerprint - property
996
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1532
    @dbus_service_property(_interface, signature="s", access="read")
997
1533
    def Fingerprint_dbus_property(self):
998
1534
        return dbus.String(self.fingerprint)
999
1535
    
1000
1536
    # Host - property
1001
 
    @dbus_service_property(_interface, signature=u"s",
1002
 
                           access=u"readwrite")
 
1537
    @dbus_service_property(_interface,
 
1538
                           signature="s",
 
1539
                           access="readwrite")
1003
1540
    def Host_dbus_property(self, value=None):
1004
1541
        if value is None:       # get
1005
1542
            return dbus.String(self.host)
1006
 
        self.host = value
1007
 
        # Emit D-Bus signal
1008
 
        self.PropertyChanged(dbus.String(u"Host"),
1009
 
                             dbus.String(value, variant_level=1))
 
1543
        self.host = str(value)
1010
1544
    
1011
1545
    # Created - property
1012
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1546
    @dbus_service_property(_interface, signature="s", access="read")
1013
1547
    def Created_dbus_property(self):
1014
 
        return dbus.String(self._datetime_to_dbus(self.created))
 
1548
        return datetime_to_dbus(self.created)
1015
1549
    
1016
1550
    # LastEnabled - property
1017
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1551
    @dbus_service_property(_interface, signature="s", access="read")
1018
1552
    def LastEnabled_dbus_property(self):
1019
 
        if self.last_enabled is None:
1020
 
            return dbus.String(u"")
1021
 
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
1553
        return datetime_to_dbus(self.last_enabled)
1022
1554
    
1023
1555
    # Enabled - property
1024
 
    @dbus_service_property(_interface, signature=u"b",
1025
 
                           access=u"readwrite")
 
1556
    @dbus_service_property(_interface,
 
1557
                           signature="b",
 
1558
                           access="readwrite")
1026
1559
    def Enabled_dbus_property(self, value=None):
1027
1560
        if value is None:       # get
1028
1561
            return dbus.Boolean(self.enabled)
1032
1565
            self.disable()
1033
1566
    
1034
1567
    # LastCheckedOK - property
1035
 
    @dbus_service_property(_interface, signature=u"s",
1036
 
                           access=u"readwrite")
 
1568
    @dbus_service_property(_interface,
 
1569
                           signature="s",
 
1570
                           access="readwrite")
1037
1571
    def LastCheckedOK_dbus_property(self, value=None):
1038
1572
        if value is not None:
1039
1573
            self.checked_ok()
1040
1574
            return
1041
 
        if self.last_checked_ok is None:
1042
 
            return dbus.String(u"")
1043
 
        return dbus.String(self._datetime_to_dbus(self
1044
 
                                                  .last_checked_ok))
 
1575
        return datetime_to_dbus(self.last_checked_ok)
 
1576
    
 
1577
    # LastCheckerStatus - property
 
1578
    @dbus_service_property(_interface, signature="n", access="read")
 
1579
    def LastCheckerStatus_dbus_property(self):
 
1580
        return dbus.Int16(self.last_checker_status)
 
1581
    
 
1582
    # Expires - property
 
1583
    @dbus_service_property(_interface, signature="s", access="read")
 
1584
    def Expires_dbus_property(self):
 
1585
        return datetime_to_dbus(self.expires)
1045
1586
    
1046
1587
    # LastApprovalRequest - property
1047
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1588
    @dbus_service_property(_interface, signature="s", access="read")
1048
1589
    def LastApprovalRequest_dbus_property(self):
1049
 
        if self.last_approval_request is None:
1050
 
            return dbus.String(u"")
1051
 
        return dbus.String(self.
1052
 
                           _datetime_to_dbus(self
1053
 
                                             .last_approval_request))
 
1590
        return datetime_to_dbus(self.last_approval_request)
1054
1591
    
1055
1592
    # Timeout - property
1056
 
    @dbus_service_property(_interface, signature=u"t",
1057
 
                           access=u"readwrite")
 
1593
    @dbus_service_property(_interface,
 
1594
                           signature="t",
 
1595
                           access="readwrite")
1058
1596
    def Timeout_dbus_property(self, value=None):
1059
1597
        if value is None:       # get
1060
 
            return dbus.UInt64(self.timeout_milliseconds())
 
1598
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
 
1599
        old_timeout = self.timeout
1061
1600
        self.timeout = datetime.timedelta(0, 0, 0, value)
1062
 
        # Emit D-Bus signal
1063
 
        self.PropertyChanged(dbus.String(u"Timeout"),
1064
 
                             dbus.UInt64(value, variant_level=1))
1065
 
        if getattr(self, u"disable_initiator_tag", None) is None:
1066
 
            return
1067
 
        # Reschedule timeout
1068
 
        gobject.source_remove(self.disable_initiator_tag)
1069
 
        self.disable_initiator_tag = None
1070
 
        time_to_die = (self.
1071
 
                       _timedelta_to_milliseconds((self
1072
 
                                                   .last_checked_ok
1073
 
                                                   + self.timeout)
1074
 
                                                  - datetime.datetime
1075
 
                                                  .utcnow()))
1076
 
        if time_to_die <= 0:
1077
 
            # The timeout has passed
1078
 
            self.disable()
1079
 
        else:
1080
 
            self.disable_initiator_tag = (gobject.timeout_add
1081
 
                                          (time_to_die, self.disable))
 
1601
        # Reschedule disabling
 
1602
        if self.enabled:
 
1603
            now = datetime.datetime.utcnow()
 
1604
            self.expires += self.timeout - old_timeout
 
1605
            if self.expires <= now:
 
1606
                # The timeout has passed
 
1607
                self.disable()
 
1608
            else:
 
1609
                if (getattr(self, "disable_initiator_tag", None)
 
1610
                    is None):
 
1611
                    return
 
1612
                gobject.source_remove(self.disable_initiator_tag)
 
1613
                self.disable_initiator_tag = gobject.timeout_add(
 
1614
                    int((self.expires - now).total_seconds() * 1000),
 
1615
                    self.disable)
 
1616
    
 
1617
    # ExtendedTimeout - property
 
1618
    @dbus_service_property(_interface,
 
1619
                           signature="t",
 
1620
                           access="readwrite")
 
1621
    def ExtendedTimeout_dbus_property(self, value=None):
 
1622
        if value is None:       # get
 
1623
            return dbus.UInt64(self.extended_timeout.total_seconds()
 
1624
                               * 1000)
 
1625
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1082
1626
    
1083
1627
    # Interval - property
1084
 
    @dbus_service_property(_interface, signature=u"t",
1085
 
                           access=u"readwrite")
 
1628
    @dbus_service_property(_interface,
 
1629
                           signature="t",
 
1630
                           access="readwrite")
1086
1631
    def Interval_dbus_property(self, value=None):
1087
1632
        if value is None:       # get
1088
 
            return dbus.UInt64(self.interval_milliseconds())
 
1633
            return dbus.UInt64(self.interval.total_seconds() * 1000)
1089
1634
        self.interval = datetime.timedelta(0, 0, 0, value)
1090
 
        # Emit D-Bus signal
1091
 
        self.PropertyChanged(dbus.String(u"Interval"),
1092
 
                             dbus.UInt64(value, variant_level=1))
1093
 
        if getattr(self, u"checker_initiator_tag", None) is None:
 
1635
        if getattr(self, "checker_initiator_tag", None) is None:
1094
1636
            return
1095
 
        # Reschedule checker run
1096
 
        gobject.source_remove(self.checker_initiator_tag)
1097
 
        self.checker_initiator_tag = (gobject.timeout_add
1098
 
                                      (value, self.start_checker))
1099
 
        self.start_checker()    # Start one now, too
1100
 
 
 
1637
        if self.enabled:
 
1638
            # Reschedule checker run
 
1639
            gobject.source_remove(self.checker_initiator_tag)
 
1640
            self.checker_initiator_tag = gobject.timeout_add(
 
1641
                value, self.start_checker)
 
1642
            self.start_checker() # Start one now, too
 
1643
    
1101
1644
    # Checker - property
1102
 
    @dbus_service_property(_interface, signature=u"s",
1103
 
                           access=u"readwrite")
 
1645
    @dbus_service_property(_interface,
 
1646
                           signature="s",
 
1647
                           access="readwrite")
1104
1648
    def Checker_dbus_property(self, value=None):
1105
1649
        if value is None:       # get
1106
1650
            return dbus.String(self.checker_command)
1107
 
        self.checker_command = value
1108
 
        # Emit D-Bus signal
1109
 
        self.PropertyChanged(dbus.String(u"Checker"),
1110
 
                             dbus.String(self.checker_command,
1111
 
                                         variant_level=1))
 
1651
        self.checker_command = str(value)
1112
1652
    
1113
1653
    # CheckerRunning - property
1114
 
    @dbus_service_property(_interface, signature=u"b",
1115
 
                           access=u"readwrite")
 
1654
    @dbus_service_property(_interface,
 
1655
                           signature="b",
 
1656
                           access="readwrite")
1116
1657
    def CheckerRunning_dbus_property(self, value=None):
1117
1658
        if value is None:       # get
1118
1659
            return dbus.Boolean(self.checker is not None)
1122
1663
            self.stop_checker()
1123
1664
    
1124
1665
    # ObjectPath - property
1125
 
    @dbus_service_property(_interface, signature=u"o", access=u"read")
 
1666
    @dbus_service_property(_interface, signature="o", access="read")
1126
1667
    def ObjectPath_dbus_property(self):
1127
1668
        return self.dbus_object_path # is already a dbus.ObjectPath
1128
1669
    
1129
1670
    # Secret = property
1130
 
    @dbus_service_property(_interface, signature=u"ay",
1131
 
                           access=u"write", byte_arrays=True)
 
1671
    @dbus_service_property(_interface,
 
1672
                           signature="ay",
 
1673
                           access="write",
 
1674
                           byte_arrays=True)
1132
1675
    def Secret_dbus_property(self, value):
1133
 
        self.secret = str(value)
 
