/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2015-12-05 02:00:01 UTC
  • mfrom: (237.4.61 release)
  • Revision ID: teddy@recompile.se-20151205020001-b0cpa52ame0usaul
Merge from release branch.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python
 
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2008-2015 Teddy Hogeborn
 
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
 
from __future__ import division, with_statement, absolute_import
35
 
 
36
 
import SocketServer as socketserver
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
 
36
 
 
37
from future_builtins import *
 
38
 
 
39
try:
 
40
    import SocketServer as socketserver
 
41
except ImportError:
 
42
    import socketserver
37
43
import socket
38
 
import optparse
 
44
import argparse
39
45
import datetime
40
46
import errno
41
47
import gnutls.crypto
44
50
import gnutls.library.functions
45
51
import gnutls.library.constants
46
52
import gnutls.library.types
47
 
import ConfigParser as configparser
 
53
try:
 
54
    import ConfigParser as configparser
 
55
except ImportError:
 
56
    import configparser
48
57
import sys
49
58
import re
50
59
import os
55
64
import logging
56
65
import logging.handlers
57
66
import pwd
58
 
from contextlib import closing
 
67
import contextlib
59
68
import struct
60
69
import fcntl
61
70
import functools
 
71
try:
 
72
    import cPickle as pickle
 
73
except ImportError:
 
74
    import pickle
 
75
import multiprocessing
 
76
import types
 
77
import binascii
 
78
import tempfile
 
79
import itertools
 
80
import collections
 
81
import codecs
62
82
 
63
83
import dbus
64
84
import dbus.service
65
 
import gobject
 
85
try:
 
86
    import gobject
 
87
except ImportError:
 
88
    from gi.repository import GObject as gobject
66
89
import avahi
67
90
from dbus.mainloop.glib import DBusGMainLoop
68
91
import ctypes
69
92
import ctypes.util
 
93
import xml.dom.minidom
 
94
import inspect
70
95
 
71
96
try:
72
97
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
76
101
    except ImportError:
77
102
        SO_BINDTODEVICE = None
78
103
 
79
 
 
80
 
version = "1.0.11"
81
 
 
82
 
logger = logging.Logger(u'mandos')
83
 
syslogger = (logging.handlers.SysLogHandler
84
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
 
              address = "/dev/log"))
86
 
syslogger.setFormatter(logging.Formatter
87
 
                       (u'Mandos [%(process)d]: %(levelname)s:'
88
 
                        u' %(message)s'))
89
 
logger.addHandler(syslogger)
90
 
 
91
 
console = logging.StreamHandler()
92
 
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
 
                                       u' %(levelname)s:'
94
 
                                       u' %(message)s'))
95
 
logger.addHandler(console)
 
104
if sys.version_info.major == 2:
 
105
    str = unicode
 
106
 
 
107
version = "1.7.1"
 
108
stored_state_file = "clients.pickle"
 
109
 
 
110
logger = logging.getLogger()
 
111
syslogger = None
 
112
 
 
113
try:
 
114
    if_nametoindex = ctypes.cdll.LoadLibrary(
 
115
        ctypes.util.find_library("c")).if_nametoindex
 
116
except (OSError, AttributeError):
 
117
    
 
118
    def if_nametoindex(interface):
 
119
        "Get an interface index the hard way, i.e. using fcntl()"
 
120
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
121
        with contextlib.closing(socket.socket()) as s:
 
122
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
123
                                struct.pack(b"16s16x", interface))
 
124
        interface_index = struct.unpack("I", ifreq[16:20])[0]
 
125
        return interface_index
 
126
 
 
127
 
 
128
def initlogger(debug, level=logging.WARNING):
 
129
    """init logger and add loglevel"""
 
130
    
 
131
    global syslogger
 
132
    syslogger = (logging.handlers.SysLogHandler(
 
133
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
134
        address = "/dev/log"))
 
135
    syslogger.setFormatter(logging.Formatter
 
136
                           ('Mandos [%(process)d]: %(levelname)s:'
 
137
                            ' %(message)s'))
 
138
    logger.addHandler(syslogger)
 
139
    
 
140
    if debug:
 
141
        console = logging.StreamHandler()
 
142
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
143
                                               ' [%(process)d]:'
 
144
                                               ' %(levelname)s:'
 
145
                                               ' %(message)s'))
 
146
        logger.addHandler(console)
 
147
    logger.setLevel(level)
 
148
 
 
149
 
 
150
class PGPError(Exception):
 
151
    """Exception if encryption/decryption fails"""
 
152
    pass
 
153
 
 
154
 
 
155
class PGPEngine(object):
 
156
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
157
    
 
158
    def __init__(self):
 
159
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
160
        self.gnupgargs = ['--batch',
 
161
                          '--home', self.tempdir,
 
162
                          '--force-mdc',
 
163
                          '--quiet',
 
164
                          '--no-use-agent']
 
165
    
 
166
    def __enter__(self):
 
167
        return self
 
168
    
 
169
    def __exit__(self, exc_type, exc_value, traceback):
 
170
        self._cleanup()
 
171
        return False
 
172
    
 
173
    def __del__(self):
 
174
        self._cleanup()
 
175
    
 
176
    def _cleanup(self):
 
177
        if self.tempdir is not None:
 
178
            # Delete contents of tempdir
 
179
            for root, dirs, files in os.walk(self.tempdir,
 
180
                                             topdown = False):
 
181
                for filename in files:
 
182
                    os.remove(os.path.join(root, filename))
 
183
                for dirname in dirs:
 
184
                    os.rmdir(os.path.join(root, dirname))
 
185
            # Remove tempdir
 
186
            os.rmdir(self.tempdir)
 
187
            self.tempdir = None
 
188
    
 
189
    def password_encode(self, password):
 
190
        # Passphrase can not be empty and can not contain newlines or
 
191
        # NUL bytes.  So we prefix it and hex encode it.
 
192
        encoded = b"mandos" + binascii.hexlify(password)
 
193
        if len(encoded) > 2048:
 
194
            # GnuPG can't handle long passwords, so encode differently
 
195
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
196
                       .replace(b"\n", b"\\n")
 
197
                       .replace(b"\0", b"\\x00"))
 
198
        return encoded
 
199
    
 
200
    def encrypt(self, data, password):
 
201
        passphrase = self.password_encode(password)
 
202
        with tempfile.NamedTemporaryFile(
 
203
                dir=self.tempdir) as passfile:
 
204
            passfile.write(passphrase)
 
205
            passfile.flush()
 
206
            proc = subprocess.Popen(['gpg', '--symmetric',
 
207
                                     '--passphrase-file',
 
208
                                     passfile.name]
 
209
                                    + self.gnupgargs,
 
210
                                    stdin = subprocess.PIPE,
 
211
                                    stdout = subprocess.PIPE,
 
212
                                    stderr = subprocess.PIPE)
 
213
            ciphertext, err = proc.communicate(input = data)
 
214
        if proc.returncode != 0:
 
215
            raise PGPError(err)
 
216
        return ciphertext
 
217
    
 
218
    def decrypt(self, data, password):
 
219
        passphrase = self.password_encode(password)
 
220
        with tempfile.NamedTemporaryFile(
 
221
                dir = self.tempdir) as passfile:
 
222
            passfile.write(passphrase)
 
223
            passfile.flush()
 
224
            proc = subprocess.Popen(['gpg', '--decrypt',
 
225
                                     '--passphrase-file',
 
226
                                     passfile.name]
 
227
                                    + self.gnupgargs,
 
228
                                    stdin = subprocess.PIPE,
 
229
                                    stdout = subprocess.PIPE,
 
230
                                    stderr = subprocess.PIPE)
 
231
            decrypted_plaintext, err = proc.communicate(input = data)
 
232
        if proc.returncode != 0:
 
233
            raise PGPError(err)
 
234
        return decrypted_plaintext
 
235
 
96
236
 
97
237
class AvahiError(Exception):
98
238
    def __init__(self, value, *args, **kwargs):
99
239
        self.value = value
100
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
101
 
    def __unicode__(self):
102
 
        return unicode(repr(self.value))
 
240
        return super(AvahiError, self).__init__(value, *args,
 
241
                                                **kwargs)
 
242
 
103
243
 
104
244
class AvahiServiceError(AvahiError):
105
245
    pass
106
246
 
 
247
 
107
248
class AvahiGroupError(AvahiError):
108
249
    pass
109
250
 
114
255
    Attributes:
115
256
    interface: integer; avahi.IF_UNSPEC or an interface index.
116
257
               Used to optionally bind to the specified interface.
117
 
    name: string; Example: u'Mandos'
118
 
    type: string; Example: u'_mandos._tcp'.
119
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
258
    name: string; Example: 'Mandos'
 
259
    type: string; Example: '_mandos._tcp'.
 
260
     See <https://www.iana.org/assignments/service-names-port-numbers>
120
261
    port: integer; what port to announce
121
262
    TXT: list of strings; TXT record for the service
122
263
    domain: string; Domain to publish on, default to .local if empty.
128
269
    server: D-Bus Server
129
270
    bus: dbus.SystemBus()
130
271
    """
131
 
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
132
 
                 servicetype = None, port = None, TXT = None,
133
 
                 domain = u"", host = u"", max_renames = 32768,
134
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
272
    
 
273
    def __init__(self,
 
274
                 interface = avahi.IF_UNSPEC,
 
275
                 name = None,
 
276
                 servicetype = None,
 
277
                 port = None,
 
278
                 TXT = None,
 
279
                 domain = "",
 
280
                 host = "",
 
281
                 max_renames = 32768,
 
282
                 protocol = avahi.PROTO_UNSPEC,
 
283
                 bus = None):
135
284
        self.interface = interface
136
285
        self.name = name
137
286
        self.type = servicetype
145
294
        self.group = None       # our entry group
146
295
        self.server = None
147
296
        self.bus = bus
148
 
    def rename(self):
 
297
        self.entry_group_state_changed_match = None
 
298
    
 
299
    def rename(self, remove=True):
149
300
        """Derived from the Avahi example code"""
150
301
        if self.rename_count >= self.max_renames:
151
 
            logger.critical(u"No suitable Zeroconf service name found"
152
 
                            u" after %i retries, exiting.",
 
302
            logger.critical("No suitable Zeroconf service name found"
 
303
                            " after %i retries, exiting.",
153
304
                            self.rename_count)
154
 
            raise AvahiServiceError(u"Too many renames")
155
 
        self.name = self.server.GetAlternativeServiceName(self.name)
156
 
        logger.info(u"Changing Zeroconf service name to %r ...",
157
 
                    unicode(self.name))
158
 
        syslogger.setFormatter(logging.Formatter
159
 
                               (u'Mandos (%s) [%%(process)d]:'
160
 
                                u' %%(levelname)s: %%(message)s'
161
 
                                % self.name))
162
 
        self.remove()
163
 
        self.add()
 
305
            raise AvahiServiceError("Too many renames")
 
306
        self.name = str(
 
307
            self.server.GetAlternativeServiceName(self.name))
164
308
        self.rename_count += 1
 
309
        logger.info("Changing Zeroconf service name to %r ...",
 
310
                    self.name)
 
311
        if remove:
 
312
            self.remove()
 
313
        try:
 
314
            self.add()
 
315
        except dbus.exceptions.DBusException as error:
 
316
            if (error.get_dbus_name()
 
317
                == "org.freedesktop.Avahi.CollisionError"):
 
318
                logger.info("Local Zeroconf service name collision.")
 
319
                return self.rename(remove=False)
 
320
            else:
 
321
                logger.critical("D-Bus Exception", exc_info=error)
 
322
                self.cleanup()
 
323
                os._exit(1)
 
324
    
165
325
    def remove(self):
166
326
        """Derived from the Avahi example code"""
 
327
        if self.entry_group_state_changed_match is not None:
 
328
            self.entry_group_state_changed_match.remove()
 
329
            self.entry_group_state_changed_match = None
167
330
        if self.group is not None:
168
331
            self.group.Reset()
 
332
    
169
333
    def add(self):
170
334
        """Derived from the Avahi example code"""
 
335
        self.remove()
171
336
        if self.group is None:
172
337
            self.group = dbus.Interface(
173
338
                self.bus.get_object(avahi.DBUS_NAME,
174
339
                                    self.server.EntryGroupNew()),
175
340
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
 
            self.group.connect_to_signal('StateChanged',
177
 
                                         self.entry_group_state_changed)
178
 
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
 
341
        self.entry_group_state_changed_match = (
 
342
            self.group.connect_to_signal(
 
343
                'StateChanged', self.entry_group_state_changed))
 
344
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
179
345
                     self.name, self.type)
180
346
        self.group.AddService(
181
347
            self.interface,
186
352
            dbus.UInt16(self.port),
187
353
            avahi.string_array_to_txt_array(self.TXT))
188
354
        self.group.Commit()
 
355
    
189
356
    def entry_group_state_changed(self, state, error):
190
357
        """Derived from the Avahi example code"""
191
 
        logger.debug(u"Avahi state change: %i", state)
 
358
        logger.debug("Avahi entry group state change: %i", state)
192
359
        
193
360
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
 
            logger.debug(u"Zeroconf service established.")
 
361
            logger.debug("Zeroconf service established.")
195
362
        elif state == avahi.ENTRY_GROUP_COLLISION:
196
 
            logger.warning(u"Zeroconf service name collision.")
 
363
            logger.info("Zeroconf service name collision.")
197
364
            self.rename()
198
365
        elif state == avahi.ENTRY_GROUP_FAILURE:
199
 
            logger.critical(u"Avahi: Error in group state changed %s",
200
 
                            unicode(error))
201
 
            raise AvahiGroupError(u"State changed: %s"
202
 
                                  % unicode(error))
 
366
            logger.critical("Avahi: Error in group state changed %s",
 
367
                            str(error))
 
368
            raise AvahiGroupError("State changed: {!s}".format(error))
 
369
    
203
370
    def cleanup(self):
204
371
        """Derived from the Avahi example code"""
205
372
        if self.group is not None:
206
 
            self.group.Free()
 
373
            try:
 
374
                self.group.Free()
 
375
            except (dbus.exceptions.UnknownMethodException,
 
376
                    dbus.exceptions.DBusException):
 
377
                pass
207
378
            self.group = None
208
 
    def server_state_changed(self, state):
 
379
        self.remove()
 
380
    
 
381
    def server_state_changed(self, state, error=None):
209
382
        """Derived from the Avahi example code"""
210
 
        if state == avahi.SERVER_COLLISION:
211
 
            logger.error(u"Zeroconf server name collision")
212
 
            self.remove()
 
383
        logger.debug("Avahi server state change: %i", state)
 
384
        bad_states = {
 
385
            avahi.SERVER_INVALID: "Zeroconf server invalid",
 
386
            avahi.SERVER_REGISTERING: None,
 
387
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
 
388
            avahi.SERVER_FAILURE: "Zeroconf server failure",
 
389
        }
 
390
        if state in bad_states:
 
391
            if bad_states[state] is not None:
 
392
                if error is None:
 
393
                    logger.error(bad_states[state])
 
394
                else:
 
395
                    logger.error(bad_states[state] + ": %r", error)
 
396
            self.cleanup()
213
397
        elif state == avahi.SERVER_RUNNING:
214
 
            self.add()
 
398
            try:
 
399
                self.add()
 
400
            except dbus.exceptions.DBusException as error:
 
401
                if (error.get_dbus_name()
 
402
                    == "org.freedesktop.Avahi.CollisionError"):
 
403
                    logger.info("Local Zeroconf service name"
 
404
                                " collision.")
 