1676
        self.secret = bytes(value)
1134
1677
    
1135
1678
    del _interface
1136
1679
 
1140
1683
        self._pipe = child_pipe
1141
1684
        self._pipe.send(('init', fpr, address))
1142
1685
        if not self._pipe.recv():
1143
 
            raise KeyError()
1144
 
 
 
1686
            raise KeyError(fpr)
 
1687
    
1145
1688
    def __getattribute__(self, name):
1146
 
        if(name == '_pipe'):
 
1689
        if name == '_pipe':
1147
1690
            return super(ProxyClient, self).__getattribute__(name)
1148
1691
        self._pipe.send(('getattr', name))
1149
1692
        data = self._pipe.recv()
1150
1693
        if data[0] == 'data':
1151
1694
            return data[1]
1152
1695
        if data[0] == 'function':
 
1696
            
1153
1697
            def func(*args, **kwargs):
1154
1698
                self._pipe.send(('funcall', name, args, kwargs))
1155
1699
                return self._pipe.recv()[1]
 
1700
            
1156
1701
            return func
1157
 
 
 
1702
    
1158
1703
    def __setattr__(self, name, value):
1159
 
        if(name == '_pipe'):
 
1704
        if name == '_pipe':
1160
1705
            return super(ProxyClient, self).__setattr__(name, value)
1161
1706
        self._pipe.send(('setattr', name, value))
1162
1707
 
1169
1714
    
1170
1715
    def handle(self):
1171
1716
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1172
 
            logger.info(u"TCP connection from: %s",
1173
 
                        unicode(self.client_address))
1174
 
            logger.debug(u"Pipe FD: %d",
 
1717
            logger.info("TCP connection from: %s",
 
1718
                        str(self.client_address))
 
1719
            logger.debug("Pipe FD: %d",
1175
1720
                         self.server.child_pipe.fileno())
1176
 
 
1177
 
            session = (gnutls.connection
1178
 
                       .ClientSession(self.request,
1179
 
                                      gnutls.connection
1180
 
                                      .X509Credentials()))
1181
 
 
 
1721
            
 
1722
            session = gnutls.connection.ClientSession(
 
1723
                self.request, gnutls.connection .X509Credentials())
 
1724
            
1182
1725
            # Note: gnutls.connection.X509Credentials is really a
1183
1726
            # generic GnuTLS certificate credentials object so long as
1184
1727
            # no X.509 keys are added to it.  Therefore, we can use it
1185
1728
            # here despite using OpenPGP certificates.
1186
 
 
1187
 
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1188
 
            #                      u"+AES-256-CBC", u"+SHA1",
1189
 
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
1190
 
            #                      u"+DHE-DSS"))
 
1729
            
 
1730
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1731
            #                      "+AES-256-CBC", "+SHA1",
 
1732
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1733
            #                      "+DHE-DSS"))
1191
1734
            # Use a fallback default, since this MUST be set.
1192
1735
            priority = self.server.gnutls_priority
1193
1736
            if priority is None:
1194
 
                priority = u"NORMAL"
1195
 
            (gnutls.library.functions
1196
 
             .gnutls_priority_set_direct(session._c_object,
1197
 
                                         priority, None))
1198
 
 
 
1737
                priority = "NORMAL"
 
1738
            gnutls.library.functions.gnutls_priority_set_direct(
 
1739
                session._c_object, priority, None)
 
1740
            
1199
1741
            # Start communication using the Mandos protocol
1200
1742
            # Get protocol number
1201
1743
            line = self.request.makefile().readline()
1202
 
            logger.debug(u"Protocol version: %r", line)
 
1744
            logger.debug("Protocol version: %r", line)
1203
1745
            try:
1204
1746
                if int(line.strip().split()[0]) > 1:
1205
 
                    raise RuntimeError
1206
 
            except (ValueError, IndexError, RuntimeError), error:
1207
 
                logger.error(u"Unknown protocol version: %s", error)
 
1747
                    raise RuntimeError(line)
 
1748
            except (ValueError, IndexError, RuntimeError) as error:
 
1749
                logger.error("Unknown protocol version: %s", error)
1208
1750
                return
1209
 
 
 
1751
            
1210
1752
            # Start GnuTLS connection
1211
1753
            try:
1212
1754
                session.handshake()
1213
 
            except gnutls.errors.GNUTLSError, error:
1214
 
                logger.warning(u"Handshake failed: %s", error)
 
1755
            except gnutls.errors.GNUTLSError as error:
 
1756
                logger.warning("Handshake failed: %s", error)
1215
1757
                # Do not run session.bye() here: the session is not
1216
1758
                # established.  Just abandon the request.
1217
1759
                return
1218
 
            logger.debug(u"Handshake succeeded")
1219
 
 
 
1760
            logger.debug("Handshake succeeded")
 
1761
            
1220
1762
            approval_required = False
1221
1763
            try:
1222
1764
                try:
1223
 
                    fpr = self.fingerprint(self.peer_certificate
1224
 
                                           (session))
1225
 
                except (TypeError, gnutls.errors.GNUTLSError), error:
1226
 
                    logger.warning(u"Bad certificate: %s", error)
 
1765
                    fpr = self.fingerprint(
 
1766
                        self.peer_certificate(session))
 
1767
                except (TypeError,
 
1768
                        gnutls.errors.GNUTLSError) as error:
 
1769
                    logger.warning("Bad certificate: %s", error)
1227
1770
                    return
1228
 
                logger.debug(u"Fingerprint: %s", fpr)
1229
 
 
 
1771
                logger.debug("Fingerprint: %s", fpr)
 
1772
                
1230
1773
                try:
1231
1774
                    client = ProxyClient(child_pipe, fpr,
1232
1775
                                         self.client_address)
1240
1783
                
1241
1784
                while True:
1242
1785
                    if not client.enabled:
1243
 
                        logger.warning(u"Client %s is disabled",
1244
 
                                       client.name)
 
1786
                        logger.info("Client %s is disabled",
 
1787
                                    client.name)
1245
1788
                        if self.server.use_dbus:
1246
1789
                            # Emit D-Bus signal
1247
 
                            client.Rejected("Disabled")                    
 
1790
                            client.Rejected("Disabled")
1248
1791
                        return
1249
1792
                    
1250
 
                    if client._approved or not client.approval_delay:
 
1793
                    if client.approved or not client.approval_delay:
1251
1794
                        #We are approved or approval is disabled
1252
1795
                        break
1253
 
                    elif client._approved is None:
1254
 
                        logger.info(u"Client %s needs approval",
 
1796
                    elif client.approved is None:
 
1797
                        logger.info("Client %s needs approval",
1255
1798
                                    client.name)
1256
1799
                        if self.server.use_dbus:
1257
1800
                            # Emit D-Bus signal
1258
1801
                            client.NeedApproval(
1259
 
                                client.approval_delay_milliseconds(),
1260
 
                                client.approved_by_default)
 
1802
                                client.approval_delay.total_seconds()
 
1803
                                * 1000, client.approved_by_default)
1261
1804
                    else:
1262
 
                        logger.warning(u"Client %s was not approved",
 
1805
                        logger.warning("Client %s was not approved",
1263
1806
                                       client.name)
1264
1807
                        if self.server.use_dbus:
1265
1808
                            # Emit D-Bus signal
1267
1810
                        return
1268
1811
                    
1269
1812
                    #wait until timeout or approved
1270
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1271
1813
                    time = datetime.datetime.now()
1272
1814
                    client.changedstate.acquire()
1273
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1815
                    client.changedstate.wait(delay.total_seconds())
1274
1816
                    client.changedstate.release()
1275
1817
                    time2 = datetime.datetime.now()
1276
1818
                    if (time2 - time) >= delay:
1291
1833
                while sent_size < len(client.secret):
1292
1834
                    try:
1293
1835
                        sent = session.send(client.secret[sent_size:])
1294
 
                    except (gnutls.errors.GNUTLSError), error:
1295
 
                        logger.warning("gnutls send failed")
 
1836
                    except gnutls.errors.GNUTLSError as error:
 
1837
                        logger.warning("gnutls send failed",
 
1838
                                       exc_info=error)
1296
1839
                        return
1297
 
                    logger.debug(u"Sent: %d, remaining: %d",
1298
 
                                 sent, len(client.secret)
1299
 
                                 - (sent_size + sent))
 
1840
                    logger.debug("Sent: %d, remaining: %d", sent,
 
1841
                                 len(client.secret) - (sent_size
 
1842
                                                       + sent))
1300
1843
                    sent_size += sent
1301
 
 
1302
 
                logger.info(u"Sending secret to %s", client.name)
1303
 
                # bump the timeout as if seen
1304
 
                client.checked_ok()
 
1844
                
 
1845
                logger.info("Sending secret to %s", client.name)
 
1846
                # bump the timeout using extended_timeout
 
1847
                client.bump_timeout(client.extended_timeout)
1305
1848
                if self.server.use_dbus:
1306
1849
                    # Emit D-Bus signal
1307
1850
                    client.GotSecret()
1311
1854
                    client.approvals_pending -= 1
1312
1855
                try:
1313
1856
                    session.bye()
1314
 
                except (gnutls.errors.GNUTLSError), error:
1315
 
                    logger.warning("GnuTLS bye failed")
 
1857
                except gnutls.errors.GNUTLSError as error:
 
1858
                    logger.warning("GnuTLS bye failed",
 
1859
                                   exc_info=error)
1316
1860
    
1317
1861
    @staticmethod
1318
1862
    def peer_certificate(session):
1319
1863
        "Return the peer's OpenPGP certificate as a bytestring"
1320
1864
        # If not an OpenPGP certificate...
1321
 
        if (gnutls.library.functions
1322
 
            .gnutls_certificate_type_get(session._c_object)
 
1865
        if (gnutls.library.functions.gnutls_certificate_type_get(
 
1866
                session._c_object)
1323
1867
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1324
1868
            # ...do the normal thing
1325
1869
            return session.peer_certificate
1328
1872
                     .gnutls_certificate_get_peers
1329
1873
                     (session._c_object, ctypes.byref(list_size)))
1330
1874
        if not bool(cert_list) and list_size.value != 0:
1331
 
            raise gnutls.errors.GNUTLSError(u"error getting peer"
1332
 
                                            u" certificate")
 
1875
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1876
                                            " certificate")
1333
1877
        if list_size.value == 0:
1334
1878
            return None
1335
1879
        cert = cert_list[0]
1339
1883
    def fingerprint(openpgp):
1340
1884
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1341
1885
        # New GnuTLS "datum" with the OpenPGP public key
1342
 
        datum = (gnutls.library.types
1343
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1344
 
                                             ctypes.POINTER
1345
 
                                             (ctypes.c_ubyte)),
1346
 
                                 ctypes.c_uint(len(openpgp))))
 
1886
        datum = gnutls.library.types.gnutls_datum_t(
 
1887
            ctypes.cast(ctypes.c_char_p(openpgp),
 
1888
                        ctypes.POINTER(ctypes.c_ubyte)),
 
1889
            ctypes.c_uint(len(openpgp)))
1347
1890
        # New empty GnuTLS certificate
1348
1891
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1349
 
        (gnutls.library.functions
1350
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1892
        gnutls.library.functions.gnutls_openpgp_crt_init(
 
1893
            ctypes.byref(crt))
1351
1894
        # Import the OpenPGP public key into the certificate
1352
 
        (gnutls.library.functions
1353
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1354
 
                                    gnutls.library.constants
1355
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1895
        gnutls.library.functions.gnutls_openpgp_crt_import(
 
1896
            crt, ctypes.byref(datum),
 
1897
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1356
1898
        # Verify the self signature in the key
1357
1899
        crtverify = ctypes.c_uint()
1358
 
        (gnutls.library.functions
1359
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1360
 
                                         ctypes.byref(crtverify)))
 
1900
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
 
1901
            crt, 0, ctypes.byref(crtverify))
1361
1902
        if crtverify.value != 0:
1362
1903
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1363
 
            raise (gnutls.errors.CertificateSecurityError
1364
 
                   (u"Verify failed"))
 
1904
            raise gnutls.errors.CertificateSecurityError(
 
1905
                "Verify failed")
1365
1906
        # New buffer for the fingerprint
1366
1907
        buf = ctypes.create_string_buffer(20)
1367
1908
        buf_len = ctypes.c_size_t()
1368
1909
        # Get the fingerprint from the certificate into the buffer
1369
 
        (gnutls.library.functions
1370
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1371
 
                                             ctypes.byref(buf_len)))
 
1910
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
 
1911
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
1372
1912
        # Deinit the certificate
1373
1913
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1374
1914
        # Convert the buffer to a Python bytestring
1375
1915
        fpr = ctypes.string_at(buf, buf_len.value)
1376
1916
        # Convert the bytestring to hexadecimal notation
1377
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1917
        hex_fpr = binascii.hexlify(fpr).upper()
1378
1918
        return hex_fpr
1379
1919
 
1380
1920
 
1381
1921
class MultiprocessingMixIn(object):
1382
1922
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1923
    
1383
1924
    def sub_process_main(self, request, address):
1384
1925
        try:
1385
1926
            self.finish_request(request, address)
1386
 
        except:
 
1927
        except Exception:
1387
1928
            self.handle_error(request, address)
1388
1929
        self.close_request(request)
1389
 
            
 
1930
    
1390
1931
    def process_request(self, request, address):
1391
1932
        """Start a new process to process the request."""
1392
 
        multiprocessing.Process(target = self.sub_process_main,
1393
 
                                args = (request, address)).start()
 
1933
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1934
                                       args = (request, address))
 
1935
        proc.start()
 
1936
        return proc
 
1937
 
1394
1938
 
1395
1939
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1396
1940
    """ adds a pipe to the MixIn """
 
1941
    
1397
1942
    def process_request(self, request, client_address):
1398
1943
        """Overrides and wraps the original process_request().
1399
1944
        
1400
1945
        This function creates a new pipe in self.pipe
1401
1946
        """
1402
1947
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1403
 
 
1404
 
        super(MultiprocessingMixInWithPipe,
1405
 
              self).process_request(request, client_address)
 
1948
        
 
1949
        proc = MultiprocessingMixIn.process_request(self, request,
 
1950
                                                    client_address)
1406
1951
        self.child_pipe.close()
1407
 
        self.add_pipe(parent_pipe)
1408
 
 
1409
 
    def add_pipe(self, parent_pipe):
 
1952
        self.add_pipe(parent_pipe, proc)
 
1953
    
 
1954
    def add_pipe(self, parent_pipe, proc):
1410
1955
        """Dummy function; override as necessary"""
1411
 
        pass
 
1956
        raise NotImplementedError()
 
1957
 
1412
1958
 
1413
1959
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1414
1960
                     socketserver.TCPServer, object):
1419
1965
        interface:      None or a network interface name (string)
1420
1966
        use_ipv6:       Boolean; to use IPv6 or not
1421
1967
    """
 
1968
    
1422
1969
    def __init__(self, server_address, RequestHandlerClass,
1423
 
                 interface=None, use_ipv6=True):
 
1970
                 interface=None,
 
1971
                 use_ipv6=True,
 
1972
                 socketfd=None):
 
1973
        """If socketfd is set, use that file descriptor instead of
 
1974
        creating a new one with socket.socket().
 
1975
        """
1424
1976
        self.interface = interface
1425
1977
        if use_ipv6:
1426
1978
            self.address_family = socket.AF_INET6
 
1979
        if socketfd is not None:
 
1980
            # Save the file descriptor
 
1981
            self.socketfd = socketfd
 
1982
            # Save the original socket.socket() function
 
1983
            self.socket_socket = socket.socket
 
1984
            # To implement --socket, we monkey patch socket.socket.
 
1985
            # 
 
1986
            # (When socketserver.TCPServer is a new-style class, we
 
1987
            # could make self.socket into a property instead of monkey
 
1988
            # patching socket.socket.)
 
1989
            # 
 
1990
            # Create a one-time-only replacement for socket.socket()
 
1991
            @functools.wraps(socket.socket)
 
1992
            def socket_wrapper(*args, **kwargs):
 
1993
                # Restore original function so subsequent calls are
 
1994
                # not affected.
 
1995
                socket.socket = self.socket_socket
 
1996
                del self.socket_socket
 
1997
                # This time only, return a new socket object from the
 
1998
                # saved file descriptor.
 
1999
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
2000
            # Replace socket.socket() function with wrapper
 
2001
            socket.socket = socket_wrapper
 
2002
        # The socketserver.TCPServer.__init__ will call
 
2003
        # socket.socket(), which might be our replacement,
 
2004
        # socket_wrapper(), if socketfd was set.
1427
2005
        socketserver.TCPServer.__init__(self, server_address,
1428
2006
                                        RequestHandlerClass)
 
2007
    
1429
2008
    def server_bind(self):
1430
2009
        """This overrides the normal server_bind() function
1431
2010
        to bind to an interface if one was specified, and also NOT to
1432
2011
        bind to an address or port if they were not specified."""
1433
2012
        if self.interface is not None:
1434
2013
            if SO_BINDTODEVICE is None:
1435
 
                logger.error(u"SO_BINDTODEVICE does not exist;"
1436
 
                             u" cannot bind to interface %s",
 
2014
                logger.error("SO_BINDTODEVICE does not exist;"
 
2015
                             " cannot bind to interface %s",
1437
2016
                             self.interface)
1438
2017
            else:
1439
2018
                try:
1440
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1441
 
                                           SO_BINDTODEVICE,
1442
 
                                           str(self.interface
1443
 
                                               + u'\0'))
1444
 
                except socket.error, error:
1445
 
                    if error[0] == errno.EPERM:
1446
 
                        logger.error(u"No permission to"
1447
 
                                     u" bind to interface %s",
1448
 
                                     self.interface)
1449
 
                    elif error[0] == errno.ENOPROTOOPT:
1450
 
                        logger.error(u"SO_BINDTODEVICE not available;"
1451
 
                                     u" cannot bind to interface %s",
1452
 
                                     self.interface)
 
2019
                    self.socket.setsockopt(
 
2020
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
 
2021
                        (self.interface + "\0").encode("utf-8"))
 
2022
                except socket.error as error:
 
2023
                    if error.errno == errno.EPERM:
 
2024
                        logger.error("No permission to bind to"
 
2025
                                     " interface %s", self.interface)
 
2026
                    elif error.errno == errno.ENOPROTOOPT:
 
2027
                        logger.error("SO_BINDTODEVICE not available;"
 
2028
                                     " cannot bind to interface %s",
 
2029
                                     self.interface)
 
2030
                    elif error.errno == errno.ENODEV:
 
2031
                        logger.error("Interface %s does not exist,"
 
2032
                                     " cannot bind", self.interface)
1453
2033
                    else:
1454
2034
                        raise
1455
2035
        # Only bind(2) the socket if we really need to.
1456
2036
        if self.server_address[0] or self.server_address[1]:
1457
2037
            if not self.server_address[0]:
1458
2038
                if self.address_family == socket.AF_INET6:
1459
 
                    any_address = u"::" # in6addr_any
 
2039
                    any_address = "::" # in6addr_any
1460
2040
                else:
1461
 
                    any_address = socket.INADDR_ANY
 
2041
                    any_address = "0.0.0.0" # INADDR_ANY
1462
2042
                self.server_address = (any_address,
1463
2043
                                       self.server_address[1])
1464
2044
            elif not self.server_address[1]:
1465
 
                self.server_address = (self.server_address[0],
1466
 
                                       0)
 
2045
                self.server_address = (self.server_address[0], 0)
1467
2046
#                 if self.interface:
1468
2047
#                     self.server_address = (self.server_address[0],
1469
2048
#                                            0, # port
1483
2062
    
1484
2063
    Assumes a gobject.MainLoop event loop.
1485
2064
    """
 
2065
    
1486
2066
    def __init__(self, server_address, RequestHandlerClass,
1487
 
                 interface=None, use_ipv6=True, clients=None,
1488
 
                 gnutls_priority=None, use_dbus=True):
 