405
                    return self.rename(remove=False)
 
406
                else:
 
407
                    logger.critical("D-Bus Exception", exc_info=error)
 
408
                    self.cleanup()
 
409
                    os._exit(1)
 
410
        else:
 
411
            if error is None:
 
412
                logger.debug("Unknown state: %r", state)
 
413
            else:
 
414
                logger.debug("Unknown state: %r: %r", state, error)
 
415
    
215
416
    def activate(self):
216
417
        """Derived from the Avahi example code"""
217
418
        if self.server is None:
218
419
            self.server = dbus.Interface(
219
420
                self.bus.get_object(avahi.DBUS_NAME,
220
 
                                    avahi.DBUS_PATH_SERVER),
 
421
                                    avahi.DBUS_PATH_SERVER,
 
422
                                    follow_name_owner_changes=True),
221
423
                avahi.DBUS_INTERFACE_SERVER)
222
 
        self.server.connect_to_signal(u"StateChanged",
223
 
                                 self.server_state_changed)
 
424
        self.server.connect_to_signal("StateChanged",
 
425
                                      self.server_state_changed)
224
426
        self.server_state_changed(self.server.GetState())
225
427
 
226
428
 
 
429
class AvahiServiceToSyslog(AvahiService):
 
430
    def rename(self, *args, **kwargs):
 
431
        """Add the new name to the syslog messages"""
 
432
        ret = AvahiService.rename(self, *args, **kwargs)
 
433
        syslogger.setFormatter(logging.Formatter(
 
434
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
435
            .format(self.name)))
 
436
        return ret
 
437
 
 
438
def call_pipe(connection,       # : multiprocessing.Connection
 
439
              func, *args, **kwargs):
 
440
    """This function is meant to be called by multiprocessing.Process
 
441
    
 
442
    This function runs func(*args, **kwargs), and writes the resulting
 
443
    return value on the provided multiprocessing.Connection.
 
444
    """
 
445
    connection.send(func(*args, **kwargs))
 
446
    connection.close()
 
447
 
227
448
class Client(object):
228
449
    """A representation of a client host served by this server.
229
450
    
230
451
    Attributes:
231
 
    name:       string; from the config file, used in log messages and
232
 
                        D-Bus identifiers
233
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
234
 
                 uniquely identify the client
235
 
    secret:     bytestring; sent verbatim (over TLS) to client
236
 
    host:       string; available for use by the checker command
237
 
    created:    datetime.datetime(); (UTC) object creation
238
 
    last_enabled: datetime.datetime(); (UTC)
239
 
    enabled:    bool()
240
 
    last_checked_ok: datetime.datetime(); (UTC) or None
241
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
242
 
                                      until this client is invalid
243
 
    interval:   datetime.timedelta(); How often to start a new checker
244
 
    disable_hook:  If set, called by disable() as disable_hook(self)
 
452
    approved:   bool(); 'None' if not yet approved/disapproved
 
453
    approval_delay: datetime.timedelta(); Time to wait for approval
 
454
    approval_duration: datetime.timedelta(); Duration of one approval
245
455
    checker:    subprocess.Popen(); a running checker process used
246
456
                                    to see if the client lives.
247
457
                                    'None' if no process is running.
248
 
    checker_initiator_tag: a gobject event source tag, or None
249
 
    disable_initiator_tag:    - '' -
250
 
    checker_callback_tag:  - '' -
251
 
    checker_command: string; External command which is run to check if
252
 
                     client lives.  %() expansions are done at
 
458
    checker_callback_tag: a gobject event source tag, or None
 
459
    checker_command: string; External command which is run to check
 
460
                     if client lives.  %() expansions are done at
253
461
                     runtime with vars(self) as dict, so that for
254
462
                     instance %(name)s can be used in the command.
 
463
    checker_initiator_tag: a gobject event source tag, or None
 
464
    created:    datetime.datetime(); (UTC) object creation
 
465
    client_structure: Object describing what attributes a client has
 
466
                      and is used for storing the client at exit
255
467
    current_checker_command: string; current running checker_command
 
468
    disable_initiator_tag: a gobject event source tag, or None
 
469
    enabled:    bool()
 
470
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
471
                 uniquely identify the client
 
472
    host:       string; available for use by the checker command
 
473
    interval:   datetime.timedelta(); How often to start a new checker
 
474
    last_approval_request: datetime.datetime(); (UTC) or None
 
475
    last_checked_ok: datetime.datetime(); (UTC) or None
 
476
    last_checker_status: integer between 0 and 255 reflecting exit
 
477
                         status of last checker. -1 reflects crashed
 
478
                         checker, -2 means no checker completed yet.
 
479
    last_checker_signal: The signal which killed the last checker, if
 
480
                         last_checker_status is -1
 
481
    last_enabled: datetime.datetime(); (UTC) or None
 
482
    name:       string; from the config file, used in log messages and
 
483
                        D-Bus identifiers
 
484
    secret:     bytestring; sent verbatim (over TLS) to client
 
485
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
486
                                      until this client is disabled
 
487
    extended_timeout:   extra long timeout when secret has been sent
 
488
    runtime_expansions: Allowed attributes for runtime expansion.
 
489
    expires:    datetime.datetime(); time (UTC) when a client will be
 
490
                disabled, or None
 
491
    server_settings: The server_settings dict from main()
256
492
    """
257
493
    
 
494
    runtime_expansions = ("approval_delay", "approval_duration",
 
495
                          "created", "enabled", "expires",
 
496
                          "fingerprint", "host", "interval",
 
497
                          "last_approval_request", "last_checked_ok",
 
498
                          "last_enabled", "name", "timeout")
 
499
    client_defaults = {
 
500
        "timeout": "PT5M",
 
501
        "extended_timeout": "PT15M",
 
502
        "interval": "PT2M",
 
503
        "checker": "fping -q -- %%(host)s",
 
504
        "host": "",
 
505
        "approval_delay": "PT0S",
 
506
        "approval_duration": "PT1S",
 
507
        "approved_by_default": "True",
 
508
        "enabled": "True",
 
509
    }
 
510
    
258
511
    @staticmethod
259
 
    def _datetime_to_milliseconds(dt):
260
 
        "Convert a datetime.datetime() to milliseconds"
261
 
        return ((dt.days * 24 * 60 * 60 * 1000)
262
 
                + (dt.seconds * 1000)
263
 
                + (dt.microseconds // 1000))
264
 
    
265
 
    def timeout_milliseconds(self):
266
 
        "Return the 'timeout' attribute in milliseconds"
267
 
        return self._datetime_to_milliseconds(self.timeout)
268
 
    
269
 
    def interval_milliseconds(self):
270
 
        "Return the 'interval' attribute in milliseconds"
271
 
        return self._datetime_to_milliseconds(self.interval)
272
 
    
273
 
    def __init__(self, name = None, disable_hook=None, config=None):
274
 
        """Note: the 'checker' key in 'config' sets the
275
 
        'checker_command' attribute and *not* the 'checker'
276
 
        attribute."""
 
512
    def config_parser(config):
 
513
        """Construct a new dict of client settings of this form:
 
514
        { client_name: {setting_name: value, ...}, ...}
 
515
        with exceptions for any special settings as defined above.
 
516
        NOTE: Must be a pure function. Must return the same result
 
517
        value given the same arguments.
 
518
        """
 
519
        settings = {}
 
520
        for client_name in config.sections():
 
521
            section = dict(config.items(client_name))
 
522
            client = settings[client_name] = {}
 
523
            
 
524
            client["host"] = section["host"]
 
525
            # Reformat values from string types to Python types
 
526
            client["approved_by_default"] = config.getboolean(
 
527
                client_name, "approved_by_default")
 
528
            client["enabled"] = config.getboolean(client_name,
 
529
                                                  "enabled")
 
530
            
 
531
            # Uppercase and remove spaces from fingerprint for later
 
532
            # comparison purposes with return value from the
 
533
            # fingerprint() function
 
534
            client["fingerprint"] = (section["fingerprint"].upper()
 
535
                                     .replace(" ", ""))
 
536
            if "secret" in section:
 
537
                client["secret"] = section["secret"].decode("base64")
 
538
            elif "secfile" in section:
 
539
                with open(os.path.expanduser(os.path.expandvars
 
540
                                             (section["secfile"])),
 
541
                          "rb") as secfile:
 
542
                    client["secret"] = secfile.read()
 
543
            else:
 
544
                raise TypeError("No secret or secfile for section {}"
 
545
                                .format(section))
 
546
            client["timeout"] = string_to_delta(section["timeout"])
 
547
            client["extended_timeout"] = string_to_delta(
 
548
                section["extended_timeout"])
 
549
            client["interval"] = string_to_delta(section["interval"])
 
550
            client["approval_delay"] = string_to_delta(
 
551
                section["approval_delay"])
 
552
            client["approval_duration"] = string_to_delta(
 
553
                section["approval_duration"])
 
554
            client["checker_command"] = section["checker"]
 
555
            client["last_approval_request"] = None
 
556
            client["last_checked_ok"] = None
 
557
            client["last_checker_status"] = -2
 
558
        
 
559
        return settings
 
560
    
 
561
    def __init__(self, settings, name = None, server_settings=None):
277
562
        self.name = name
278
 
        if config is None:
279
 
            config = {}
280
 
        logger.debug(u"Creating client %r", self.name)
281
 
        # Uppercase and remove spaces from fingerprint for later
282
 
        # comparison purposes with return value from the fingerprint()
283
 
        # function
284
 
        self.fingerprint = (config[u"fingerprint"].upper()
285
 
                            .replace(u" ", u""))
286
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
287
 
        if u"secret" in config:
288
 
            self.secret = config[u"secret"].decode(u"base64")
289
 
        elif u"secfile" in config:
290
 
            with closing(open(os.path.expanduser
291
 
                              (os.path.expandvars
292
 
                               (config[u"secfile"])))) as secfile:
293
 
                self.secret = secfile.read()
 
563
        if server_settings is None:
 
564
            server_settings = {}
 
565
        self.server_settings = server_settings
 
566
        # adding all client settings
 
567
        for setting, value in settings.items():
 
568
            setattr(self, setting, value)
 
569
        
 
570
        if self.enabled:
 
571
            if not hasattr(self, "last_enabled"):
 
572
                self.last_enabled = datetime.datetime.utcnow()
 
573
            if not hasattr(self, "expires"):
 
574
                self.expires = (datetime.datetime.utcnow()
 
575
                                + self.timeout)
294
576
        else:
295
 
            raise TypeError(u"No secret or secfile for client %s"
296
 
                            % self.name)
297
 
        self.host = config.get(u"host", u"")
298
 
        self.created = datetime.datetime.utcnow()
299
 
        self.enabled = False
300
 
        self.last_enabled = None
301
 
        self.last_checked_ok = None
302
 
        self.timeout = string_to_delta(config[u"timeout"])
303
 
        self.interval = string_to_delta(config[u"interval"])
304
 
        self.disable_hook = disable_hook
 
577
            self.last_enabled = None
 
578
            self.expires = None
 
579
        
 
580
        logger.debug("Creating client %r", self.name)
 
581
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
582
        self.created = settings.get("created",
 
583
                                    datetime.datetime.utcnow())
 
584
        
 
585
        # attributes specific for this server instance
305
586
        self.checker = None
306
587
        self.checker_initiator_tag = None
307
588
        self.disable_initiator_tag = None
308
589
        self.checker_callback_tag = None
309
 
        self.checker_command = config[u"checker"]
310
590
        self.current_checker_command = None
311
 
        self.last_connect = None
 
591
        self.approved = None
 
592
        self.approvals_pending = 0
 
593
        self.changedstate = multiprocessing_manager.Condition(
 
594
            multiprocessing_manager.Lock())
 
595
        self.client_structure = [attr
 
596
                                 for attr in self.__dict__.iterkeys()
 
597
                                 if not attr.startswith("_")]
 
598
        self.client_structure.append("client_structure")
 
599
        
 
600
        for name, t in inspect.getmembers(
 
601
                type(self), lambda obj: isinstance(obj, property)):
 
602
            if not name.startswith("_"):
 
603
                self.client_structure.append(name)
 
604
    
 
605
    # Send notice to process children that client state has changed
 
606
    def send_changedstate(self):
 
607
        with self.changedstate:
 
608
            self.changedstate.notify_all()
312
609
    
313
610
    def enable(self):
314
611
        """Start this client's checker and timeout hooks"""
315
 
        if getattr(self, u"enabled", False):
 
612
        if getattr(self, "enabled", False):
316
613
            # Already enabled
317
614
            return
 
615
        self.expires = datetime.datetime.utcnow() + self.timeout
 
616
        self.enabled = True
318
617
        self.last_enabled = datetime.datetime.utcnow()
319
 
        # Schedule a new checker to be started an 'interval' from now,
320
 
        # and every interval from then on.
321
 
        self.checker_initiator_tag = (gobject.timeout_add
322
 
                                      (self.interval_milliseconds(),
323
 
                                       self.start_checker))
324
 
        # Also start a new checker *right now*.
325
 
        self.start_checker()
326
 
        # Schedule a disable() when 'timeout' has passed
327
 
        self.disable_initiator_tag = (gobject.timeout_add
328
 
                                   (self.timeout_milliseconds(),
329
 
                                    self.disable))
330
 
        self.enabled = True
 
618
        self.init_checker()
 
619
        self.send_changedstate()
331
620
    
332
 
    def disable(self):
 
621
    def disable(self, quiet=True):
333
622
        """Disable this client."""
334
623
        if not getattr(self, "enabled", False):
335
624
            return False
336
 
        logger.info(u"Disabling client %s", self.name)
337
 
        if getattr(self, u"disable_initiator_tag", False):
 
625
        if not quiet:
 
626
            logger.info("Disabling client %s", self.name)
 
627
        if getattr(self, "disable_initiator_tag", None) is not None:
338
628
            gobject.source_remove(self.disable_initiator_tag)
339
629
            self.disable_initiator_tag = None
340
 
        if getattr(self, u"checker_initiator_tag", False):
 
630
        self.expires = None
 
631
        if getattr(self, "checker_initiator_tag", None) is not None:
341
632
            gobject.source_remove(self.checker_initiator_tag)
342
633
            self.checker_initiator_tag = None
343
634
        self.stop_checker()
344
 
        if self.disable_hook:
345
 
            self.disable_hook(self)
346
635
        self.enabled = False
 
636
        if not quiet:
 
637
            self.send_changedstate()
347
638
        # Do not run this again if called by a gobject.timeout_add
348
639
        return False
349
640
    
350
641
    def __del__(self):
351
 
        self.disable_hook = None
352
642
        self.disable()
353
643
    
354
 
    def checker_callback(self, pid, condition, command):
 
644
    def init_checker(self):
 
645
        # Schedule a new checker to be started an 'interval' from now,
 
646
        # and every interval from then on.
 