2067
                 interface=None,
 
2068
                 use_ipv6=True,
 
2069
                 clients=None,
 
2070
                 gnutls_priority=None,
 
2071
                 use_dbus=True,
 
2072
                 socketfd=None):
1489
2073
        self.enabled = False
1490
2074
        self.clients = clients
1491
2075
        if self.clients is None:
1492
 
            self.clients = set()
 
2076
            self.clients = {}
1493
2077
        self.use_dbus = use_dbus
1494
2078
        self.gnutls_priority = gnutls_priority
1495
2079
        IPv6_TCPServer.__init__(self, server_address,
1496
2080
                                RequestHandlerClass,
1497
2081
                                interface = interface,
1498
 
                                use_ipv6 = use_ipv6)
 
2082
                                use_ipv6 = use_ipv6,
 
2083
                                socketfd = socketfd)
 
2084
    
1499
2085
    def server_activate(self):
1500
2086
        if self.enabled:
1501
2087
            return socketserver.TCPServer.server_activate(self)
 
2088
    
1502
2089
    def enable(self):
1503
2090
        self.enabled = True
1504
 
    def add_pipe(self, parent_pipe):
 
2091
    
 
2092
    def add_pipe(self, parent_pipe, proc):
1505
2093
        # Call "handle_ipc" for both data and EOF events
1506
 
        gobject.io_add_watch(parent_pipe.fileno(),
1507
 
                             gobject.IO_IN | gobject.IO_HUP,
1508
 
                             functools.partial(self.handle_ipc,
1509
 
                                               parent_pipe = parent_pipe))
1510
 
        
1511
 
    def handle_ipc(self, source, condition, parent_pipe=None,
 
2094
        gobject.io_add_watch(
 
2095
            parent_pipe.fileno(),
 
2096
            gobject.IO_IN | gobject.IO_HUP,
 
2097
            functools.partial(self.handle_ipc,
 
2098
                              parent_pipe = parent_pipe,
 
2099
                              proc = proc))
 
2100
    
 
2101
    def handle_ipc(self, source, condition,
 
2102
                   parent_pipe=None,
 
2103
                   proc = None,
1512
2104
                   client_object=None):
1513
 
        condition_names = {
1514
 
            gobject.IO_IN: u"IN",   # There is data to read.
1515
 
            gobject.IO_OUT: u"OUT", # Data can be written (without
1516
 
                                    # blocking).
1517
 
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
1518
 
            gobject.IO_ERR: u"ERR", # Error condition.
1519
 
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
1520
 
                                    # broken, usually for pipes and
1521
 
                                    # sockets).
1522
 
            }
1523
 
        conditions_string = ' | '.join(name
1524
 
                                       for cond, name in
1525
 
                                       condition_names.iteritems()
1526
 
                                       if cond & condition)
1527
 
        # error or the other end of multiprocessing.Pipe has closed
1528
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
2105
        # error, or the other end of multiprocessing.Pipe has closed
 
2106
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2107
            # Wait for other process to exit
 
2108
            proc.join()
1529
2109
            return False
1530
2110
        
1531
2111
        # Read a request from the child
1536
2116
            fpr = request[1]
1537
2117
            address = request[2]
1538
2118
            
1539
 
            for c in self.clients:
 
2119
            for c in self.clients.itervalues():
1540
2120
                if c.fingerprint == fpr:
1541
2121
                    client = c
1542
2122
                    break
1543
2123
            else:
1544
 
                logger.warning(u"Client not found for fingerprint: %s, ad"
1545
 
                               u"dress: %s", fpr, address)
 
2124
                logger.info("Client not found for fingerprint: %s, ad"
 
2125
                            "dress: %s", fpr, address)
1546
2126
                if self.use_dbus:
1547
2127
                    # Emit D-Bus signal
1548
 
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
2128
                    mandos_dbus_service.ClientNotFound(fpr,
 
2129
                                                       address[0])
1549
2130
                parent_pipe.send(False)
1550
2131
                return False
1551
2132
            
1552
 
            gobject.io_add_watch(parent_pipe.fileno(),
1553
 
                                 gobject.IO_IN | gobject.IO_HUP,
1554
 
                                 functools.partial(self.handle_ipc,
1555
 
                                                   parent_pipe = parent_pipe,
1556
 
                                                   client_object = client))
 
2133
            gobject.io_add_watch(
 
2134
                parent_pipe.fileno(),
 
2135
                gobject.IO_IN | gobject.IO_HUP,
 
2136
                functools.partial(self.handle_ipc,
 
2137
                                  parent_pipe = parent_pipe,
 
2138
                                  proc = proc,
 
2139
                                  client_object = client))
1557
2140
            parent_pipe.send(True)
1558
 
            # remove the old hook in favor of the new above hook on same fileno
 
2141
            # remove the old hook in favor of the new above hook on
 
2142
            # same fileno
1559
2143
            return False
1560
2144
        if command == 'funcall':
1561
2145
            funcname = request[1]
1562
2146
            args = request[2]
1563
2147
            kwargs = request[3]
1564
2148
            
1565
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1566
 
 
 
2149
            parent_pipe.send(('data', getattr(client_object,
 
2150
                                              funcname)(*args,
 
2151
                                                        **kwargs)))
 
2152
        
1567
2153
        if command == 'getattr':
1568
2154
            attrname = request[1]
1569
 
            if callable(client_object.__getattribute__(attrname)):
1570
 
                parent_pipe.send(('function',))
 
2155
            if isinstance(client_object.__getattribute__(attrname),
 
2156
                          collections.Callable):
 
2157
                parent_pipe.send(('function', ))
1571
2158
            else:
1572
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
2159
                parent_pipe.send((
 
2160
                    'data', client_object.__getattribute__(attrname)))
1573
2161
        
1574
2162
        if command == 'setattr':
1575
2163
            attrname = request[1]
1576
2164
            value = request[2]
1577
2165
            setattr(client_object, attrname, value)
1578
 
 
 
2166
        
1579
2167
        return True
1580
2168
 
1581
2169
 
 
2170
def rfc3339_duration_to_delta(duration):
 
2171
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2172
    
 
2173
    >>> rfc3339_duration_to_delta("P7D")
 
2174
    datetime.timedelta(7)
 
2175
    >>> rfc3339_duration_to_delta("PT60S")
 
2176
    datetime.timedelta(0, 60)
 
2177
    >>> rfc3339_duration_to_delta("PT60M")
 
2178
    datetime.timedelta(0, 3600)
 
2179
    >>> rfc3339_duration_to_delta("PT24H")
 
2180
    datetime.timedelta(1)
 
2181
    >>> rfc3339_duration_to_delta("P1W")
 
2182
    datetime.timedelta(7)
 
2183
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2184
    datetime.timedelta(0, 330)
 
2185
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2186
    datetime.timedelta(1, 200)
 
2187
    """
 
2188
    
 
2189
    # Parsing an RFC 3339 duration with regular expressions is not
 
2190
    # possible - there would have to be multiple places for the same
 
2191
    # values, like seconds.  The current code, while more esoteric, is
 
2192
    # cleaner without depending on a parsing library.  If Python had a
 
2193
    # built-in library for parsing we would use it, but we'd like to
 
2194
    # avoid excessive use of external libraries.
 
2195
    
 
2196
    # New type for defining tokens, syntax, and semantics all-in-one
 
2197
    Token = collections.namedtuple("Token", (
 
2198
        "regexp",  # To match token; if "value" is not None, must have
 
2199
                   # a "group" containing digits
 
2200
        "value",   # datetime.timedelta or None
 
2201
        "followers"))           # Tokens valid after this token
 
2202
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2203
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2204
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2205
    token_second = Token(re.compile(r"(\d+)S"),
 
2206
                         datetime.timedelta(seconds=1),
 
2207
                         frozenset((token_end, )))
 
2208
    token_minute = Token(re.compile(r"(\d+)M"),
 
2209
                         datetime.timedelta(minutes=1),
 
2210
                         frozenset((token_second, token_end)))
 
2211
    token_hour = Token(re.compile(r"(\d+)H"),
 
2212
                       datetime.timedelta(hours=1),
 
2213
                       frozenset((token_minute, token_end)))
 
2214
    token_time = Token(re.compile(r"T"),
 
2215
                       None,
 
2216
                       frozenset((token_hour, token_minute,
 
2217
                                  token_second)))
 
2218
    token_day = Token(re.compile(r"(\d+)D"),
 
2219
                      datetime.timedelta(days=1),
 
2220
                      frozenset((token_time, token_end)))
 
2221
    token_month = Token(re.compile(r"(\d+)M"),
 
2222
                        datetime.timedelta(weeks=4),
 
2223
                        frozenset((token_day, token_end)))
 
2224
    token_year = Token(re.compile(r"(\d+)Y"),
 
2225
                       datetime.timedelta(weeks=52),
 
2226
                       frozenset((token_month, token_end)))
 
2227
    token_week = Token(re.compile(r"(\d+)W"),
 
2228
                       datetime.timedelta(weeks=1),
 
2229
                       frozenset((token_end, )))
 
2230
    token_duration = Token(re.compile(r"P"), None,
 
2231
                           frozenset((token_year, token_month,
 
2232
                                      token_day, token_time,
 
2233
                                      token_week)))
 
2234
    # Define starting values
 
2235
    value = datetime.timedelta() # Value so far
 
2236
    found_token = None
 
2237
    followers = frozenset((token_duration, )) # Following valid tokens
 
2238
    s = duration                # String left to parse
 
2239
    # Loop until end token is found
 
2240
    while found_token is not token_end:
 
2241
        # Search for any currently valid tokens
 
2242
        for token in followers:
 
2243
            match = token.regexp.match(s)
 
2244
            if match is not None:
 
2245
                # Token found
 
2246
                if token.value is not None:
 
2247
                    # Value found, parse digits
 
2248
                    factor = int(match.group(1), 10)
 
2249
                    # Add to value so far
 
2250
                    value += factor * token.value
 
2251
                # Strip token from string
 
2252
                s = token.regexp.sub("", s, 1)
 
2253
                # Go to found token
 
2254
                found_token = token
 
2255
                # Set valid next tokens
 
2256
                followers = found_token.followers
 
2257
                break
 
2258
        else:
 
2259
            # No currently valid tokens were found
 
2260
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
2261
                             .format(duration))
 
2262
    # End token found
 
2263
    return value
 
2264
 
 
2265
 
1582
2266
def string_to_delta(interval):
1583
2267
    """Parse a string and return a datetime.timedelta
1584
2268
    
1585
 
    >>> string_to_delta(u'7d')
 
2269
    >>> string_to_delta('7d')
1586
2270
    datetime.timedelta(7)
1587
 
    >>> string_to_delta(u'60s')
 
2271
    >>> string_to_delta('60s')
1588
2272
    datetime.timedelta(0, 60)
1589
 
    >>> string_to_delta(u'60m')
 
2273
    >>> string_to_delta('60m')
1590
2274
    datetime.timedelta(0, 3600)
1591
 
    >>> string_to_delta(u'24h')
 
2275
    >>> string_to_delta('24h')
1592
2276
    datetime.timedelta(1)
1593
 
    >>> string_to_delta(u'1w')
 
2277
    >>> string_to_delta('1w')
1594
2278
    datetime.timedelta(7)
1595
 
    >>> string_to_delta(u'5m 30s')
 
2279
    >>> string_to_delta('5m 30s')
1596
2280
    datetime.timedelta(0, 330)
1597
2281
    """
 
2282
    
 
2283
    try:
 
2284
        return rfc3339_duration_to_delta(interval)
 
2285
    except ValueError:
 
2286
        pass
 
2287
    
1598
2288
    timevalue = datetime.timedelta(0)
1599
2289
    for s in interval.split():
1600
2290
        try:
1601
 
            suffix = unicode(s[-1])
 
2291
            suffix = s[-1]
1602
2292
            value = int(s[:-1])
1603
 
            if suffix == u"d":
 
2293
            if suffix == "d":
1604
2294
                delta = datetime.timedelta(value)
1605
 
            elif suffix == u"s":
 
2295
            elif suffix == "s":
1606
2296
                delta = datetime.timedelta(0, value)
1607
 
            elif suffix == u"m":
 
2297
            elif suffix == "m":
1608
2298
                delta = datetime.timedelta(0, 0, 0, 0, value)
1609
 
            elif suffix == u"h":
 
2299
            elif suffix == "h":
1610
2300
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1611
 
            elif suffix == u"w":
 
2301
            elif suffix == "w":
1612
2302
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1613
2303
            else:
1614
 
                raise ValueError(u"Unknown suffix %r" % suffix)
1615
 
        except (ValueError, IndexError), e:
1616
 
            raise ValueError(e.message)
 
2304
                raise ValueError("Unknown suffix {!r}".format(suffix))
 
2305
        except IndexError as e:
 
2306
            raise ValueError(*(e.args))
1617
2307
        timevalue += delta
1618
2308
    return timevalue
1619
2309
 
1620
2310
 
1621
 
def if_nametoindex(interface):
1622
 
    """Call the C function if_nametoindex(), or equivalent
1623
 
    
1624
 
    Note: This function cannot accept a unicode string."""
1625
 
    global if_nametoindex
1626
 
    try:
1627
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1628
 
                          (ctypes.util.find_library(u"c"))
1629
 
                          .if_nametoindex)
1630
 
    except (OSError, AttributeError):
1631
 
        logger.warning(u"Doing if_nametoindex the hard way")
1632
 
        def if_nametoindex(interface):
1633
 
            "Get an interface index the hard way, i.e. using fcntl()"
1634
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1635
 
            with contextlib.closing(socket.socket()) as s:
1636
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1637
 
                                    struct.pack(str(u"16s16x"),
1638
 
                                                interface))
1639
 
            interface_index = struct.unpack(str(u"I"),
1640
 
                                            ifreq[16:20])[0]
1641
 
            return interface_index
1642
 
    return if_nametoindex(interface)
1643
 
 
1644
 
 
1645
2311
def daemon(nochdir = False, noclose = False):
1646
2312
    """See daemon(3).  Standard BSD Unix function.
1647
2313
    
1650
2316
        sys.exit()
1651
2317
    os.setsid()
1652
2318
    if not nochdir:
1653
 
        os.chdir(u"/")
 
2319
        os.chdir("/")
1654
2320
    if os.fork():
1655
2321
        sys.exit()
1656
2322
    if not noclose:
1657
2323
        # Close all standard open file descriptors
1658
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2324
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1659
2325
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1660
2326
            raise OSError(errno.ENODEV,
1661
 
                          u"%s not a character device"
1662
 
                          % os.path.devnull)
 
2327
                          "{} not a character device"
 
2328
                          .format(os.devnull))
1663
2329
        os.dup2(null, sys.stdin.fileno())
1664
2330
        os.dup2(null, sys.stdout.fileno())
1665
2331
        os.dup2(null, sys.stderr.fileno())
1672
2338
    ##################################################################
1673
2339
    # Parsing of options, both command line and config file
1674
2340
    
1675
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1676
 
    parser.add_option("-i", u"--interface", type=u"string",
1677
 
                      metavar="IF", help=u"Bind to interface IF")
1678
 
    parser.add_option("-a", u"--address", type=u"string",
1679
 
                      help=u"Address to listen for requests on")
1680
 
    parser.add_option("-p", u"--port", type=u"int",
1681
 
                      help=u"Port number to receive requests on")
1682
 
    parser.add_option("--check", action=u"store_true",
1683
 
                      help=u"Run self-test")
1684
 
    parser.add_option("--debug", action=u"store_true",
1685
 
                      help=u"Debug mode; run in foreground and log to"
1686
 
                      u" terminal")
1687
 
    parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
1688
 
                      help=u"Debug level for stdout output")
1689
 
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
 
                      u" priority string (see GnuTLS documentation)")
1691
 
    parser.add_option("--servicename", type=u"string",
1692
 
                      metavar=u"NAME", help=u"Zeroconf service name")
1693
 
    parser.add_option("--configdir", type=u"string",
1694
 
                      default=u"/etc/mandos", metavar=u"DIR",
1695
 
                      help=u"Directory to search for configuration"
1696
 
                      u" files")
1697
 
    parser.add_option("--no-dbus", action=u"store_false",
1698
 
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
1699
 
                      u" system bus interface")
1700
 
    parser.add_option("--no-ipv6", action=u"store_false",
1701
 
                      dest=u"use_ipv6", help=u"Do not use IPv6")
1702
 
    options = parser.parse_args()[0]
 
2341
    parser = argparse.ArgumentParser()
 
2342
    parser.add_argument("-v", "--version", action="version",
 
2343
                        version = "%(prog)s {}".format(version),
 
2344
                        help="show version number and exit")
 
2345
    parser.add_argument("-i", "--interface", metavar="IF",
 
2346
                        help="Bind to interface IF")
 
2347
    parser.add_argument("-a", "--address",
 
2348
                        help="Address to listen for requests on")
 
2349
    parser.add_argument("-p", "--port", type=int,
 
2350
                        help="Port number to receive requests on")
 
2351
    parser.add_argument("--check", action="store_true",
 
2352
                        help="Run self-test")
 
2353
    parser.add_argument("--debug", action="store_true",
 
2354
                        help="Debug mode; run in foreground and log"
 
2355
                        " to terminal", default=None)
 
2356
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
2357
                        help="Debug level for stdout output")
 
2358
    parser.add_argument("--priority", help="GnuTLS"
 
2359
                        " priority string (see GnuTLS documentation)")
 
2360
    parser.add_argument("--servicename",
 
2361
                        metavar="NAME", help="Zeroconf service name")
 
2362
    parser.add_argument("--configdir",
 
2363
                        default="/etc/mandos", metavar="DIR",
 
2364
                        help="Directory to search for configuration"
 
2365
                        " files")
 
2366
    parser.add_argument("--no-dbus", action="store_false",
 
2367
                        dest="use_dbus", help="Do not provide D-Bus"
 
2368
                        " system bus interface", default=None)
 
2369
    parser.add_argument("--no-ipv6", action="store_false",
 
2370
                        dest="use_ipv6", help="Do not use IPv6",
 
2371
                        default=None)
 
2372
    parser.add_argument("--no-restore", action="store_false",
 
2373
                        dest="restore", help="Do not restore stored"
 
2374
                        " state", default=None)
 
2375
    parser.add_argument("--socket", type=int,
 
2376
                        help="Specify a file descriptor to a network"
 
2377
                        " socket to use instead of creating one")
 
2378
    parser.add_argument("--statedir", metavar="DIR",
 
2379
                        help="Directory to save/restore state in")
 
2380
    parser.add_argument("--foreground", action="store_true",
 
2381
                        help="Run in foreground", default=None)
 
2382
    parser.add_argument("--no-zeroconf", action="store_false",
 
2383
                        dest="zeroconf", help="Do not use Zeroconf",
 
2384
                        default=None)
 
2385
    
 
2386
    options = parser.parse_args()
1703
2387
    
1704
2388
    if options.check:
1705
2389
        import doctest
1706
 
        doctest.testmod()
1707
 
        sys.exit()
 
2390
        fail_count, test_count = doctest.testmod()
 
2391
        sys.exit(os.EX_OK if fail_count == 0 else 1)
1708
2392
    
1709
2393
    # Default values for config file for server-global settings
1710
 
    server_defaults = { u"interface": u"",
1711
 
                        u"address": u"",
1712
 
                        u"port": u"",
1713
 
                        u"debug": u"False",
1714
 
                        u"priority":
1715
 
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1716
 
                        u"servicename": u"Mandos",
1717
 
                        u"use_dbus": u"True",
1718
 
                        u"use_ipv6": u"True",
1719
 
                        u"debuglevel": u"",
1720
 
                        }
 
2394
    server_defaults = { "interface": "",
 
2395
                        "address": "",
 
2396
                        "port": "",
 
2397
                        "debug": "False",
 
2398
                        "priority":
 