647
        if self.checker_initiator_tag is not None:
 
648
            gobject.source_remove(self.checker_initiator_tag)
 
649
        self.checker_initiator_tag = gobject.timeout_add(
 
650
            int(self.interval.total_seconds() * 1000),
 
651
            self.start_checker)
 
652
        # Schedule a disable() when 'timeout' has passed
 
653
        if self.disable_initiator_tag is not None:
 
654
            gobject.source_remove(self.disable_initiator_tag)
 
655
        self.disable_initiator_tag = gobject.timeout_add(
 
656
            int(self.timeout.total_seconds() * 1000), self.disable)
 
657
        # Also start a new checker *right now*.
 
658
        self.start_checker()
 
659
    
 
660
    def checker_callback(self, source, condition, connection,
 
661
                         command):
355
662
        """The checker has completed, so take appropriate actions."""
356
663
        self.checker_callback_tag = None
357
664
        self.checker = None
358
 
        if os.WIFEXITED(condition):
359
 
            exitstatus = os.WEXITSTATUS(condition)
360
 
            if exitstatus == 0:
361
 
                logger.info(u"Checker for %(name)s succeeded",
 
665
        # Read return code from connection (see call_pipe)
 
666
        returncode = connection.recv()
 
667
        connection.close()
 
668
        
 
669
        if returncode >= 0:
 
670
            self.last_checker_status = returncode
 
671
            self.last_checker_signal = None
 
672
            if self.last_checker_status == 0:
 
673
                logger.info("Checker for %(name)s succeeded",
362
674
                            vars(self))
363
675
                self.checked_ok()
364
676
            else:
365
 
                logger.info(u"Checker for %(name)s failed",
366
 
                            vars(self))
 
677
                logger.info("Checker for %(name)s failed", vars(self))
367
678
        else:
368
 
            logger.warning(u"Checker for %(name)s crashed?",
 
679
            self.last_checker_status = -1
 
680
            self.last_checker_signal = -returncode
 
681
            logger.warning("Checker for %(name)s crashed?",
369
682
                           vars(self))
 
683
        return False
370
684
    
371
685
    def checked_ok(self):
372
 
        """Bump up the timeout for this client.
373
 
        
374
 
        This should only be called when the client has been seen,
375
 
        alive and well.
376
 
        """
 
686
        """Assert that the client has been seen, alive and well."""
377
687
        self.last_checked_ok = datetime.datetime.utcnow()
378
 
        gobject.source_remove(self.disable_initiator_tag)
379
 
        self.disable_initiator_tag = (gobject.timeout_add
380
 
                                      (self.timeout_milliseconds(),
381
 
                                       self.disable))
 
688
        self.last_checker_status = 0
 
689
        self.last_checker_signal = None
 
690
        self.bump_timeout()
 
691
    
 
692
    def bump_timeout(self, timeout=None):
 
693
        """Bump up the timeout for this client."""
 
694
        if timeout is None:
 
695
            timeout = self.timeout
 
696
        if self.disable_initiator_tag is not None:
 
697
            gobject.source_remove(self.disable_initiator_tag)
 
698
            self.disable_initiator_tag = None
 
699
        if getattr(self, "enabled", False):
 
700
            self.disable_initiator_tag = gobject.timeout_add(
 
701
                int(timeout.total_seconds() * 1000), self.disable)
 
702
            self.expires = datetime.datetime.utcnow() + timeout
 
703
    
 
704
    def need_approval(self):
 
705
        self.last_approval_request = datetime.datetime.utcnow()
382
706
    
383
707
    def start_checker(self):
384
708
        """Start a new checker subprocess if one is not running.
386
710
        If a checker already exists, leave it running and do
387
711
        nothing."""
388
712
        # The reason for not killing a running checker is that if we
389
 
        # did that, then if a checker (for some reason) started
390
 
        # running slowly and taking more than 'interval' time, the
391
 
        # client would inevitably timeout, since no checker would get
392
 
        # a chance to run to completion.  If we instead leave running
 
713
        # did that, and if a checker (for some reason) started running
 
714
        # slowly and taking more than 'interval' time, then the client
 
715
        # would inevitably timeout, since no checker would get a
 
716
        # chance to run to completion.  If we instead leave running
393
717
        # checkers alone, the checker would have to take more time
394
 
        # than 'timeout' for the client to be declared invalid, which
395
 
        # is as it should be.
 
718
        # than 'timeout' for the client to be disabled, which is as it
 
719
        # should be.
396
720
        
397
 
        # If a checker exists, make sure it is not a zombie
398
 
        if self.checker is not None:
399
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
400
 
            if pid:
401
 
                logger.warning(u"Checker was a zombie")
402
 
                gobject.source_remove(self.checker_callback_tag)
403
 
                self.checker_callback(pid, status,
404
 
                                      self.current_checker_command)
 
721
        if self.checker is not None and not self.checker.is_alive():
 
722
            logger.warning("Checker was not alive; joining")
 
723
            self.checker.join()
 
724
            self.checker = None
405
725
        # Start a new checker if needed
406
726
        if self.checker is None:
 
727
            # Escape attributes for the shell
 
728
            escaped_attrs = {
 
729
                attr: re.escape(str(getattr(self, attr)))
 
730
                for attr in self.runtime_expansions }
407
731
            try:
408
 
                # In case checker_command has exactly one % operator
409
 
                command = self.checker_command % self.host
410
 
            except TypeError:
411
 
                # Escape attributes for the shell
412
 
                escaped_attrs = dict((key,
413
 
                                      re.escape(unicode(str(val),
414
 
                                                        errors=
415
 
                                                        u'replace')))
416
 
                                     for key, val in
417
 
                                     vars(self).iteritems())
418
 
                try:
419
 
                    command = self.checker_command % escaped_attrs
420
 
                except TypeError, error:
421
 
                    logger.error(u'Could not format string "%s":'
422
 
                                 u' %s', self.checker_command, error)
423
 
                    return True # Try again later
 
732
                command = self.checker_command % escaped_attrs
 
733
            except TypeError as error:
 
734
                logger.error('Could not format string "%s"',
 
735
                             self.checker_command,
 
736
                             exc_info=error)
 
737
                return True     # Try again later
424
738
            self.current_checker_command = command
425
 
            try:
426
 
                logger.info(u"Starting checker %r for %s",
427
 
                            command, self.name)
428
 
                # We don't need to redirect stdout and stderr, since
429
 
                # in normal mode, that is already done by daemon(),
430
 
                # and in debug mode we don't want to.  (Stdin is
431
 
                # always replaced by /dev/null.)
432
 
                self.checker = subprocess.Popen(command,
433
 
                                                close_fds=True,
434
 
                                                shell=True, cwd=u"/")
435
 
                self.checker_callback_tag = (gobject.child_watch_add
436
 
                                             (self.checker.pid,
437
 
                                              self.checker_callback,
438
 
                                              data=command))
439
 
                # The checker may have completed before the gobject
440
 
                # watch was added.  Check for this.
441
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
442
 
                if pid:
443
 
                    gobject.source_remove(self.checker_callback_tag)
444
 
                    self.checker_callback(pid, status, command)
445
 
            except OSError, error:
446
 
                logger.error(u"Failed to start subprocess: %s",
447
 
                             error)
 
739
            logger.info("Starting checker %r for %s", command,
 
740
                        self.name)
 
741
            # We don't need to redirect stdout and stderr, since
 
742
            # in normal mode, that is already done by daemon(),
 
743
            # and in debug mode we don't want to.  (Stdin is
 
744
            # always replaced by /dev/null.)
 
745
            # The exception is when not debugging but nevertheless
 
746
            # running in the foreground; use the previously
 
747
            # created wnull.
 
748
            popen_args = { "close_fds": True,
 
749
                           "shell": True,
 
750
                           "cwd": "/" }
 
751
            if (not self.server_settings["debug"]
 
752
                and self.server_settings["foreground"]):
 
753
                popen_args.update({"stdout": wnull,
 
754
                                   "stderr": wnull })
 
755
            pipe = multiprocessing.Pipe(duplex = False)
 
756
            self.checker = multiprocessing.Process(
 
757
                target = call_pipe,
 
758
                args = (pipe[1], subprocess.call, command),
 
759
                kwargs = popen_args)
 
760
            self.checker.start()
 
761
            self.checker_callback_tag = gobject.io_add_watch(
 
762
                pipe[0].fileno(), gobject.IO_IN,
 
763
                self.checker_callback, pipe[0], command)
448
764
        # Re-run this periodically if run by gobject.timeout_add
449
765
        return True
450
766
    
453
769
        if self.checker_callback_tag:
454
770
            gobject.source_remove(self.checker_callback_tag)
455
771
            self.checker_callback_tag = None
456
 
        if getattr(self, u"checker", None) is None:
 
772
        if getattr(self, "checker", None) is None:
457
773
            return
458
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
459
 
        try:
460
 
            os.kill(self.checker.pid, signal.SIGTERM)
461
 
            #os.sleep(0.5)
462
 
            #if self.checker.poll() is None:
463
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
464
 
        except OSError, error:
465
 
            if error.errno != errno.ESRCH: # No such process
466
 
                raise
 
774
        logger.debug("Stopping checker for %(name)s", vars(self))
 
775
        self.checker.terminate()
467
776
        self.checker = None
468
 
    
469
 
    def still_valid(self):
470
 
        """Has the timeout not yet passed for this client?"""
471
 
        if not getattr(self, u"enabled", False):
472
 
            return False
473
 
        now = datetime.datetime.utcnow()
474
 
        if self.last_checked_ok is None:
475
 
            return now < (self.created + self.timeout)
476
 
        else:
477
 
            return now < (self.last_checked_ok + self.timeout)
478
 
 
479
 
 
480
 
class ClientDBus(Client, dbus.service.Object):
 
777
 
 
778
 
 
779
def dbus_service_property(dbus_interface,
 
780
                          signature="v",
 
781
                          access="readwrite",
 
782
                          byte_arrays=False):
 
783
    """Decorators for marking methods of a DBusObjectWithProperties to
 
784
    become properties on the D-Bus.
 
785
    
 
786
    The decorated method will be called with no arguments by "Get"
 
787
    and with one argument by "Set".
 
788
    
 
789
    The parameters, where they are supported, are the same as
 
790
    dbus.service.method, except there is only "signature", since the
 
791
    type from Get() and the type sent to Set() is the same.
 
792
    """
 
793
    # Encoding deeply encoded byte arrays is not supported yet by the
 
794
    # "Set" method, so we fail early here:
 
795
    if byte_arrays and signature != "ay":
 
796
        raise ValueError("Byte arrays not supported for non-'ay'"
 
797
                         " signature {!r}".format(signature))
 
798
    
 
799
    def decorator(func):
 
800
        func._dbus_is_property = True
 
801
        func._dbus_interface = dbus_interface
 
802
        func._dbus_signature = signature
 
803
        func._dbus_access = access
 
804
        func._dbus_name = func.__name__
 
805
        if func._dbus_name.endswith("_dbus_property"):
 
806
            func._dbus_name = func._dbus_name[:-14]
 
807
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
808
        return func
 
809
    
 
810
    return decorator
 
811
 
 
812
 
 
813
def dbus_interface_annotations(dbus_interface):
 
814
    """Decorator for marking functions returning interface annotations
 
815
    
 
816
    Usage:
 
817
    
 
818
    @dbus_interface_annotations("org.example.Interface")
 
819
    def _foo(self):  # Function name does not matter
 
820
        return {"org.freedesktop.DBus.Deprecated": "true",
 
821
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
822
                    "false"}
 
823
    """
 
824
    
 
825
    def decorator(func):
 
826
        func._dbus_is_interface = True
 
827
        func._dbus_interface = dbus_interface
 
828
        func._dbus_name = dbus_interface
 
829
        return func
 
830
    
 
831
    return decorator
 
832
 
 
833
 
 
834
def dbus_annotations(annotations):
 
835
    """Decorator to annotate D-Bus methods, signals or properties
 
836
    Usage:
 
837
    
 
838
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
 
839
                       "org.freedesktop.DBus.Property."
 
840
                       "EmitsChangedSignal": "false"})
 
841
    @dbus_service_property("org.example.Interface", signature="b",
 
842
                           access="r")
 
843
    def Property_dbus_property(self):
 
844
        return dbus.Boolean(False)
 
845
    
 
846
    See also the DBusObjectWithAnnotations class.
 
847
    """
 
848
    
 
849
    def decorator(func):
 
850
        func._dbus_annotations = annotations
 
851
        return func
 
852
    
 
853
    return decorator
 
854
 
 
855
 
 
856
class DBusPropertyException(dbus.exceptions.DBusException):
 
857
    """A base class for D-Bus property-related exceptions
 
858
    """
 
859
    pass
 
860
 
 
861
 
 
862
class DBusPropertyAccessException(DBusPropertyException):
 
863
    """A property's access permissions disallows an operation.
 
864
    """
 
865
    pass
 
866
 
 
867
 
 
868
class DBusPropertyNotFound(DBusPropertyException):
 
869
    """An attempt was made to access a non-existing property.
 
870
    """
 
871
    pass
 
872
 
 
873
 
 
874
class DBusObjectWithAnnotations(dbus.service.Object):
 
875
    """A D-Bus object with annotations.
 
876
    
 
877
    Classes inheriting from this can use the dbus_annotations
 
878
    decorator to add annotations to methods or signals.
 
879
    """
 
880
    
 
881
    @staticmethod
 
882
    def _is_dbus_thing(thing):
 
883
        """Returns a function testing if an attribute is a D-Bus thing
 
884
        
 
885
        If called like _is_dbus_thing("method") it returns a function
 
886
        suitable for use as predicate to inspect.getmembers().
 
887
        """
 
888
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
 
889
                                   False)
 
890
    
 
891
    def _get_all_dbus_things(self, thing):
 
892
        """Returns a generator of (name, attribute) pairs
 
893
        """
 
894
        return ((getattr(athing.__get__(self), "_dbus_name", name),
 
895
                 athing.__get__(self))
 
896
                for cls in self.__class__.__mro__
 
897
                for name, athing in
 
898
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
899
    
 
900
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
901
                         out_signature = "s",
 
902
                         path_keyword = 'object_path',
 
903
                         connection_keyword = 'connection')
 
904
    def Introspect(self, object_path, connection):
 
905
        """Overloading of standard D-Bus method.
 
906
        
 
907
        Inserts annotation tags on methods and signals.
 
908
        """
 
909
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
910
                                                   connection)
 
911
        try:
 
912
            document = xml.dom.minidom.parseString(xmlstring)
 
913
            
 
914
            for if_tag in document.getElementsByTagName("interface"):
 
915
                # Add annotation tags
 
916
                for typ in ("method", "signal"):
 
917
                    for tag in if_tag.getElementsByTagName(typ):
 
918
                        annots = dict()
 
919
                        for name, prop in (self.
 