2399
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
 
2400
                        ":+SIGN-DSA-SHA256",
 
2401
                        "servicename": "Mandos",
 
2402
                        "use_dbus": "True",
 
2403
                        "use_ipv6": "True",
 
2404
                        "debuglevel": "",
 
2405
                        "restore": "True",
 
2406
                        "socket": "",
 
2407
                        "statedir": "/var/lib/mandos",
 
2408
                        "foreground": "False",
 
2409
                        "zeroconf": "True",
 
2410
                    }
1721
2411
    
1722
2412
    # Parse config file for server-global settings
1723
2413
    server_config = configparser.SafeConfigParser(server_defaults)
1724
2414
    del server_defaults
1725
 
    server_config.read(os.path.join(options.configdir,
1726
 
                                    u"mandos.conf"))
 
2415
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
1727
2416
    # Convert the SafeConfigParser object to a dict
1728
2417
    server_settings = server_config.defaults()
1729
2418
    # Use the appropriate methods on the non-string config options
1730
 
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
1731
 
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
2419
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
2420
        server_settings[option] = server_config.getboolean("DEFAULT",
1732
2421
                                                           option)
1733
2422
    if server_settings["port"]:
1734
 
        server_settings["port"] = server_config.getint(u"DEFAULT",
1735
 
                                                       u"port")
 
2423
        server_settings["port"] = server_config.getint("DEFAULT",
 
2424
                                                       "port")
 
2425
    if server_settings["socket"]:
 
2426
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2427
                                                         "socket")
 
2428
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2429
        # over with an opened os.devnull.  But we don't want this to
 
2430
        # happen with a supplied network socket.
 
2431
        if 0 <= server_settings["socket"] <= 2:
 
2432
            server_settings["socket"] = os.dup(server_settings
 
2433
                                               ["socket"])
1736
2434
    del server_config
1737
2435
    
1738
2436
    # Override the settings from the config file with command line
1739
2437
    # options, if set.
1740
 
    for option in (u"interface", u"address", u"port", u"debug",
1741
 
                   u"priority", u"servicename", u"configdir",
1742
 
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
 
2438
    for option in ("interface", "address", "port", "debug",
 
2439
                   "priority", "servicename", "configdir", "use_dbus",
 
2440
                   "use_ipv6", "debuglevel", "restore", "statedir",
 
2441
                   "socket", "foreground", "zeroconf"):
1743
2442
        value = getattr(options, option)
1744
2443
        if value is not None:
1745
2444
            server_settings[option] = value
1746
2445
    del options
1747
2446
    # Force all strings to be unicode
1748
2447
    for option in server_settings.keys():
1749
 
        if type(server_settings[option]) is str:
1750
 
            server_settings[option] = unicode(server_settings[option])
 
2448
        if isinstance(server_settings[option], bytes):
 
2449
            server_settings[option] = (server_settings[option]
 
2450
                                       .decode("utf-8"))
 
2451
    # Force all boolean options to be boolean
 
2452
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2453
                   "foreground", "zeroconf"):
 
2454
        server_settings[option] = bool(server_settings[option])
 
2455
    # Debug implies foreground
 
2456
    if server_settings["debug"]:
 
2457
        server_settings["foreground"] = True
1751
2458
    # Now we have our good server settings in "server_settings"
1752
2459
    
1753
2460
    ##################################################################
1754
2461
    
 
2462
    if (not server_settings["zeroconf"]
 
2463
        and not (server_settings["port"]
 
2464
                 or server_settings["socket"] != "")):
 
2465
        parser.error("Needs port or socket to work without Zeroconf")
 
2466
    
1755
2467
    # For convenience
1756
 
    debug = server_settings[u"debug"]
1757
 
    debuglevel = server_settings[u"debuglevel"]
1758
 
    use_dbus = server_settings[u"use_dbus"]
1759
 
    use_ipv6 = server_settings[u"use_ipv6"]
1760
 
 
1761
 
    if server_settings[u"servicename"] != u"Mandos":
1762
 
        syslogger.setFormatter(logging.Formatter
1763
 
                               (u'Mandos (%s) [%%(process)d]:'
1764
 
                                u' %%(levelname)s: %%(message)s'
1765
 
                                % server_settings[u"servicename"]))
 
2468
    debug = server_settings["debug"]
 
2469
    debuglevel = server_settings["debuglevel"]
 
2470
    use_dbus = server_settings["use_dbus"]
 
2471
    use_ipv6 = server_settings["use_ipv6"]
 
2472
    stored_state_path = os.path.join(server_settings["statedir"],
 
2473
                                     stored_state_file)
 
2474
    foreground = server_settings["foreground"]
 
2475
    zeroconf = server_settings["zeroconf"]
 
2476
    
 
2477
    if debug:
 
2478
        initlogger(debug, logging.DEBUG)
 
2479
    else:
 
2480
        if not debuglevel:
 
2481
            initlogger(debug)
 
2482
        else:
 
2483
            level = getattr(logging, debuglevel.upper())
 
2484
            initlogger(debug, level)
 
2485
    
 
2486
    if server_settings["servicename"] != "Mandos":
 
2487
        syslogger.setFormatter(
 
2488
            logging.Formatter('Mandos ({}) [%(process)d]:'
 
2489
                              ' %(levelname)s: %(message)s'.format(
 
2490
                                  server_settings["servicename"])))
1766
2491
    
1767
2492
    # Parse config file with clients
1768
 
    client_defaults = { u"timeout": u"1h",
1769
 
                        u"interval": u"5m",
1770
 
                        u"checker": u"fping -q -- %%(host)s",
1771
 
                        u"host": u"",
1772
 
                        u"approval_delay": u"0s",
1773
 
                        u"approval_duration": u"1s",
1774
 
                        }
1775
 
    client_config = configparser.SafeConfigParser(client_defaults)
1776
 
    client_config.read(os.path.join(server_settings[u"configdir"],
1777
 
                                    u"clients.conf"))
 
2493
    client_config = configparser.SafeConfigParser(Client
 
2494
                                                  .client_defaults)
 
2495
    client_config.read(os.path.join(server_settings["configdir"],
 
2496
                                    "clients.conf"))
1778
2497
    
1779
2498
    global mandos_dbus_service
1780
2499
    mandos_dbus_service = None
1781
2500
    
1782
 
    tcp_server = MandosServer((server_settings[u"address"],
1783
 
                               server_settings[u"port"]),
1784
 
                              ClientHandler,
1785
 
                              interface=(server_settings[u"interface"]
1786
 
                                         or None),
1787
 
                              use_ipv6=use_ipv6,
1788
 
                              gnutls_priority=
1789
 
                              server_settings[u"priority"],
1790
 
                              use_dbus=use_dbus)
1791
 
    if not debug:
1792
 
        pidfilename = u"/var/run/mandos.pid"
 
2501
    socketfd = None
 
2502
    if server_settings["socket"] != "":
 
2503
        socketfd = server_settings["socket"]
 
2504
    tcp_server = MandosServer(
 
2505
        (server_settings["address"], server_settings["port"]),
 
2506
        ClientHandler,
 
2507
        interface=(server_settings["interface"] or None),
 
2508
        use_ipv6=use_ipv6,
 
2509
        gnutls_priority=server_settings["priority"],
 
2510
        use_dbus=use_dbus,
 
2511
        socketfd=socketfd)
 
2512
    if not foreground:
 
2513
        pidfilename = "/run/mandos.pid"
 
2514
        if not os.path.isdir("/run/."):
 
2515
            pidfilename = "/var/run/mandos.pid"
 
2516
        pidfile = None
1793
2517
        try:
1794
 
            pidfile = open(pidfilename, u"w")
1795
 
        except IOError:
1796
 
            logger.error(u"Could not open file %r", pidfilename)
 
2518
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
 
2519
        except IOError as e:
 
2520
            logger.error("Could not open file %r", pidfilename,
 
2521
                         exc_info=e)
1797
2522
    
1798
 
    try:
1799
 
        uid = pwd.getpwnam(u"_mandos").pw_uid
1800
 
        gid = pwd.getpwnam(u"_mandos").pw_gid
1801
 
    except KeyError:
 
2523
    for name in ("_mandos", "mandos", "nobody"):
1802
2524
        try:
1803
 
            uid = pwd.getpwnam(u"mandos").pw_uid
1804
 
            gid = pwd.getpwnam(u"mandos").pw_gid
 
2525
            uid = pwd.getpwnam(name).pw_uid
 
2526
            gid = pwd.getpwnam(name).pw_gid
 
2527
            break
1805
2528
        except KeyError:
1806
 
            try:
1807
 
                uid = pwd.getpwnam(u"nobody").pw_uid
1808
 
                gid = pwd.getpwnam(u"nobody").pw_gid
1809
 
            except KeyError:
1810
 
                uid = 65534
1811
 
                gid = 65534
 
2529
            continue
 
2530
    else:
 
2531
        uid = 65534
 
2532
        gid = 65534
1812
2533
    try:
1813
2534
        os.setgid(gid)
1814
2535
        os.setuid(uid)
1815
 
    except OSError, error:
1816
 
        if error[0] != errno.EPERM:
1817
 
            raise error
 
2536
    except OSError as error:
 
2537
        if error.errno != errno.EPERM:
 
2538
            raise
1818
2539
    
1819
 
    if not debug and not debuglevel:
1820
 
        syslogger.setLevel(logging.WARNING)
1821
 
        console.setLevel(logging.WARNING)
1822
 
    if debuglevel:
1823
 
        level = getattr(logging, debuglevel.upper())
1824
 
        syslogger.setLevel(level)
1825
 
        console.setLevel(level)
1826
 
 
1827
2540
    if debug:
1828
2541
        # Enable all possible GnuTLS debugging
1829
2542
        
1833
2546
        
1834
2547
        @gnutls.library.types.gnutls_log_func
1835
2548
        def debug_gnutls(level, string):
1836
 
            logger.debug(u"GnuTLS: %s", string[:-1])
 
2549
            logger.debug("GnuTLS: %s", string[:-1])
1837
2550
        
1838
 
        (gnutls.library.functions
1839
 
         .gnutls_global_set_log_function(debug_gnutls))
 
2551
        gnutls.library.functions.gnutls_global_set_log_function(
 
2552
            debug_gnutls)
1840
2553
        
1841
2554
        # Redirect stdin so all checkers get /dev/null
1842
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2555
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1843
2556
        os.dup2(null, sys.stdin.fileno())
1844
2557
        if null > 2:
1845
2558
            os.close(null)
1846
 
    else:
1847
 
        # No console logging
1848
 
        logger.removeHandler(console)
1849
 
    
 
2559
    
 
2560
    # Need to fork before connecting to D-Bus
 
2561
    if not foreground:
 
2562
        # Close all input and output, do double fork, etc.
 