920
                                           _get_all_dbus_things(typ)):
 
921
                            if (name == tag.getAttribute("name")
 
922
                                and prop._dbus_interface
 
923
                                == if_tag.getAttribute("name")):
 
924
                                annots.update(getattr(
 
925
                                    prop, "_dbus_annotations", {}))
 
926
                        for name, value in annots.items():
 
927
                            ann_tag = document.createElement(
 
928
                                "annotation")
 
929
                            ann_tag.setAttribute("name", name)
 
930
                            ann_tag.setAttribute("value", value)
 
931
                            tag.appendChild(ann_tag)
 
932
                # Add interface annotation tags
 
933
                for annotation, value in dict(
 
934
                    itertools.chain.from_iterable(
 
935
                        annotations().items()
 
936
                        for name, annotations
 
937
                        in self._get_all_dbus_things("interface")
 
938
                        if name == if_tag.getAttribute("name")
 
939
                        )).items():
 
940
                    ann_tag = document.createElement("annotation")
 
941
                    ann_tag.setAttribute("name", annotation)
 
942
                    ann_tag.setAttribute("value", value)
 
943
                    if_tag.appendChild(ann_tag)
 
944
                # Fix argument name for the Introspect method itself
 
945
                if (if_tag.getAttribute("name")
 
946
                                == dbus.INTROSPECTABLE_IFACE):
 
947
                    for cn in if_tag.getElementsByTagName("method"):
 
948
                        if cn.getAttribute("name") == "Introspect":
 
949
                            for arg in cn.getElementsByTagName("arg"):
 
950
                                if (arg.getAttribute("direction")
 
951
                                    == "out"):
 
952
                                    arg.setAttribute("name",
 
953
                                                     "xml_data")
 
954
            xmlstring = document.toxml("utf-8")
 
955
            document.unlink()
 
956
        except (AttributeError, xml.dom.DOMException,
 
957
                xml.parsers.expat.ExpatError) as error:
 
958
            logger.error("Failed to override Introspection method",
 
959
                         exc_info=error)
 
960
        return xmlstring
 
961
 
 
962
 
 
963
class DBusObjectWithProperties(DBusObjectWithAnnotations):
 
964
    """A D-Bus object with properties.
 
965
    
 
966
    Classes inheriting from this can use the dbus_service_property
 
967
    decorator to expose methods as D-Bus properties.  It exposes the
 
968
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
969
    """
 
970
    
 
971
    def _get_dbus_property(self, interface_name, property_name):
 
972
        """Returns a bound method if one exists which is a D-Bus
 
973
        property with the specified name and interface.
 
974
        """
 
975
        for cls in self.__class__.__mro__:
 
976
            for name, value in inspect.getmembers(
 
977
                    cls, self._is_dbus_thing("property")):
 
978
                if (value._dbus_name == property_name
 
979
                    and value._dbus_interface == interface_name):
 
980
                    return value.__get__(self)
 
981
        
 
982
        # No such property
 
983
        raise DBusPropertyNotFound("{}:{}.{}".format(
 
984
            self.dbus_object_path, interface_name, property_name))
 
985
    
 
986
    @classmethod
 
987
    def _get_all_interface_names(cls):
 
988
        """Get a sequence of all interfaces supported by an object"""
 
989
        return (name for name in set(getattr(getattr(x, attr),
 
990
                                             "_dbus_interface", None)
 
991
                                     for x in (inspect.getmro(cls))
 
992
                                     for attr in dir(x))
 
993
                if name is not None)
 
994
    
 
995
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
996
                         in_signature="ss",
 
997
                         out_signature="v")
 
998
    def Get(self, interface_name, property_name):
 
999
        """Standard D-Bus property Get() method, see D-Bus standard.
 
1000
        """
 
1001
        prop = self._get_dbus_property(interface_name, property_name)
 
1002
        if prop._dbus_access == "write":
 
1003
            raise DBusPropertyAccessException(property_name)
 
1004
        value = prop()
 
1005
        if not hasattr(value, "variant_level"):
 
1006
            return value
 
1007
        return type(value)(value, variant_level=value.variant_level+1)
 
1008
    
 
1009
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
 
1010
    def Set(self, interface_name, property_name, value):
 
1011
        """Standard D-Bus property Set() method, see D-Bus standard.
 
1012
        """
 
1013
        prop = self._get_dbus_property(interface_name, property_name)
 
1014
        if prop._dbus_access == "read":
 
1015
            raise DBusPropertyAccessException(property_name)
 
1016
        if prop._dbus_get_args_options["byte_arrays"]:
 
1017
            # The byte_arrays option is not supported yet on
 
1018
            # signatures other than "ay".
 
1019
            if prop._dbus_signature != "ay":
 
1020
                raise ValueError("Byte arrays not supported for non-"
 
1021
                                 "'ay' signature {!r}"
 
1022
                                 .format(prop._dbus_signature))
 
1023
            value = dbus.ByteArray(b''.join(chr(byte)
 
1024
                                            for byte in value))
 
1025
        prop(value)
 
1026
    
 
1027
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1028
                         in_signature="s",
 
1029
                         out_signature="a{sv}")
 
1030
    def GetAll(self, interface_name):
 
1031
        """Standard D-Bus property GetAll() method, see D-Bus
 
1032
        standard.
 
1033
        
 
1034
        Note: Will not include properties with access="write".
 
1035
        """
 
1036
        properties = {}
 
1037
        for name, prop in self._get_all_dbus_things("property"):
 
1038
            if (interface_name
 
1039
                and interface_name != prop._dbus_interface):
 
1040
                # Interface non-empty but did not match
 
1041
                continue
 
1042
            # Ignore write-only properties
 
1043
            if prop._dbus_access == "write":
 
1044
                continue
 
1045
            value = prop()
 
1046
            if not hasattr(value, "variant_level"):
 
1047
                properties[name] = value
 
1048
                continue
 
1049
            properties[name] = type(value)(
 
1050
                value, variant_level = value.variant_level + 1)
 
1051
        return dbus.Dictionary(properties, signature="sv")
 
1052
    
 
1053
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
 
1054
    def PropertiesChanged(self, interface_name, changed_properties,
 
1055
                          invalidated_properties):
 
1056
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
 
1057
        standard.
 
1058
        """
 
1059
        pass
 
1060
    
 
1061
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1062
                         out_signature="s",
 
1063
                         path_keyword='object_path',
 
1064
                         connection_keyword='connection')
 
1065
    def Introspect(self, object_path, connection):
 
1066
        """Overloading of standard D-Bus method.
 
1067
        
 
1068
        Inserts property tags and interface annotation tags.
 
1069
        """
 
1070
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1071
                                                         object_path,
 
1072
                                                         connection)
 
1073
        try:
 
1074
            document = xml.dom.minidom.parseString(xmlstring)
 
1075
            
 
1076
            def make_tag(document, name, prop):
 
1077
                e = document.createElement("property")
 
1078
                e.setAttribute("name", name)
 
1079
                e.setAttribute("type", prop._dbus_signature)
 
1080
                e.setAttribute("access", prop._dbus_access)
 
1081
                return e
 
1082
            
 
1083
            for if_tag in document.getElementsByTagName("interface"):
 
1084
                # Add property tags
 
1085
                for tag in (make_tag(document, name, prop)
 
1086
                            for name, prop
 
1087
                            in self._get_all_dbus_things("property")
 
1088
                            if prop._dbus_interface
 
1089
                            == if_tag.getAttribute("name")):
 
1090
                    if_tag.appendChild(tag)
 
1091
                # Add annotation tags for properties
 
1092
                for tag in if_tag.getElementsByTagName("property"):
 
1093
                    annots = dict()
 
1094
                    for name, prop in self._get_all_dbus_things(
 
1095
                            "property"):
 
1096
                        if (name == tag.getAttribute("name")
 
1097
                            and prop._dbus_interface
 
1098
                            == if_tag.getAttribute("name")):
 
1099
                            annots.update(getattr(
 
1100
                                prop, "_dbus_annotations", {}))
 
1101
                    for name, value in annots.items():
 
1102
                        ann_tag = document.createElement(
 
1103
                            "annotation")
 
1104
                        ann_tag.setAttribute("name", name)
 
1105
                        ann_tag.setAttribute("value", value)
 
1106
                        tag.appendChild(ann_tag)
 
1107
                # Add the names to the return values for the
 
1108
                # "org.freedesktop.DBus.Properties" methods
 
1109
                if (if_tag.getAttribute("name")
 
1110
                    == "org.freedesktop.DBus.Properties"):
 
1111
                    for cn in if_tag.getElementsByTagName("method"):
 
1112
                        if cn.getAttribute("name") == "Get":
 
1113
                            for arg in cn.getElementsByTagName("arg"):
 
1114
                                if (arg.getAttribute("direction")
 
1115
                                    == "out"):
 
1116
                                    arg.setAttribute("name", "value")
 
1117
                        elif cn.getAttribute("name") == "GetAll":
 
1118
                            for arg in cn.getElementsByTagName("arg"):
 
1119
                                if (arg.getAttribute("direction")
 
1120
                                    == "out"):
 
1121
                                    arg.setAttribute("name", "props")
 
1122
            xmlstring = document.toxml("utf-8")
 
1123
            document.unlink()
 
1124
        except (AttributeError, xml.dom.DOMException,
 
1125
                xml.parsers.expat.ExpatError) as error:
 
1126
            logger.error("Failed to override Introspection method",
 
1127
                         exc_info=error)
 
1128
        return xmlstring
 
1129
 
 
1130
try:
 
1131
    dbus.OBJECT_MANAGER_IFACE
 
1132
except AttributeError:
 
1133
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
 
1134
 
 
1135
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
 
1136
    """A D-Bus object with an ObjectManager.
 
1137
    
 
1138
    Classes inheriting from this exposes the standard
 
1139
    GetManagedObjects call and the InterfacesAdded and
 
1140
    InterfacesRemoved signals on the standard
 
1141
    "org.freedesktop.DBus.ObjectManager" interface.
 
1142
    
 
1143
    Note: No signals are sent automatically; they must be sent
 
1144
    manually.
 
1145
    """
 
1146
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
1147
                         out_signature = "a{oa{sa{sv}}}")
 
1148
    def GetManagedObjects(self):
 
1149
        """This function must be overridden"""
 
1150
        raise NotImplementedError()
 
1151
    
 
1152
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
 
1153
                         signature = "oa{sa{sv}}")
 
1154
    def InterfacesAdded(self, object_path, interfaces_and_properties):
 
1155
        pass
 
1156
    
 
1157
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
 
1158
    def InterfacesRemoved(self, object_path, interfaces):
 
1159
        pass
 
1160
    
 
1161
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1162
                         out_signature = "s",
 
1163
                         path_keyword = 'object_path',
 
1164
                         connection_keyword = 'connection')
 
1165
    def Introspect(self, object_path, connection):
 
1166
        """Overloading of standard D-Bus method.
 
1167
        
 
1168
        Override return argument name of GetManagedObjects to be
 
1169
        "objpath_interfaces_and_properties"
 
1170
        """
 
1171
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1172
                                                         object_path,
 
1173
                                                         connection)
 
1174
        try:
 
1175
            document = xml.dom.minidom.parseString(xmlstring)
 
1176
            
 
1177
            for if_tag in document.getElementsByTagName("interface"):
 
1178
                # Fix argument name for the GetManagedObjects method
 
1179
                if (if_tag.getAttribute("name")
 
1180
                                == dbus.OBJECT_MANAGER_IFACE):
 
1181
                    for cn in if_tag.getElementsByTagName("method"):
 
1182
                        if (cn.getAttribute("name")
 
1183
                            == "GetManagedObjects"):
 
1184
                            for arg in cn.getElementsByTagName("arg"):
 
1185
                                if (arg.getAttribute("direction")
 
1186
                                    == "out"):
 
1187
                                    arg.setAttribute(
 
1188
                                        "name",
 
1189
                                        "objpath_interfaces"
 
1190
                                        "_and_properties")
 
1191
            xmlstring = document.toxml("utf-8")
 
1192
            document.unlink()
 
1193
        except (AttributeError, xml.dom.DOMException,
 
1194
                xml.parsers.expat.ExpatError) as error:
 
1195
            logger.error("Failed to override Introspection method",
 
1196
                         exc_info = error)
 
1197
        return xmlstring
 
1198
 
 
1199
def datetime_to_dbus(dt, variant_level=0):
 
1200
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
1201
    if dt is None:
 
1202
        return dbus.String("", variant_level = variant_level)
 
1203
    return dbus.String(dt.isoformat(), variant_level=variant_level)
 
1204
 
 
1205
 
 
1206
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1207
    """A class decorator; applied to a subclass of
 
1208
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1209
    interface names according to the "alt_interface_names" mapping.
 
1210
    Usage:
 
1211
    
 
1212
    @alternate_dbus_interfaces({"org.example.Interface":
 
1213
                                    "net.example.AlternateInterface"})
 
1214
    class SampleDBusObject(dbus.service.Object):
 
1215
        @dbus.service.method("org.example.Interface")
 
1216
        def SampleDBusMethod():
 
1217
            pass
 
1218
    
 
1219
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1220
    reachable via two interfaces: "org.example.Interface" and
 
1221
    "net.example.AlternateInterface", the latter of which will have
 
1222
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1223
    "true", unless "deprecate" is passed with a False value.
 
1224
    
 
1225
    This works for methods and signals, and also for D-Bus properties
 
1226
    (from DBusObjectWithProperties) and interfaces (from the
 
1227
    dbus_interface_annotations decorator).
 
1228
    """
 
1229
    
 
1230
    def wrapper(cls):
 
1231
        for orig_interface_name, alt_interface_name in (
 
1232
                alt_interface_names.items()):
 
1233
            attr = {}
 
1234
            interface_names = set()
 
1235
            # Go though all attributes of the class
 
1236
            for attrname, attribute in inspect.getmembers(cls):
 
1237
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
1238
                # with the wrong interface name
 
1239
                if (not hasattr(attribute, "_dbus_interface")
 
1240
                    or not attribute._dbus_interface.startswith(
 
1241
                        orig_interface_name)):
 
1242
                    continue
 
1243
                # Create an alternate D-Bus interface name based on
 
1244
                # the current name
 
1245
                alt_interface = attribute._dbus_interface.replace(
 
1246
                    orig_interface_name, alt_interface_name)
 
1247
                interface_names.add(alt_interface)
 
1248
                # Is this a D-Bus signal?
 
1249
                if getattr(attribute, "_dbus_is_signal", False):
 
1250
                    if sys.version_info.major == 2:
 
1251
                        # Extract the original non-method undecorated
 
1252
                        # function by black magic
 
1253
                        nonmethod_func = (dict(
 
1254
                            zip(attribute.func_code.co_freevars,
 
1255
                                attribute.__closure__))
 
1256
                                          ["func"].cell_contents)
 
1257
                    else:
 
1258
                        nonmethod_func = attribute
 
1259
                    # Create a new, but exactly alike, function
 
1260
                    # object, and decorate it to be a new D-Bus signal
 
1261
                    # with the alternate D-Bus interface name
 
1262
                    if sys.version_info.major == 2:
 
1263
                        new_function = types.FunctionType(
 
1264
                            nonmethod_func.func_code,
 
1265
                            nonmethod_func.func_globals,
 
1266
                            nonmethod_func.func_name,
 
1267
                            nonmethod_func.func_defaults,
 
1268
                            nonmethod_func.func_closure)
 
1269
                    else:
 
1270
                        new_function = types.FunctionType(
 
1271
                            nonmethod_func.__code__,
 
1272
                            nonmethod_func.__globals__,
 
1273
                            nonmethod_func.__name__,
 
1274
                            nonmethod_func.__defaults__,
 
1275
                            nonmethod_func.__closure__)
 
1276
                    new_function = (dbus.service.signal(
 
1277
                        alt_interface,
 
1278
                        attribute._dbus_signature)(new_function))
 
1279
                    # Copy annotations, if any
 
1280
                    try:
 
1281
                        new_function._dbus_annotations = dict(
 
1282
                            attribute._dbus_annotations)
 
1283
                    except AttributeError:
 
1284
                        pass
 
1285
                    # Define a creator of a function to call both the
 
1286
                    # original and alternate functions, so both the
 
1287
                    # original and alternate signals gets sent when
 
1288
                    # the function is called
 
1289
                    def fixscope(func1, func2):
 
1290
                        """This function is a scope container to pass
 
1291
                        func1 and func2 to the "call_both" function
 
1292
                        outside of its arguments"""
 
1293
                        
 
1294
                        @functools.wraps(func2)
 
1295
                        def call_both(*args, **kwargs):
 
1296
                            """This function will emit two D-Bus
 
1297
                            signals by calling func1 and func2"""
 
1298
                            func1(*args, **kwargs)
 
1299
                            func2(*args, **kwargs)
 
1300
                        # Make wrapper function look like a D-Bus signal
 
1301
                        for name, attr in inspect.getmembers(func2):
 
1302
                            if name.startswith("_dbus_"):
 
1303
                                setattr(call_both, name, attr)
 
1304
                        
 
1305
                        return call_both
 
1306
                    # Create the "call_both" function and add it to
 
1307
                    # the class
 
1308
                    attr[attrname] = fixscope(attribute, new_function)
 
1309
                # Is this a D-Bus method?
 
1310
                elif getattr(attribute, "_dbus_is_method", False):
 
1311
                    # Create a new, but exactly alike, function
 
1312
                    # object.  Decorate it to be a new D-Bus method
 
1313
                    # with the alternate D-Bus interface name.  Add it
 
1314
                    # to the class.
 
1315
                    attr[attrname] = (
 
1316
                        dbus.service.method(
 
1317
                            alt_interface,
 
1318
                            attribute._dbus_in_signature,
 
1319
                            attribute._dbus_out_signature)
 
1320
                        (types.FunctionType(attribute.func_code,
 
1321
                                            attribute.func_globals,
 
1322
                                            attribute.func_name,
 
1323
                                            attribute.func_defaults,
 
1324
                                            attribute.func_closure)))
 
1325
                    # Copy annotations, if any
 
1326
                    try:
 
1327
                        attr[attrname]._dbus_annotations = dict(
 
1328
                            attribute._dbus_annotations)
 
1329
                    except AttributeError:
 
1330
                        pass
 
1331
                # Is this a D-Bus property?
 
1332
                elif getattr(attribute, "_dbus_is_property", False):
 
1333
                    # Create a new, but exactly alike, function
 
1334
                    # object, and decorate it to be a new D-Bus
 
1335
                    # property with the alternate D-Bus interface
 
1336
                    # name.  Add it to the class.
 
1337
                    attr[attrname] = (dbus_service_property(
 
1338
                        alt_interface, attribute._dbus_signature,
 
1339
                        attribute._dbus_access,
 
1340
                        attribute._dbus_get_args_options
 
1341
                        ["byte_arrays"])
 
1342
                                      (types.FunctionType(
 
1343
                                          attribute.func_code,
 
1344
                                          attribute.func_globals,
 
1345
                                          attribute.func_name,
 
1346
                                          attribute.func_defaults,
 
1347
                                          attribute.func_closure)))
 
1348
                    # Copy annotations, if any
 
1349
                    try:
 
1350
                        attr[attrname]._dbus_annotations = dict(
 
1351
                            attribute._dbus_annotations)
 
1352
                    except AttributeError:
 
1353
                        pass
 
1354
                # Is this a D-Bus interface?
 
1355
                elif getattr(attribute, "_dbus_is_interface", False):
 
1356
                    # Create a new, but exactly alike, function
 
1357
                    # object.  Decorate it to be a new D-Bus interface
 
1358
                    # with the alternate D-Bus interface name.  Add it
 
1359
                    # to the class.
 
1360
                    attr[attrname] = (
 
1361
                        dbus_interface_annotations(alt_interface)
 
1362
                        (types.FunctionType(attribute.func_code,
 
1363
                                            attribute.func_globals,
 
1364
                                            attribute.func_name,
 
1365
                                            attribute.func_defaults,
 
1366
                                            attribute.func_closure)))
 
1367
            if deprecate:
 
1368
                # Deprecate all alternate interfaces
 
1369
                iname="_AlternateDBusNames_interface_annotation{}"
 
1370
                for interface_name in interface_names:
 
1371
                    
 
1372
                    @dbus_interface_annotations(interface_name)
 
1373
                    def func(self):
 
1374
                        return { "org.freedesktop.DBus.Deprecated":
 
1375
                                 "true" }
 
1376
                    # Find an unused name
 
1377
                    for aname in (iname.format(i)
 
1378
                                  for i in itertools.count()):
 
1379
                        if aname not in attr:
 
1380
                            attr[aname] = func
 
1381
                            break
 
1382
            if interface_names:
 
1383
                # Replace the class with a new subclass of it with
 
1384
                # methods, signals, etc. as created above.
 
1385
                cls = type(b"{}Alternate".format(cls.__name__),
 
1386
                           (cls, ), attr)
 
1387
        return cls
 
1388
    
 
1389
    return wrapper
 
1390
 
 
1391
 
 
1392
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1393
                            "se.bsnet.fukt.Mandos"})
 
1394
class ClientDBus(Client, DBusObjectWithProperties):
481
1395
    """A Client class using D-Bus
482
1396
    
483
1397
    Attributes:
484
1398
    dbus_object_path: dbus.ObjectPath
485
1399
    bus: dbus.SystemBus()
486
1400
    """
 
1401
    
 
1402
    runtime_expansions = (Client.runtime_expansions
 
1403
                          + ("dbus_object_path", ))
 
1404
    
 
1405
    _interface = "se.recompile.Mandos.Client"
 
1406
    
487
1407
    # dbus.service.Object doesn't use super(), so we can't either.
488
1408
    
489
1409
    def __init__(self, bus = None, *args, **kwargs):
491
1411
        Client.__init__(self, *args, **kwargs)
492
1412
        # Only now, when this client is initialized, can it show up on
493
1413
        # the D-Bus
494
 
        self.dbus_object_path = (dbus.ObjectPath
495
 
                                 (u"/clients/"
496
 
                                  + self.name.replace(u".", u"_")))
497
 
        dbus.service.Object.__init__(self, self.bus,
498
 
                                     self.dbus_object_path)
499
 
    
500
 
    @staticmethod
501
 
    def _datetime_to_dbus(dt, variant_level=0):
502
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
503
 
        return dbus.String(dt.isoformat(),
504
 
                           variant_level=variant_level)
505
 
    
506
 
    def enable(self):
507
 
        oldstate = getattr(self, u"enabled", False)
508
 
        r = Client.enable(self)
509
 
        if oldstate != self.enabled:
510
 
            # Emit D-Bus signals
511
 
            self.PropertyChanged(dbus.String(u"enabled"),
512
 
                                 dbus.Boolean(True, variant_level=1))
513
 
            self.PropertyChanged(
514
 
                dbus.String(u"last_enabled"),
515
 
                self._datetime_to_dbus(self.last_enabled,
516
 
                                       variant_level=1))
517
 
        return r
518
 
    
519
 
    def disable(self, signal = True):
520
 
        oldstate = getattr(self, u"enabled", False)
521
 
        r = Client.disable(self)
522
 
        if signal and oldstate != self.enabled:
523
 
            # Emit D-Bus signal
524
 
            self.PropertyChanged(dbus.String(u"enabled"),
525
 
                                 dbus.Boolean(False, variant_level=1))
526
 
        return r
 
1414
        client_object_name = str(self.name).translate(
 
1415
            {ord("."): ord("_"),
 
1416
             ord("-"): ord("_")})
 
1417
        self.dbus_object_path = dbus.ObjectPath(
 
1418
            "/clients/" + client_object_name)
 
1419
        DBusObjectWithProperties.__init__(self, self.bus,
 
1420
                                          self.dbus_object_path)
 
1421
    
 
1422
    def notifychangeproperty(transform_func, dbus_name,
 
1423
                             type_func=lambda x: x,
 
1424
                             variant_level=1,
 
1425
                             invalidate_only=False,
 
1426
                             _interface=_interface):
 
1427
        """ Modify a variable so that it's a property which announces
 
1428
        its changes to DBus.
 
1429
        
 
1430
        transform_fun: Function that takes a value and a variant_level
 
1431
                       and transforms it to a D-Bus type.
 
1432
        dbus_name: D-Bus name of the variable
 
1433
        type_func: Function that transform the value before sending it
 
1434
                   to the D-Bus.  Default: no transform
 
1435
        variant_level: D-Bus variant level.  Default: 1
 
1436
        """
 
1437
        attrname = "_{}".format(dbus_name)
 
1438
        
 
1439
        def setter(self, value):
 
1440
            if hasattr(self, "dbus_object_path"):
 
1441
                if (not hasattr(self, attrname) or
 
1442
                    type_func(getattr(self, attrname, None))
 
1443
                    != type_func(value)):
 
1444
                    if invalidate_only:
 
1445
                        self.PropertiesChanged(
 
1446
                            _interface, dbus.Dictionary(),
 
1447
                            dbus.Array((dbus_name, )))
 
1448
                    else:
 
1449
                        dbus_value = transform_func(
 
1450
                            type_func(value),
 
1451
                            variant_level = variant_level)
 
1452
                        self.PropertyChanged(dbus.String(dbus_name),
 
1453
                                             dbus_value)
 
1454
                        self.PropertiesChanged(
 
1455
                            _interface,
 
1456
                            dbus.Dictionary({ dbus.String(dbus_name):
 
1457
                                              dbus_value }),
 
1458
                            dbus.Array())
 
1459
            setattr(self, attrname, value)
 
1460
        
 
1461
        return property(lambda self: getattr(self, attrname), setter)
 
1462
    
 
1463
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1464
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1465
                                             "ApprovalPending",
 
1466
                                             type_func = bool)
 
1467
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1468
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1469
                                        "LastEnabled")
 
1470
    checker = notifychangeproperty(
 
1471
        dbus.Boolean, "CheckerRunning",
 
1472
        type_func = lambda checker: checker is not None)
 
1473
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1474
                                           "LastCheckedOK")
 
1475
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1476
                                               "LastCheckerStatus")
 
1477
    last_approval_request = notifychangeproperty(
 
1478
        datetime_to_dbus, "LastApprovalRequest")
 
1479
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1480
                                               "ApprovedByDefault")
 
1481
    approval_delay = notifychangeproperty(
 
1482
        dbus.UInt64, "ApprovalDelay",
 
1483
        type_func = lambda td: td.total_seconds() * 1000)
 
1484
    approval_duration = notifychangeproperty(
 
1485
        dbus.UInt64, "ApprovalDuration",
 
1486
        type_func = lambda td: td.total_seconds() * 1000)
 
1487
    host = notifychangeproperty(dbus.String, "Host")
 
1488
    timeout = notifychangeproperty(
 
1489
        dbus.UInt64, "Timeout",
 
1490
        type_func = lambda td: td.total_seconds() * 1000)
 
1491
    extended_timeout = notifychangeproperty(
 
1492
        dbus.UInt64, "ExtendedTimeout",
 
1493
        type_func = lambda td: td.total_seconds() * 1000)
 
1494
    interval = notifychangeproperty(
 
1495
        dbus.UInt64, "Interval",
 
1496
        type_func = lambda td: td.total_seconds() * 1000)
 
1497
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1498
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
 
1499
                                  invalidate_only=True)
 
1500
    
 
1501
    del notifychangeproperty
527
1502
    
528
1503
    def __del__(self, *args, **kwargs):
529
1504
        try:
530
1505
            self.remove_from_connection()
531
1506
        except LookupError:
532
1507
            pass
533
 
        if hasattr(dbus.service.Object, u"__del__"):
534
 
            dbus.service.Object.__del__(self, *args, **kwargs)
 
1508
        if hasattr(DBusObjectWithProperties, "__del__"):
 
1509
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
535
1510
        Client.__del__(self, *args, **kwargs)
536
1511
    
537
 
    def checker_callback(self, pid, condition, command,
538
 
                         *args, **kwargs):
539
 
        self.checker_callback_tag = None
540
 
        self.checker = None
541
 
        # Emit D-Bus signal
542
 
        self.PropertyChanged(dbus.String(u"checker_running"),
543
 
                             dbus.Boolean(False, variant_level=1))
544
 
        if os.WIFEXITED(condition):
545
 
            exitstatus = os.WEXITSTATUS(condition)
 
1512
    def checker_callback(self, source, condition,
 
1513
                         connection, command, *args, **kwargs):
 
1514
        ret = Client.checker_callback(self, source, condition,
 
1515
                                      connection, command, *args,
 
1516
                                      **kwargs)
 
1517
        exitstatus = self.last_checker_status
 
1518
        if exitstatus >= 0:
546
1519
            # Emit D-Bus signal
547
1520
            self.CheckerCompleted(dbus.Int16(exitstatus),
548
 
                                  dbus.Int64(condition),
 
1521
                                  # This is specific to GNU libC
 
1522
                                  dbus.Int64(exitstatus << 8),
549
1523
                                  dbus.String(command))
550
1524
        else:
551
1525
            # Emit D-Bus signal
552
1526
            self.CheckerCompleted(dbus.Int16(-1),
553
 
                                  dbus.Int64(condition),
 
1527
                                  dbus.Int64(
 
1528
                                      # This is specific to GNU libC
 
1529
                                      (exitstatus << 8)
 
1530
                                      | self.last_checker_signal),
554
1531
                                  dbus.String(command))
555
 
        
556
 
        return Client.checker_callback(self, pid, condition, command,
557
 
                                       *args, **kwargs)
558
 
    
559
 
    def checked_ok(self, *args, **kwargs):
560
 
        r = Client.checked_ok(self, *args, **kwargs)
561
 
        # Emit D-Bus signal
562
 
        self.PropertyChanged(
563
 
            dbus.String(u"last_checked_ok"),
564
 
            (self._datetime_to_dbus(self.last_checked_ok,
565
 
                                    variant_level=1)))
566
 
        return r
 
1532
        return ret
567
1533
    
568
1534
    def start_checker(self, *args, **kwargs):
569
 
        old_checker = self.checker
570
 
        if self.checker is not None:
571
 
            old_checker_pid = self.checker.pid
572
 
        else:
573
 
            old_checker_pid = None
 
1535
        old_checker_pid = getattr(self.checker, "pid", None)
574
1536
        r = Client.start_checker(self, *args, **kwargs)
575
1537
        # Only if new checker process was started
576
1538
        if (self.checker is not None
577
1539
            and old_checker_pid != self.checker.pid):
578
1540
            # Emit D-Bus signal
579
1541
            self.CheckerStarted(self.current_checker_command)
580
 
            self.PropertyChanged(
581
 
                dbus.String(u"checker_running"),
582
 
                dbus.Boolean(True, variant_level=1))
583
 
        return r
584
 
    
585
 
    def stop_checker(self, *args, **kwargs):
586
 
        old_checker = getattr(self, u"checker", None)
587
 
        r = Client.stop_checker(self, *args, **kwargs)
588
 
        if (old_checker is not None
589
 
            and getattr(self, u"checker", None) is None):
590
 
            self.PropertyChanged(dbus.String(u"checker_running"),
591
 
                                 dbus.Boolean(False, variant_level=1))
592
 
        return r
593
 
    
594
 
    ## D-Bus methods & signals
595
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
596
 
    
597
 
    # CheckedOK - method
598
 
    @dbus.service.method(_interface)
599
 
    def CheckedOK(self):
600
 
        return self.checked_ok()
 