2563
        daemon()
 
2564
    
 
2565
    # multiprocessing will use threads, so before we use gobject we
 
2566
    # need to inform gobject that threads will be used.
 
2567
    gobject.threads_init()
1850
2568
    
1851
2569
    global main_loop
1852
2570
    # From the Avahi example code
1853
 
    DBusGMainLoop(set_as_default=True )
 
2571
    DBusGMainLoop(set_as_default=True)
1854
2572
    main_loop = gobject.MainLoop()
1855
2573
    bus = dbus.SystemBus()
1856
2574
    # End of Avahi example code
1857
2575
    if use_dbus:
1858
2576
        try:
1859
 
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1860
 
                                            bus, do_not_queue=True)
1861
 
        except dbus.exceptions.NameExistsException, e:
1862
 
            logger.error(unicode(e) + u", disabling D-Bus")
 
2577
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
2578
                                            bus,
 
2579
                                            do_not_queue=True)
 
2580
            old_bus_name = dbus.service.BusName(
 
2581
                "se.bsnet.fukt.Mandos", bus,
 
2582
                do_not_queue=True)
 
2583
        except dbus.exceptions.DBusException as e:
 
2584
            logger.error("Disabling D-Bus:", exc_info=e)
1863
2585
            use_dbus = False
1864
 
            server_settings[u"use_dbus"] = False
 
2586
            server_settings["use_dbus"] = False
1865
2587
            tcp_server.use_dbus = False
1866
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1867
 
    service = AvahiService(name = server_settings[u"servicename"],
1868
 
                           servicetype = u"_mandos._tcp",
1869
 
                           protocol = protocol, bus = bus)
1870
 
    if server_settings["interface"]:
1871
 
        service.interface = (if_nametoindex
1872
 
                             (str(server_settings[u"interface"])))
1873
 
 
1874
 
    if not debug:
1875
 
        # Close all input and output, do double fork, etc.
1876
 
        daemon()
1877
 
        
 
2588
    if zeroconf:
 
2589
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2590
        service = AvahiServiceToSyslog(
 
2591
            name = server_settings["servicename"],
 
2592
            servicetype = "_mandos._tcp",
 
2593
            protocol = protocol,
 
2594
            bus = bus)
 
2595
        if server_settings["interface"]:
 
2596
            service.interface = if_nametoindex(
 
2597
                server_settings["interface"].encode("utf-8"))
 
2598
    
1878
2599
    global multiprocessing_manager
1879
2600
    multiprocessing_manager = multiprocessing.Manager()
1880
2601
    
1881
2602
    client_class = Client
1882
2603
    if use_dbus:
1883
2604
        client_class = functools.partial(ClientDBus, bus = bus)
1884
 
    def client_config_items(config, section):
1885
 
        special_settings = {
1886
 
            "approved_by_default":
1887
 
                lambda: config.getboolean(section,
1888
 
                                          "approved_by_default"),
1889
 
            }
1890
 
        for name, value in config.items(section):
 
2605
    
 
2606
    client_settings = Client.config_parser(client_config)
 
2607
    old_client_settings = {}
 
2608
    clients_data = {}
 
2609
    
 
2610
    # This is used to redirect stdout and stderr for checker processes
 
2611
    global wnull
 
2612
    wnull = open(os.devnull, "w") # A writable /dev/null
 
2613
    # Only used if server is running in foreground but not in debug
 
2614
    # mode
 
2615
    if debug or not foreground:
 
2616
        wnull.close()
 
2617
    
 
2618
    # Get client data and settings from last running state.
 
2619
    if server_settings["restore"]:
 
2620
        try:
 
2621
            with open(stored_state_path, "rb") as stored_state:
 
2622
                clients_data, old_client_settings = pickle.load(
 
2623
                    stored_state)
 
2624
            os.remove(stored_state_path)
 
2625
        except IOError as e:
 
2626
            if e.errno == errno.ENOENT:
 
2627
                logger.warning("Could not load persistent state:"
 
2628
                               " {}".format(os.strerror(e.errno)))
 
2629
            else:
 
2630
                logger.critical("Could not load persistent state:",
 
2631
                                exc_info=e)
 
2632
                raise
 
2633
        except EOFError as e:
 
2634
            logger.warning("Could not load persistent state: "
 
2635
                           "EOFError:",
 
2636
                           exc_info=e)
 
2637
    
 
2638
    with PGPEngine() as pgp:
 
2639
        for client_name, client in clients_data.items():
 
2640
            # Skip removed clients
 
2641
            if client_name not in client_settings:
 
2642
                continue
 
2643
            
 
2644
            # Decide which value to use after restoring saved state.
 
2645
            # We have three different values: Old config file,
 
2646
            # new config file, and saved state.
 
2647
            # New config value takes precedence if it differs from old
 
2648
            # config value, otherwise use saved state.
 
2649
            for name, value in client_settings[client_name].items():
 
2650
                try:
 
2651
                    # For each value in new config, check if it
 
2652
                    # differs from the old config value (Except for
 
2653
                    # the "secret" attribute)
 
2654
                    if (name != "secret"
 
2655
                        and (value !=
 
2656
                             old_client_settings[client_name][name])):
 
2657
                        client[name] = value
 
2658
                except KeyError:
 
2659
                    pass
 
2660
            
 
2661
            # Clients who has passed its expire date can still be
 
2662
            # enabled if its last checker was successful.  A Client
 
2663
            # whose checker succeeded before we stored its state is
 
2664
            # assumed to have successfully run all checkers during
 
2665
            # downtime.
 
2666
            if client["enabled"]:
 
2667
                if datetime.datetime.utcnow() >= client["expires"]:
 
2668
                    if not client["last_checked_ok"]:
 
2669
                        logger.warning(
 
2670
                            "disabling client {} - Client never "
 
2671
                            "performed a successful checker".format(
 
2672
                                client_name))
 
2673
                        client["enabled"] = False
 
2674
                    elif client["last_checker_status"] != 0:
 
2675
                        logger.warning(
 
2676
                            "disabling client {} - Client last"
 
2677
                            " checker failed with error code"
 
2678
                            " {}".format(
 
2679
                                client_name,
 
2680
                                client["last_checker_status"]))
 
2681
                        client["enabled"] = False
 
2682
                    else:
 
2683
                        client["expires"] = (
 
2684
                            datetime.datetime.utcnow()
 
2685
                            + client["timeout"])
 
2686
                        logger.debug("Last checker succeeded,"
 
2687
                                     " keeping {} enabled".format(
 
2688
                                         client_name))
1891
2689
            try:
1892
 
                yield (name, special_settings[name]())
1893
 
            except KeyError:
1894
 
                yield (name, value)
1895
 
    
1896
 
    tcp_server.clients.update(set(
1897
 
            client_class(name = section,
1898
 
                         config= dict(client_config_items(
1899
 
                        client_config, section)))
1900
 
            for section in client_config.sections()))
 
2690
                client["secret"] = pgp.decrypt(
 
2691
                    client["encrypted_secret"],
 
2692
                    client_settings[client_name]["secret"])
 
2693
            except PGPError:
 
2694
                # If decryption fails, we use secret from new settings
 
2695
                logger.debug("Failed to decrypt {} old secret".format(
 
2696
                    client_name))
 
2697
                client["secret"] = (client_settings[client_name]
 
2698
                                    ["secret"])
 
2699
    
 
2700
    # Add/remove clients based on new changes made to config
 
2701
    for client_name in (set(old_client_settings)
 
2702
                        - set(client_settings)):
 
2703
        del clients_data[client_name]
 
2704
    for client_name in (set(client_settings)
 
2705
                        - set(old_client_settings)):
 
2706
        clients_data[client_name] = client_settings[client_name]
 
2707
    
 
2708
    # Create all client objects
 
2709
    for client_name, client in clients_data.items():
 
2710
        tcp_server.clients[client_name] = client_class(
 
2711
            name = client_name,
 
2712
            settings = client,
 
2713
            server_settings = server_settings)
 
2714
    
1901
2715
    if not tcp_server.clients:
1902
 
        logger.warning(u"No clients defined")
1903
 
        
1904
 
    if not debug:
1905
 
        try:
1906
 
            with pidfile:
1907
 
                pid = os.getpid()
1908
 
                pidfile.write(str(pid) + "\n")
1909
 
            del pidfile
1910
 
        except IOError:
1911
 
            logger.error(u"Could not write to file %r with PID %d",
1912
 
                         pidfilename, pid)
1913
 
        except NameError:
1914
 
            # "pidfile" was never created
1915
 
            pass
 
2716
        logger.warning("No clients defined")
 
2717
    
 
2718
    if not foreground:
 
2719
        if pidfile is not None:
 
2720
            pid = os.getpid()
 
2721
            try:
 
2722
                with pidfile:
 
2723
                    print(pid, file=pidfile)
 
2724
            except IOError:
 
2725
                logger.error("Could not write to file %r with PID %d",
 
2726
                             pidfilename, pid)
 
2727
        del pidfile
1916
2728
        del pidfilename
1917
 
        
1918
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1919
 
 
 
2729
    
1920
2730
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1921
2731
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1922
2732
    
1923
2733
    if use_dbus:
1924
 
        class MandosDBusService(dbus.service.Object):
 
2734
        
 
2735
        @alternate_dbus_interfaces(
 
2736
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
 
2737
        class MandosDBusService(DBusObjectWithProperties):
1925
2738
            """A D-Bus proxy object"""
 