1542
        return r
 
1543
    
 
1544
    def _reset_approved(self):
 
1545
        self.approved = None
 
1546
        return False
 
1547
    
 
1548
    def approve(self, value=True):
 
1549
        self.approved = value
 
1550
        gobject.timeout_add(int(self.approval_duration.total_seconds()
 
1551
                                * 1000), self._reset_approved)
 
1552
        self.send_changedstate()
 
1553
    
 
1554
    ## D-Bus methods, signals & properties
 
1555
    
 
1556
    ## Interfaces
 
1557
    
 
1558
    ## Signals
601
1559
    
602
1560
    # CheckerCompleted - signal
603
 
    @dbus.service.signal(_interface, signature=u"nxs")
 
1561
    @dbus.service.signal(_interface, signature="nxs")
604
1562
    def CheckerCompleted(self, exitcode, waitstatus, command):
605
1563
        "D-Bus signal"
606
1564
        pass
607
1565
    
608
1566
    # CheckerStarted - signal
609
 
    @dbus.service.signal(_interface, signature=u"s")
 
1567
    @dbus.service.signal(_interface, signature="s")
610
1568
    def CheckerStarted(self, command):
611
1569
        "D-Bus signal"
612
1570
        pass
613
1571
    
614
 
    # GetAllProperties - method
615
 
    @dbus.service.method(_interface, out_signature=u"a{sv}")
616
 
    def GetAllProperties(self):
617
 
        "D-Bus method"
618
 
        return dbus.Dictionary({
619
 
                dbus.String(u"name"):
620
 
                    dbus.String(self.name, variant_level=1),
621
 
                dbus.String(u"fingerprint"):
622
 
                    dbus.String(self.fingerprint, variant_level=1),
623
 
                dbus.String(u"host"):
624
 
                    dbus.String(self.host, variant_level=1),
625
 
                dbus.String(u"created"):
626
 
                    self._datetime_to_dbus(self.created,
627
 
                                           variant_level=1),
628
 
                dbus.String(u"last_enabled"):
629
 
                    (self._datetime_to_dbus(self.last_enabled,
630
 
                                            variant_level=1)
631
 
                     if self.last_enabled is not None
632
 
                     else dbus.Boolean(False, variant_level=1)),
633
 
                dbus.String(u"enabled"):
634
 
                    dbus.Boolean(self.enabled, variant_level=1),
635
 
                dbus.String(u"last_checked_ok"):
636
 
                    (self._datetime_to_dbus(self.last_checked_ok,
637
 
                                            variant_level=1)
638
 
                     if self.last_checked_ok is not None
639
 
                     else dbus.Boolean (False, variant_level=1)),
640
 
                dbus.String(u"timeout"):
641
 
                    dbus.UInt64(self.timeout_milliseconds(),
642
 
                                variant_level=1),
643
 
                dbus.String(u"interval"):
644
 
                    dbus.UInt64(self.interval_milliseconds(),
645
 
                                variant_level=1),
646
 
                dbus.String(u"checker"):
647
 
                    dbus.String(self.checker_command,
648
 
                                variant_level=1),
649
 
                dbus.String(u"checker_running"):
650
 
                    dbus.Boolean(self.checker is not None,
651
 
                                 variant_level=1),
652
 
                dbus.String(u"object_path"):
653
 
                    dbus.ObjectPath(self.dbus_object_path,
654
 
                                    variant_level=1)
655
 
                }, signature=u"sv")
656
 
    
657
 
    # IsStillValid - method
658
 
    @dbus.service.method(_interface, out_signature=u"b")
659
 
    def IsStillValid(self):
660
 
        return self.still_valid()
661
 
    
662
1572
    # PropertyChanged - signal
663
 
    @dbus.service.signal(_interface, signature=u"sv")
 
1573
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
 
1574
    @dbus.service.signal(_interface, signature="sv")
664
1575
    def PropertyChanged(self, property, value):
665
1576
        "D-Bus signal"
666
1577
        pass
667
1578
    
668
 
    # ReceivedSecret - signal
 
1579
    # GotSecret - signal
669
1580
    @dbus.service.signal(_interface)
670
 
    def ReceivedSecret(self):
671
 
        "D-Bus signal"
 
1581
    def GotSecret(self):
 
1582
        """D-Bus signal
 
1583
        Is sent after a successful transfer of secret from the Mandos
 
1584
        server to mandos-client
 
1585
        """
672
1586
        pass
673
1587
    
674
1588
    # Rejected - signal
675
 
    @dbus.service.signal(_interface)
676
 
    def Rejected(self):
 
1589
    @dbus.service.signal(_interface, signature="s")
 
1590
    def Rejected(self, reason):
677
1591
        "D-Bus signal"
678
1592
        pass
679
1593
    
680
 
    # SetChecker - method
681
 
    @dbus.service.method(_interface, in_signature=u"s")
682
 
    def SetChecker(self, checker):
683
 
        "D-Bus setter method"
684
 
        self.checker_command = checker
685
 
        # Emit D-Bus signal
686
 
        self.PropertyChanged(dbus.String(u"checker"),
687
 
                             dbus.String(self.checker_command,
688
 
                                         variant_level=1))
689
 
    
690
 
    # SetHost - method
691
 
    @dbus.service.method(_interface, in_signature=u"s")
692
 
    def SetHost(self, host):
693
 
        "D-Bus setter method"
694
 
        self.host = host
695
 
        # Emit D-Bus signal
696
 
        self.PropertyChanged(dbus.String(u"host"),
697
 
                             dbus.String(self.host, variant_level=1))
698
 
    
699
 
    # SetInterval - method
700
 
    @dbus.service.method(_interface, in_signature=u"t")
701
 
    def SetInterval(self, milliseconds):
702
 
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
703
 
        # Emit D-Bus signal
704
 
        self.PropertyChanged(dbus.String(u"interval"),
705
 
                             (dbus.UInt64(self.interval_milliseconds(),
706
 
                                          variant_level=1)))
707
 
    
708
 
    # SetSecret - method
709
 
    @dbus.service.method(_interface, in_signature=u"ay",
710
 
                         byte_arrays=True)
711
 
    def SetSecret(self, secret):
712
 
        "D-Bus setter method"
713
 
        self.secret = str(secret)
714
 
    
715
 
    # SetTimeout - method
716
 
    @dbus.service.method(_interface, in_signature=u"t")
717
 
    def SetTimeout(self, milliseconds):
718
 
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
719
 
        # Emit D-Bus signal
720
 
        self.PropertyChanged(dbus.String(u"timeout"),
721
 
                             (dbus.UInt64(self.timeout_milliseconds(),
722
 
                                          variant_level=1)))
 
1594
    # NeedApproval - signal
 
1595
    @dbus.service.signal(_interface, signature="tb")
 
1596
    def NeedApproval(self, timeout, default):
 
1597
        "D-Bus signal"
 
1598
        return self.need_approval()
 
1599
    
 
1600
    ## Methods
 
1601
    
 
1602
    # Approve - method
 
1603
    @dbus.service.method(_interface, in_signature="b")
 
1604
    def Approve(self, value):
 
1605
        self.approve(value)
 
1606
    
 
1607
    # CheckedOK - method
 
1608
    @dbus.service.method(_interface)
 
1609
    def CheckedOK(self):
 
1610
        self.checked_ok()
723
1611
    
724
1612
    # Enable - method
 
1613
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
725
1614
    @dbus.service.method(_interface)
726
1615
    def Enable(self):
727
1616
        "D-Bus method"
728
1617
        self.enable()
729
1618
    
730
1619
    # StartChecker - method
 
1620
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
731
1621
    @dbus.service.method(_interface)
732
1622
    def StartChecker(self):
733
1623
        "D-Bus method"
734
1624
        self.start_checker()
735
1625
    
736
1626
    # Disable - method
 
1627
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
737
1628
    @dbus.service.method(_interface)
738
1629
    def Disable(self):
739
1630
        "D-Bus method"
740
1631
        self.disable()
741
1632
    
742
1633
    # StopChecker - method
 
1634
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
743
1635
    @dbus.service.method(_interface)
744
1636
    def StopChecker(self):
745
1637
        self.stop_checker()
746
1638
    
 
1639
    ## Properties
 
1640
    
 
1641
    # ApprovalPending - property
 
1642
    @dbus_service_property(_interface, signature="b", access="read")
 
1643
    def ApprovalPending_dbus_property(self):
 
1644
        return dbus.Boolean(bool(self.approvals_pending))
 
1645
    
 
1646
    # ApprovedByDefault - property
 
1647
    @dbus_service_property(_interface,
 
1648
                           signature="b",
 
1649
                           access="readwrite")
 
1650
    def ApprovedByDefault_dbus_property(self, value=None):
 
1651
        if value is None:       # get
 
1652
            return dbus.Boolean(self.approved_by_default)
 
1653
        self.approved_by_default = bool(value)
 
1654
    
 
1655
    # ApprovalDelay - property
 
1656
    @dbus_service_property(_interface,
 
1657
                           signature="t",
 
1658
                           access="readwrite")
 
1659
    def ApprovalDelay_dbus_property(self, value=None):
 
1660
        if value is None:       # get
 
1661
            return dbus.UInt64(self.approval_delay.total_seconds()
 
1662
                               * 1000)
 
1663
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
1664
    
 
1665
    # ApprovalDuration - property
 
1666
    @dbus_service_property(_interface,
 
1667
                           signature="t",
 
1668
                           access="readwrite")
 
1669
    def ApprovalDuration_dbus_property(self, value=None):
 
1670
        if value is None:       # get
 
1671
            return dbus.UInt64(self.approval_duration.total_seconds()
 
1672
                               * 1000)
 
1673
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1674
    
 
1675
    # Name - property
 
1676
    @dbus_annotations(
 
1677
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
 
1678
    @dbus_service_property(_interface, signature="s", access="read")
 
1679
    def Name_dbus_property(self):
 
1680
        return dbus.String(self.name)
 
1681
    
 
1682
    # Fingerprint - property
 
1683
    @dbus_annotations(
 
1684
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
 
1685
    @dbus_service_property(_interface, signature="s", access="read")
 
1686
    def Fingerprint_dbus_property(self):
 
1687
        return dbus.String(self.fingerprint)
 
1688
    
 
1689
    # Host - property
 
1690
    @dbus_service_property(_interface,
 
1691
                           signature="s",
 
1692
                           access="readwrite")
 
1693
    def Host_dbus_property(self, value=None):
 
1694
        if value is None:       # get
 
1695
            return dbus.String(self.host)
 
1696
        self.host = str(value)
 
1697
    
 
1698
    # Created - property
 
1699
    @dbus_annotations(
 
1700
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
 
1701
    @dbus_service_property(_interface, signature="s", access="read")
 
1702
    def Created_dbus_property(self):
 
1703
        return datetime_to_dbus(self.created)
 
1704
    
 
1705
    # LastEnabled - property
 
1706
    @dbus_service_property(_interface, signature="s", access="read")
 
1707
    def LastEnabled_dbus_property(self):
 
1708
        return datetime_to_dbus(self.last_enabled)
 
1709
    
 
1710
    # Enabled - property
 
1711
    @dbus_service_property(_interface,
 
1712
                           signature="b",
 
1713
                           access="readwrite")
 
1714
    def Enabled_dbus_property(self, value=None):
 
1715
        if value is None:       # get
 
1716
            return dbus.Boolean(self.enabled)
 
1717
        if value:
 
1718
            self.enable()
 
1719
        else:
 
1720
            self.disable()
 
1721
    
 
1722
    # LastCheckedOK - property
 
1723
    @dbus_service_property(_interface,
 
1724
                           signature="s",
 
1725
                           access="readwrite")
 
1726
    def LastCheckedOK_dbus_property(self, value=None):
 
1727
        if value is not None:
 
1728
            self.checked_ok()
 
1729
            return
 
1730
        return datetime_to_dbus(self.last_checked_ok)
 
1731
    
 
1732
    # LastCheckerStatus - property
 
1733
    @dbus_service_property(_interface, signature="n", access="read")
 
1734
    def LastCheckerStatus_dbus_property(self):
 
1735
        return dbus.Int16(self.last_checker_status)
 
1736
    
 
1737
    # Expires - property
 
1738
    @dbus_service_property(_interface, signature="s", access="read")
 
1739
    def Expires_dbus_property(self):
 
1740
        return datetime_to_dbus(self.expires)
 
1741
    
 
1742
    # LastApprovalRequest - property
 
1743
    @dbus_service_property(_interface, signature="s", access="read")
 
1744
    def LastApprovalRequest_dbus_property(self):
 
1745
        return datetime_to_dbus(self.last_approval_request)
 
1746
    
 
1747
    # Timeout - property
 
1748
    @dbus_service_property(_interface,
 
1749
                           signature="t",
 
1750
                           access="readwrite")
 
1751
    def Timeout_dbus_property(self, value=None):
 
1752
        if value is None:       # get
 
1753
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
 
1754
        old_timeout = self.timeout
 
1755
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1756
        # Reschedule disabling
 
1757
        if self.enabled:
 
1758
            now = datetime.datetime.utcnow()
 
1759
            self.expires += self.timeout - old_timeout
 
1760
            if self.expires <= now:
 
1761
                # The timeout has passed
 
1762
                self.disable()
 
1763
            else:
 
1764
                if (getattr(self, "disable_initiator_tag", None)
 
1765
                    is None):
 
1766
                    return
 
1767
                gobject.source_remove(self.disable_initiator_tag)
 
1768
                self.disable_initiator_tag = gobject.timeout_add(
 
1769
                    int((self.expires - now).total_seconds() * 1000),
 
1770
                    self.disable)
 
1771
    
 
1772
    # ExtendedTimeout - property
 
1773
    @dbus_service_property(_interface,
 
1774
                           signature="t",
 
1775
                           access="readwrite")
 
1776
    def ExtendedTimeout_dbus_property(self, value=None):
 
1777
        if value is None:       # get
 
1778
            return dbus.UInt64(self.extended_timeout.total_seconds()
 
1779
                               * 1000)
 
1780
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1781
    
 
1782
    # Interval - property
 
1783
    @dbus_service_property(_interface,
 
1784
                           signature="t",
 
1785
                           access="readwrite")
 
1786
    def Interval_dbus_property(self, value=None):
 
1787
        if value is None:       # get
 
1788
            return dbus.UInt64(self.interval.total_seconds() * 1000)
 
1789
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1790
        if getattr(self, "checker_initiator_tag", None) is None:
 
1791
            return
 
1792
        if self.enabled:
 
1793
            # Reschedule checker run
 
1794
            gobject.source_remove(self.checker_initiator_tag)
 
1795
            self.checker_initiator_tag = gobject.timeout_add(
 
1796
                value, self.start_checker)
 
1797
            self.start_checker() # Start one now, too
 
1798
    
 
1799
    # Checker - property
 
1800
    @dbus_service_property(_interface,
 
1801
                           signature="s",
 
1802
                           access="readwrite")
 
1803
    def Checker_dbus_property(self, value=None):
 
1804
        if value is None:       # get
 
1805
            return dbus.String(self.checker_command)
 
1806
        self.checker_command = str(value)
 
1807
    
 
1808
    # CheckerRunning - property
 
1809
    @dbus_service_property(_interface,
 
1810
                           signature="b",
 
1811
                           access="readwrite")
 
1812
    def CheckerRunning_dbus_property(self, value=None):
 
1813
        if value is None:       # get
 
1814
            return dbus.Boolean(self.checker is not None)
 
1815
        if value:
 
1816
            self.start_checker()
 
1817
        else:
 
1818
            self.stop_checker()
 
1819
    
 
1820
    # ObjectPath - property
 
1821
    @dbus_annotations(
 
1822
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
 
1823
         "org.freedesktop.DBus.Deprecated": "true"})
 
1824
    @dbus_service_property(_interface, signature="o", access="read")
 
1825
    def ObjectPath_dbus_property(self):
 
1826
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1827
    
 
1828
    # Secret = property
 
1829
    @dbus_annotations(
 
1830
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1831
         "invalidates"})
 
1832
    @dbus_service_property(_interface,
 
1833
                           signature="ay",
 
1834
                           access="write",
 
1835
                           byte_arrays=True)
 
1836
    def Secret_dbus_property(self, value):
 
1837
        self.secret = bytes(value)
 
1838
    
747
1839
    del _interface
748
1840
 
749
1841
 
 
1842
class ProxyClient(object):
 
1843
    def __init__(self, child_pipe, fpr, address):
 
1844
        self._pipe = child_pipe
 
1845
        self._pipe.send(('init', fpr, address))
 
1846
        if not self._pipe.recv():
 
1847
            raise KeyError(fpr)
 
1848
    
 
1849
    def __getattribute__(self, name):
 
1850
        if name == '_pipe':
 
1851
            return super(ProxyClient, self).__getattribute__(name)
 
1852
        self._pipe.send(('getattr', name))
 
1853
        data = self._pipe.recv()
 
1854
        if data[0] == 'data':
 
1855
            return data[1]
 
1856
        if data[0] == 'function':
 
1857
            
 
1858
            def func(*args, **kwargs):
 
1859
                self._pipe.send(('funcall', name, args, kwargs))
 
1860
                return self._pipe.recv()[1]
 
1861
            
 
1862
            return func
 
1863
    
 
1864
    def __setattr__(self, name, value):
 
1865
        if name == '_pipe':
 
1866
            return super(ProxyClient, self).__setattr__(name, value)
 
1867
        self._pipe.send(('setattr', name, value))
 
1868
 
 
1869
 
750
1870
class ClientHandler(socketserver.BaseRequestHandler, object):
751
1871
    """A class to handle client connections.
752
1872
    
754
1874
    Note: This will run in its own forked process."""
755
1875
    
756
1876
    def handle(self):
757
 
        logger.info(u"TCP connection from: %s",
758
 
                    unicode(self.client_address))
759
 
        logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
 
        # Open IPC pipe to parent process
761
 
        with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
 
            session = (gnutls.connection
763
 
                       .ClientSession(self.request,
764
 
                                      gnutls.connection
765
 
                                      .X509Credentials()))
 
1877
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1878
            logger.info("TCP connection from: %s",
 
1879
                        str(self.client_address))
 
1880
            logger.debug("Pipe FD: %d",
 
1881
                         self.server.child_pipe.fileno())
766
1882
            
767
 
            line = self.request.makefile().readline()
768
 
            logger.debug(u"Protocol version: %r", line)
769
 
            try:
770
 
                if int(line.strip().split()[0]) > 1:
771
 
                    raise RuntimeError
772
 
            except (ValueError, IndexError, RuntimeError), error:
773
 
                logger.error(u"Unknown protocol version: %s", error)
774
 
                return
 
1883
            session = gnutls.connection.ClientSession(
 
1884
                self.request, gnutls.connection .X509Credentials())
775
1885
            
776
1886
            # Note: gnutls.connection.X509Credentials is really a
777
1887
            # generic GnuTLS certificate credentials object so long as
778
1888
            # no X.509 keys are added to it.  Therefore, we can use it
779
1889
            # here despite using OpenPGP certificates.
780
1890
            
781
 
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
 
            #                      u"+AES-256-CBC", u"+SHA1",
783
 
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
784
 
            #                      u"+DHE-DSS"))
 
1891
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1892
            #                      "+AES-256-CBC", "+SHA1",
 
1893
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1894
            #                      "+DHE-DSS"))
785
1895
            # Use a fallback default, since this MUST be set.
786
1896
            priority = self.server.gnutls_priority
787
1897
            if priority is None:
788
 
                priority = u"NORMAL"
789
 
            (gnutls.library.functions
790
 
             .gnutls_priority_set_direct(session._c_object,
791
 
                                         priority, None))
792
 
            
 
1898
                priority = "NORMAL"
 
1899
            gnutls.library.functions.gnutls_priority_set_direct(
 
1900
                session._c_object, priority, None)
 
1901
            
 
1902
            # Start communication using the Mandos protocol
 
1903
            # Get protocol number
 
1904
            line = self.request.makefile().readline()
 
1905
            logger.debug("Protocol version: %r", line)
 
1906
            try:
 
1907
                if int(line.strip().split()[0]) > 1:
 
1908
                    raise RuntimeError(line)
 
1909
            except (ValueError, IndexError, RuntimeError) as error:
 
1910
                logger.error("Unknown protocol version: %s", error)
 
1911
                return
 
1912
            
 
1913
            # Start GnuTLS connection
793
1914
            try:
794
1915
                session.handshake()
795
 
            except gnutls.errors.GNUTLSError, error:
796
 
                logger.warning(u"Handshake failed: %s", error)
 
1916
            except gnutls.errors.GNUTLSError as error:
 
1917
                logger.warning("Handshake failed: %s", error)
797
1918
                # Do not run session.bye() here: the session is not
798
1919
                # established.  Just abandon the request.
799
1920
                return
800
 
            logger.debug(u"Handshake succeeded")
 
1921
            logger.debug("Handshake succeeded")
 
1922
            
 
1923
            approval_required = False
801
1924
            try:
802
 
                fpr = self.fingerprint(self.peer_certificate(session))
803
 
            except (TypeError, gnutls.errors.GNUTLSError), error:
804
 
                logger.warning(u"Bad certificate: %s", error)
805
 
                session.bye()
806
 
                return
807
 
            logger.debug(u"Fingerprint: %s", fpr)
 
1925
                try:
 
1926
                    fpr = self.fingerprint(
 
1927
                        self.peer_certificate(session))
 
1928
                except (TypeError,
 
1929
                        gnutls.errors.GNUTLSError) as error:
 
1930
                    logger.warning("Bad certificate: %s", error)
 
1931
                    return
 
1932
                logger.debug("Fingerprint: %s", fpr)
 
1933
                
 
1934
                try:
 
1935
                    client = ProxyClient(child_pipe, fpr,
 
1936
                                         self.client_address)
 
1937
                except KeyError:
 
1938
                    return
 
1939
                
 
1940
                if client.approval_delay:
 
1941
                    delay = client.approval_delay
 
1942
                    client.approvals_pending += 1
 
1943
                    approval_required = True
 
1944
                
 
1945
                while True:
 
1946
                    if not client.enabled:
 
1947
                        logger.info("Client %s is disabled",
 
1948
                                    client.name)
 
1949
                        if self.server.use_dbus:
 
1950
                            # Emit D-Bus signal
 
1951
                            client.Rejected("Disabled")
 
1952
                        return
 
1953
                    
 
1954
                    if client.approved or not client.approval_delay:
 
1955
                        #We are approved or approval is disabled
 
1956
                        break
 
1957
                    elif client.approved is None:
 
1958
                        logger.info("Client %s needs approval",
 
1959
                                    client.name)
 
1960
                        if self.server.use_dbus:
 
1961
                            # Emit D-Bus signal
 
1962
                            client.NeedApproval(
 
1963
                                client.approval_delay.total_seconds()
 
1964
                                * 1000, client.approved_by_default)
 
1965
                    else:
 
1966
                        logger.warning("Client %s was not approved",
 
1967
                                       client.name)
 
1968
                        if self.server.use_dbus:
 
1969
                            # Emit D-Bus signal
 
1970
                            client.Rejected("Denied")
 
1971
                        return
 
1972
                    
 
1973
                    #wait until timeout or approved
 
1974
                    time = datetime.datetime.now()
 
1975
                    client.changedstate.acquire()
 
1976
                    client.changedstate.wait(delay.total_seconds())
 
1977
                    client.changedstate.release()
 
1978
                    time2 = datetime.datetime.now()
 
1979
                    if (time2 - time) >= delay:
 
1980
                        if not client.approved_by_default:
 
1981
                            logger.warning("Client %s timed out while"
 
1982
                                           " waiting for approval",
 
1983
                                           client.name)
 
1984
                            if self.server.use_dbus:
 
1985
                                # Emit D-Bus signal
 
1986
                                client.Rejected("Approval timed out")
 
1987
                            return
 
1988
                        else:
 
1989
                            break
 
1990
                    else:
 
1991
                        delay -= time2 - time
 
1992
                
 
1993
                sent_size = 0
 
1994
                while sent_size < len(client.secret):
 
1995
                    try:
 
1996
                        sent = session.send(client.secret[sent_size:])
 
1997
                    except gnutls.errors.GNUTLSError as error:
 
1998
                        logger.warning("gnutls send failed",
 
1999
                                       exc_info=error)
 
2000
                        return
 
2001
                    logger.debug("Sent: %d, remaining: %d", sent,
 
2002
                                 len(client.secret) - (sent_size
 
2003
                                                       + sent))
 
2004
                    sent_size += sent
 
2005
                
 
2006
                logger.info("Sending secret to %s", client.name)
 
2007
                # bump the timeout using extended_timeout
 
2008
                client.bump_timeout(client.extended_timeout)
 
2009
                if self.server.use_dbus:
 
2010
                    # Emit D-Bus signal
 
2011
                    client.GotSecret()
808
2012
            
809
 
            for c in self.server.clients:
810
 
                if c.fingerprint == fpr:
811
 
                    client = c
812
 
                    break
813
 
            else:
814
 
                ipc.write(u"NOTFOUND %s %s\n"
815
 
                          % (fpr, unicode(self.client_address)))
816
 
                session.bye()
817
 
                return
818
 
            # Have to check if client.still_valid(), since it is
819
 
            # possible that the client timed out while establishing
820
 
            # the GnuTLS session.
821
 
            if not client.still_valid():
822
 
                ipc.write(u"INVALID %s\n" % client.name)
823
 
                session.bye()
824
 
                return
825
 
            ipc.write(u"SENDING %s\n" % client.name)
826
 
            sent_size = 0
827
 
            while sent_size < len(client.secret):
828
 
                sent = session.send(client.secret[sent_size:])
829
 
                logger.debug(u"Sent: %d, remaining: %d",
830
 
                             sent, len(client.secret)
831
 
                             - (sent_size + sent))
832
 
                sent_size += sent
833
 
            session.bye()
 
2013
            finally:
 
2014
                if approval_required:
 
2015
                    client.approvals_pending -= 1
 
2016
                try:
 
2017
                    session.bye()
 
2018
                except gnutls.errors.GNUTLSError as error:
 
2019
                    logger.warning("GnuTLS bye failed",
 
2020
                                   exc_info=error)
834
2021
    
835
2022
    @staticmethod
836
2023
    def peer_certificate(session):
837
2024
        "Return the peer's OpenPGP certificate as a bytestring"
838
2025
        # If not an OpenPGP certificate...
839
 
        if (gnutls.library.functions
840
 
            .gnutls_certificate_type_get(session._c_object)
 
2026
        if (gnutls.library.functions.gnutls_certificate_type_get(
 
2027
                session._c_object)
841
2028
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
842
2029
            # ...do the normal thing
843
2030
            return session.peer_certificate
846
2033
                     .gnutls_certificate_get_peers
847
2034
                     (session._c_object, ctypes.byref(list_size)))
848
2035
        if not bool(cert_list) and list_size.value != 0:
849
 
            raise gnutls.errors.GNUTLSError(u"error getting peer"
850
 
                                            u" certificate")
 
2036
            raise gnutls.errors.GNUTLSError("error getting peer"
 
2037
                                            " certificate")
851
2038
        if list_size.value == 0:
852
2039
            return None
853
2040
        cert = cert_list[0]
857
2044
    def fingerprint(openpgp):
858
2045
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
859
2046
        # New GnuTLS "datum" with the OpenPGP public key
860
 
        datum = (gnutls.library.types
861
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
862
 
                                             ctypes.POINTER
863
 
                                             (ctypes.c_ubyte)),
864
 
                                 ctypes.c_uint(len(openpgp))))
 
2047
        datum = gnutls.library.types.gnutls_datum_t(
 
2048
            ctypes.cast(ctypes.c_char_p(openpgp),
 
2049
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2050
            ctypes.c_uint(len(openpgp)))
865
2051
        # New empty GnuTLS certificate
866
2052
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
867
 
        (gnutls.library.functions
868
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
2053
        gnutls.library.functions.gnutls_openpgp_crt_init(
 
2054
            ctypes.byref(crt))
869
2055
        # Import the OpenPGP public key into the certificate
870
 
        (gnutls.library.functions
871
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
872
 
                                    gnutls.library.constants
873
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
2056
        gnutls.library.functions.gnutls_openpgp_crt_import(
 
2057
            crt, ctypes.byref(datum),
 
2058
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
874
2059
        # Verify the self signature in the key
875
2060
        crtverify = ctypes.c_uint()
876
 
        (gnutls.library.functions
877
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
878
 
                                         ctypes.byref(crtverify)))
 
2061
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
 
2062
            crt, 0, ctypes.byref(crtverify))
879
2063
        if crtverify.value != 0:
880
2064
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
881
 
            raise (gnutls.errors.CertificateSecurityError
882
 
                   (u"Verify failed"))
 
2065
            raise gnutls.errors.CertificateSecurityError(
 
2066
                "Verify failed")
883
2067
        # New buffer for the fingerprint
884
2068
        buf = ctypes.create_string_buffer(20)
885
2069
        buf_len = ctypes.c_size_t()
886
2070
        # Get the fingerprint from the certificate into the buffer
887
 
        (gnutls.library.functions
888
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
889
 
                                             ctypes.byref(buf_len)))
 
2071
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
 
2072
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
890
2073
        # Deinit the certificate
891
2074
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
892
2075
        # Convert the buffer to a Python bytestring
893
2076
        fpr = ctypes.string_at(buf, buf_len.value)
894
2077
        # Convert the bytestring to hexadecimal notation
895
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
2078
        hex_fpr = binascii.hexlify(fpr).upper()
896
2079
        return hex_fpr
897
2080
 
898
2081
 
899
 
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
900
 
    """Like socketserver.ForkingMixIn, but also pass a pipe."""
 