2739
            
1926
2740
            def __init__(self):
1927
 
                dbus.service.Object.__init__(self, bus, u"/")
1928
 
            _interface = u"se.bsnet.fukt.Mandos"
1929
 
            
1930
 
            @dbus.service.signal(_interface, signature=u"o")
 
2741
                dbus.service.Object.__init__(self, bus, "/")
 
2742
            
 
2743
            _interface = "se.recompile.Mandos"
 
2744
            
 
2745
            @dbus_interface_annotations(_interface)
 
2746
            def _foo(self):
 
2747
                return {
 
2748
                    "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
2749
                    "false" }
 
2750
            
 
2751
            @dbus.service.signal(_interface, signature="o")
1931
2752
            def ClientAdded(self, objpath):
1932
2753
                "D-Bus signal"
1933
2754
                pass
1934
2755
            
1935
 
            @dbus.service.signal(_interface, signature=u"ss")
 
2756
            @dbus.service.signal(_interface, signature="ss")
1936
2757
            def ClientNotFound(self, fingerprint, address):
1937
2758
                "D-Bus signal"
1938
2759
                pass
1939
2760
            
1940
 
            @dbus.service.signal(_interface, signature=u"os")
 
2761
            @dbus.service.signal(_interface, signature="os")
1941
2762
            def ClientRemoved(self, objpath, name):
1942
2763
                "D-Bus signal"
1943
2764
                pass
1944
2765
            
1945
 
            @dbus.service.method(_interface, out_signature=u"ao")
 
2766
            @dbus.service.method(_interface, out_signature="ao")
1946
2767
            def GetAllClients(self):
1947
2768
                "D-Bus method"
1948
 
                return dbus.Array(c.dbus_object_path
1949
 
                                  for c in tcp_server.clients)
 
2769
                return dbus.Array(c.dbus_object_path for c in
 
2770
                                  tcp_server.clients.itervalues())
1950
2771
            
1951
2772
            @dbus.service.method(_interface,
1952
 
                                 out_signature=u"a{oa{sv}}")
 
2773
                                 out_signature="a{oa{sv}}")
1953
2774
            def GetAllClientsWithProperties(self):
1954
2775
                "D-Bus method"
1955
2776
                return dbus.Dictionary(
1956
 
                    ((c.dbus_object_path, c.GetAll(u""))
1957
 
                     for c in tcp_server.clients),
1958
 
                    signature=u"oa{sv}")
 
2777
                    { c.dbus_object_path: c.GetAll("")
 
2778
                      for c in tcp_server.clients.itervalues() },
 
2779
                    signature="oa{sv}")
1959
2780
            
1960
 
            @dbus.service.method(_interface, in_signature=u"o")
 
2781
            @dbus.service.method(_interface, in_signature="o")
1961
2782
            def RemoveClient(self, object_path):
1962
2783
                "D-Bus method"
1963
 
                for c in tcp_server.clients:
 
2784
                for c in tcp_server.clients.itervalues():
1964
2785
                    if c.dbus_object_path == object_path:
1965
 
                        tcp_server.clients.remove(c)
 
2786
                        del tcp_server.clients[c.name]
1966
2787
                        c.remove_from_connection()
1967
2788
                        # Don't signal anything except ClientRemoved
1968
2789
                        c.disable(quiet=True)
1977
2798
    
1978
2799
    def cleanup():
1979
2800
        "Cleanup function; run on exit"
1980
 
        service.cleanup()
1981
 
        
 
2801
        if zeroconf:
 
2802
            service.cleanup()
 
2803
        
 
2804
        multiprocessing.active_children()
 
2805
        wnull.close()
 
2806
        if not (tcp_server.clients or client_settings):
 
2807
            return
 
2808
        
 
2809
        # Store client before exiting. Secrets are encrypted with key
 
2810
        # based on what config file has. If config file is
 
2811
        # removed/edited, old secret will thus be unrecovable.
 
2812
        clients = {}
 
2813
        with PGPEngine() as pgp:
 
2814
            for client in tcp_server.clients.itervalues():
 
2815
                key = client_settings[client.name]["secret"]
 
2816
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2817
                                                      key)
 
2818
                client_dict = {}
 
2819
                
 
2820
                # A list of attributes that can not be pickled
 
2821
                # + secret.
 
2822
                exclude = { "bus", "changedstate", "secret",
 
2823
                            "checker", "server_settings" }
 
2824
                for name, typ in inspect.getmembers(dbus.service
 
2825
                                                    .Object):
 
2826
                    exclude.add(name)
 
2827
                
 
2828
                client_dict["encrypted_secret"] = (client
 
2829
                                                   .encrypted_secret)
 
2830
                for attr in client.client_structure:
 
2831
                    if attr not in exclude:
 
2832
                        client_dict[attr] = getattr(client, attr)
 
2833
                
 
2834
                clients[client.name] = client_dict
 
2835
                del client_settings[client.name]["secret"]
 
2836
        
 
2837
        try:
 
2838
            with tempfile.NamedTemporaryFile(
 
2839
                    mode='wb',
 
2840
                    suffix=".pickle",
 
2841
                    prefix='clients-',
 
2842
                    dir=os.path.dirname(stored_state_path),
 
2843
                    delete=False) as stored_state:
 
2844
                pickle.dump((clients, client_settings), stored_state)
 
2845
                tempname = stored_state.name
 
2846
            os.rename(tempname, stored_state_path)
 
2847
        except (IOError, OSError) as e:
 
2848
            if not debug:
 
2849
                try:
 
2850
                    os.remove(tempname)
 
2851
                except NameError:
 
2852
                    pass
 
2853
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2854
                logger.warning("Could not save persistent state: {}"
 
2855
                               .format(os.strerror(e.errno)))
 
2856
            else:
 
2857
                logger.warning("Could not save persistent state:",
 
2858
                               exc_info=e)
 
2859
                raise
 
2860
        
 
2861
        # Delete all clients, and settings from config
1982
2862
        while tcp_server.clients:
1983
 
            client = tcp_server.clients.pop()
 
2863
            name, client = tcp_server.clients.popitem()
1984
2864
            if use_dbus:
1985
2865
                client.remove_from_connection()
1986
 
            client.disable_hook = None
1987
2866
            # Don't signal anything except ClientRemoved
1988
2867
            client.disable(quiet=True)
1989
2868
            if use_dbus:
1990
2869
                # Emit D-Bus signal
1991
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1992
 
                                                  client.name)
 
2870
                mandos_dbus_service.ClientRemoved(
 
2871
                    client.dbus_object_path, client.name)
 
2872
        client_settings.clear()
1993
2873
    
1994
2874
    atexit.register(cleanup)
1995
2875
    
1996
 
    for client in tcp_server.clients:
 
2876
    for client in tcp_server.clients.itervalues():
1997
2877
        if use_dbus:
1998
2878
            # Emit D-Bus signal
1999
2879
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2000
 
        client.enable()
 
2880
        # Need to initiate checking of clients
 
2881
        if client.enabled:
 
2882
            client.init_checker()
2001
2883
    
2002
2884
    tcp_server.enable()
2003
2885
    tcp_server.server_activate()
2004
2886
    
2005
2887
    # Find out what port we got
2006
 
    service.port = tcp_server.socket.getsockname()[1]
 
2888
    if zeroconf:
 
2889
        service.port = tcp_server.socket.getsockname()[1]
2007
2890
    if use_ipv6:
2008
 
        logger.info(u"Now listening on address %r, port %d,"
2009
 
                    " flowinfo %d, scope_id %d"
2010
 
                    % tcp_server.socket.getsockname())
 
2891
        logger.info("Now listening on address %r, port %d,"
 
2892
                    " flowinfo %d, scope_id %d",
 
2893
                    *tcp_server.socket.getsockname())
2011
2894
    else:                       # IPv4
2012
 
        logger.info(u"Now listening on address %r, port %d"
2013
 
                    % tcp_server.socket.getsockname())
 
2895
        logger.info("Now listening on address %r, port %d",
 
2896
                    *tcp_server.socket.getsockname())
2014
2897
    
2015
2898
    #service.interface = tcp_server.socket.getsockname()[3]
2016
2899
    
2017
2900
    try:
2018
 
        # From the Avahi example code
2019
 
        try:
2020
 
            service.activate()
2021
 
        except dbus.exceptions.DBusException, error:
2022
 
            logger.critical(u"DBusException: %s", error)
2023
 
            cleanup()
2024
 
            sys.exit(1)
2025
 
        # End of Avahi example code
 
2901
        if zeroconf:
 
2902
            # From the Avahi example code
 
2903
            try:
 
2904
                service.activate()
 
2905
            except dbus.exceptions.DBusException as error:
 
2906
                logger.critical("D-Bus Exception", exc_info=error)
 
2907
                cleanup()
 
2908
                sys.exit(1)
 
2909
            # End of Avahi example code
2026
2910
        
2027
2911
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2028
2912
                             lambda *args, **kwargs:
2029
2913
                             (tcp_server.handle_request
2030
2914
                              (*args[2:], **kwargs) or True))
2031
2915
        
2032
 
        logger.debug(u"Starting main loop")
 
2916
        logger.debug("Starting main loop")
2033
2917
        main_loop.run()
2034
 
    except AvahiError, error:
2035
 
        logger.critical(u"AvahiError: %s", error)
 
2918
    except AvahiError as error:
 
2919
        logger.critical("Avahi Error", exc_info=error)
2036
2920
        cleanup()
2037
2921
        sys.exit(1)
2038
2922
    except KeyboardInterrupt:
2039
2923
        if debug:
2040
 
            print >> sys.stderr
2041
 
        logger.debug(u"Server received KeyboardInterrupt")
2042
 
    logger.debug(u"Server exiting")
 
2924
            print("", file=sys.stderr)
 
2925
        logger.debug("Server received KeyboardInterrupt")
 
2926
    logger.debug("Server exiting")
2043
2927
    # Must run before the D-Bus bus name gets deregistered
2044
2928
    cleanup()
2045
2929
 
 
2930
 
2046
2931
if __name__ == '__main__':
2047
2932
    main()