2082
class MultiprocessingMixIn(object):
 
2083
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
2084
    
 
2085
    def sub_process_main(self, request, address):
 
2086
        try:
 
2087
            self.finish_request(request, address)
 
2088
        except Exception:
 
2089
            self.handle_error(request, address)
 
2090
        self.close_request(request)
 
2091
    
 
2092
    def process_request(self, request, address):
 
2093
        """Start a new process to process the request."""
 
2094
        proc = multiprocessing.Process(target = self.sub_process_main,
 
2095
                                       args = (request, address))
 
2096
        proc.start()
 
2097
        return proc
 
2098
 
 
2099
 
 
2100
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
2101
    """ adds a pipe to the MixIn """
 
2102
    
901
2103
    def process_request(self, request, client_address):
902
2104
        """Overrides and wraps the original process_request().
903
2105
        
904
2106
        This function creates a new pipe in self.pipe
905
2107
        """
906
 
        self.pipe = os.pipe()
907
 
        super(ForkingMixInWithPipe,
908
 
              self).process_request(request, client_address)
909
 
        os.close(self.pipe[1])  # close write end
910
 
        self.add_pipe(self.pipe[0])
911
 
    def add_pipe(self, pipe):
 
2108
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
2109
        
 
2110
        proc = MultiprocessingMixIn.process_request(self, request,
 
2111
                                                    client_address)
 
2112
        self.child_pipe.close()
 
2113
        self.add_pipe(parent_pipe, proc)
 
2114
    
 
2115
    def add_pipe(self, parent_pipe, proc):
912
2116
        """Dummy function; override as necessary"""
913
 
        os.close(pipe)
914
 
 
915
 
 
916
 
class IPv6_TCPServer(ForkingMixInWithPipe,
 
2117
        raise NotImplementedError()
 
2118
 
 
2119
 
 
2120
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
917
2121
                     socketserver.TCPServer, object):
918
2122
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
919
2123
    
922
2126
        interface:      None or a network interface name (string)
923
2127
        use_ipv6:       Boolean; to use IPv6 or not
924
2128
    """
 
2129
    
925
2130
    def __init__(self, server_address, RequestHandlerClass,
926
 
                 interface=None, use_ipv6=True):
 
2131
                 interface=None,
 
2132
                 use_ipv6=True,
 
2133
                 socketfd=None):
 
2134
        """If socketfd is set, use that file descriptor instead of
 
2135
        creating a new one with socket.socket().
 
2136
        """
927
2137
        self.interface = interface
928
2138
        if use_ipv6:
929
2139
            self.address_family = socket.AF_INET6
 
2140
        if socketfd is not None:
 
2141
            # Save the file descriptor
 
2142
            self.socketfd = socketfd
 
2143
            # Save the original socket.socket() function
 
2144
            self.socket_socket = socket.socket
 
2145
            # To implement --socket, we monkey patch socket.socket.
 
2146
            # 
 
2147
            # (When socketserver.TCPServer is a new-style class, we
 
2148
            # could make self.socket into a property instead of monkey
 
2149
            # patching socket.socket.)
 
2150
            # 
 
2151
            # Create a one-time-only replacement for socket.socket()
 
2152
            @functools.wraps(socket.socket)
 
2153
            def socket_wrapper(*args, **kwargs):
 
2154
                # Restore original function so subsequent calls are
 
2155
                # not affected.
 
2156
                socket.socket = self.socket_socket
 
2157
                del self.socket_socket
 
2158
                # This time only, return a new socket object from the
 
2159
                # saved file descriptor.
 
2160
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
2161
            # Replace socket.socket() function with wrapper
 
2162
            socket.socket = socket_wrapper
 
2163
        # The socketserver.TCPServer.__init__ will call
 
2164
        # socket.socket(), which might be our replacement,
 
2165
        # socket_wrapper(), if socketfd was set.
930
2166
        socketserver.TCPServer.__init__(self, server_address,
931
2167
                                        RequestHandlerClass)
 
2168
    
932
2169
    def server_bind(self):
933
2170
        """This overrides the normal server_bind() function
934
2171
        to bind to an interface if one was specified, and also NOT to
935
2172
        bind to an address or port if they were not specified."""
936
2173
        if self.interface is not None:
937
2174
            if SO_BINDTODEVICE is None:
938
 
                logger.error(u"SO_BINDTODEVICE does not exist;"
939
 
                             u" cannot bind to interface %s",
 
2175
                logger.error("SO_BINDTODEVICE does not exist;"
 
2176
                             " cannot bind to interface %s",
940
2177
                             self.interface)
941
2178
            else:
942
2179
                try:
943
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
944
 
                                           SO_BINDTODEVICE,
945
 
                                           str(self.interface
946
 
                                               + u'\0'))
947
 
                except socket.error, error:
948
 
                    if error[0] == errno.EPERM:
949
 
                        logger.error(u"No permission to"
950
 
                                     u" bind to interface %s",
951
 
                                     self.interface)
952
 
                    elif error[0] == errno.ENOPROTOOPT:
953
 
                        logger.error(u"SO_BINDTODEVICE not available;"
954
 
                                     u" cannot bind to interface %s",
955
 
                                     self.interface)
 
2180
                    self.socket.setsockopt(
 
2181
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
 
2182
                        (self.interface + "\0").encode("utf-8"))
 
2183
                except socket.error as error:
 
2184
                    if error.errno == errno.EPERM:
 
2185
                        logger.error("No permission to bind to"
 
2186
                                     " interface %s", self.interface)
 
2187
                    elif error.errno == errno.ENOPROTOOPT:
 
2188
                        logger.error("SO_BINDTODEVICE not available;"
 
2189
                                     " cannot bind to interface %s",
 
2190
                                     self.interface)
 
2191
                    elif error.errno == errno.ENODEV:
 
2192
                        logger.error("Interface %s does not exist,"
 
2193
                                     " cannot bind", self.interface)
956
2194
                    else:
957
2195
                        raise
958
2196
        # Only bind(2) the socket if we really need to.
959
2197
        if self.server_address[0] or self.server_address[1]:
960
2198
            if not self.server_address[0]:
961
2199
                if self.address_family == socket.AF_INET6:
962
 
                    any_address = u"::" # in6addr_any
 
2200
                    any_address = "::" # in6addr_any
963
2201
                else:
964
 
                    any_address = socket.INADDR_ANY
 
2202
                    any_address = "0.0.0.0" # INADDR_ANY
965
2203
                self.server_address = (any_address,
966
2204
                                       self.server_address[1])
967
2205
            elif not self.server_address[1]:
968
 
                self.server_address = (self.server_address[0],
969
 
                                       0)
 
2206
                self.server_address = (self.server_address[0], 0)
970
2207
#                 if self.interface:
971
2208
#                     self.server_address = (self.server_address[0],
972
2209
#                                            0, # port
983
2220
        clients:        set of Client objects
984
2221
        gnutls_priority GnuTLS priority string
985
2222
        use_dbus:       Boolean; to emit D-Bus signals or not
986
 
        clients:        set of Client objects
987
 
        gnutls_priority GnuTLS priority string
988
 
        use_dbus:       Boolean; to emit D-Bus signals or not
989
2223
    
990
2224
    Assumes a gobject.MainLoop event loop.
991
2225
    """
 
2226
    
992
2227
    def __init__(self, server_address, RequestHandlerClass,
993
 
                 interface=None, use_ipv6=True, clients=None,
994
 
                 gnutls_priority=None, use_dbus=True):
 
2228
                 interface=None,
 
2229
                 use_ipv6=True,
 
2230
                 clients=None,
 
2231
                 gnutls_priority=None,
 
2232
                 use_dbus=True,
 
2233
                 socketfd=None):
995
2234
        self.enabled = False
996
2235
        self.clients = clients
997
2236
        if self.clients is None:
998
 
            self.clients = set()
 
2237
            self.clients = {}
999
2238
        self.use_dbus = use_dbus
1000
2239
        self.gnutls_priority = gnutls_priority
1001
2240
        IPv6_TCPServer.__init__(self, server_address,
1002
2241
                                RequestHandlerClass,
1003
2242
                                interface = interface,
1004
 
                                use_ipv6 = use_ipv6)
 
2243
                                use_ipv6 = use_ipv6,
 
2244
                                socketfd = socketfd)
 
2245
    
1005
2246
    def server_activate(self):
1006
2247
        if self.enabled:
1007
2248
            return socketserver.TCPServer.server_activate(self)
 
2249
    
1008
2250
    def enable(self):
1009
2251
        self.enabled = True
1010
 
    def add_pipe(self, pipe):
 
2252
    
 
2253
    def add_pipe(self, parent_pipe, proc):
1011
2254
        # Call "handle_ipc" for both data and EOF events
1012
 
        gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1013
 
                             self.handle_ipc)
1014
 
    def handle_ipc(self, source, condition, file_objects={}):
1015
 
        condition_names = {
1016
 
            gobject.IO_IN: u"IN",   # There is data to read.
1017
 
            gobject.IO_OUT: u"OUT", # Data can be written (without
1018
 
                                    # blocking).
1019
 
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
1020
 
            gobject.IO_ERR: u"ERR", # Error condition.
1021
 
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
1022
 
                                    # broken, usually for pipes and
1023
 
                                    # sockets).
1024
 
            }
1025
 
        conditions_string = ' | '.join(name
1026
 
                                       for cond, name in
1027
 
                                       condition_names.iteritems()
1028
 
                                       if cond & condition)
1029
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1030
 
                     conditions_string)
1031
 
        
1032
 
        # Turn the pipe file descriptor into a Python file object
1033
 
        if source not in file_objects:
1034
 
            file_objects[source] = os.fdopen(source, u"r", 1)
1035
 
        
1036
 
        # Read a line from the file object
1037
 
        cmdline = file_objects[source].readline()
1038
 
        if not cmdline:             # Empty line means end of file
1039
 
            # close the IPC pipe
1040
 
            file_objects[source].close()
1041
 
            del file_objects[source]
1042
 
            
1043
 
            # Stop calling this function
1044
 
            return False
1045
 
        
1046
 
        logger.debug(u"IPC command: %r", cmdline)
1047
 
        
1048
 
        # Parse and act on command
1049
 
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1050
 
        
1051
 
        if cmd == u"NOTFOUND":
1052
 
            logger.warning(u"Client not found for fingerprint: %s",
1053
 
                           args)
1054
 
            if self.use_dbus:
1055
 
                # Emit D-Bus signal
1056
 
                mandos_dbus_service.ClientNotFound(args)
1057
 
        elif cmd == u"INVALID":
1058
 
            for client in self.clients:
1059
 
                if client.name == args:
1060
 
                    logger.warning(u"Client %s is invalid", args)
1061
 
                    if self.use_dbus:
1062
 
                        # Emit D-Bus signal
1063
 
                        client.Rejected()
1064
 
                    break
1065
 
            else:
1066
 
                logger.error(u"Unknown client %s is invalid", args)
1067
 
        elif cmd == u"SENDING":
1068
 
            for client in self.clients:
1069
 
                if client.name == args:
1070
 
                    logger.info(u"Sending secret to %s", client.name)
1071
 
                    client.checked_ok()
1072
 
                    if self.use_dbus:
1073
 
                        # Emit D-Bus signal
1074
 
                        client.ReceivedSecret()
1075
 
                    break
1076
 
            else:
1077
 
                logger.error(u"Sending secret to unknown client %s",
1078
 
                             args)
 
2255
        gobject.io_add_watch(
 
2256
            parent_pipe.fileno(),
 
2257
            gobject.IO_IN | gobject.IO_HUP,
 
2258
            functools.partial(self.handle_ipc,
 
2259
                              parent_pipe = parent_pipe,
 
2260
                              proc = proc))
 
2261
    
 
2262
    def handle_ipc(self, source, condition,
 
2263
                   parent_pipe=None,
 
2264
                   proc = None,
 
2265
                   client_object=None):
 
2266
        # error, or the other end of multiprocessing.Pipe has closed
 
2267
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2268
            # Wait for other process to exit
 
2269
            proc.join()
 
2270
            return False
 
2271
        
 
2272
        # Read a request from the child
 
2273
        request = parent_pipe.recv()
 
2274
        command = request[0]
 
2275
        
 
2276
        if command == 'init':
 
2277
            fpr = request[1]
 
2278
            address = request[2]
 
2279
            
 
2280
            for c in self.clients.itervalues():
 
2281
                if c.fingerprint == fpr:
 
2282
                    client = c
 
2283
                    break
 
2284
            else:
 
2285
                logger.info("Client not found for fingerprint: %s, ad"
 
2286
                            "dress: %s", fpr, address)
 
2287
                if self.use_dbus:
 
2288
                    # Emit D-Bus signal
 
2289
                    mandos_dbus_service.ClientNotFound(fpr,
 
2290
                                                       address[0])
 
2291
                parent_pipe.send(False)
 
2292
                return False
 
2293
            
 
2294
            gobject.io_add_watch(
 
2295
                parent_pipe.fileno(),
 
2296
                gobject.IO_IN | gobject.IO_HUP,
 
2297
                functools.partial(self.handle_ipc,
 
2298
                                  parent_pipe = parent_pipe,
 
2299
                                  proc = proc,
 
2300
                                  client_object = client))
 
2301
            parent_pipe.send(True)
 
2302
            # remove the old hook in favor of the new above hook on
 
2303
            # same fileno
 
2304
            return False
 
2305
        if command == 'funcall':
 
2306
            funcname = request[1]
 
2307
            args = request[2]
 
2308
            kwargs = request[3]
 
2309
            
 
2310
            parent_pipe.send(('data', getattr(client_object,
 
2311
                                              funcname)(*args,
 
2312
                                                        **kwargs)))
 
2313
        
 
2314
        if command == 'getattr':
 
2315
            attrname = request[1]
 
2316
            if isinstance(client_object.__getattribute__(attrname),
 
2317
                          collections.Callable):
 
2318
                parent_pipe.send(('function', ))
 
2319
            else:
 
2320
                parent_pipe.send((
 
2321
                    'data', client_object.__getattribute__(attrname)))
 
2322
        
 
2323
        if command == 'setattr':
 
2324
            attrname = request[1]
 
2325
            value = request[2]
 
2326
            setattr(client_object, attrname, value)
 
2327
        
 
2328
        return True
 
2329
 
 
2330
 
 
2331
def rfc3339_duration_to_delta(duration):
 
2332
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2333
    
 
2334
    >>> rfc3339_duration_to_delta("P7D")
 
2335
    datetime.timedelta(7)
 
2336
    >>> rfc3339_duration_to_delta("PT60S")
 
2337
    datetime.timedelta(0, 60)
 
2338
    >>> rfc3339_duration_to_delta("PT60M")
 
2339
    datetime.timedelta(0, 3600)
 
2340
    >>> rfc3339_duration_to_delta("PT24H")
 
2341
    datetime.timedelta(1)
 
2342
    >>> rfc3339_duration_to_delta("P1W")
 
2343
    datetime.timedelta(7)
 
2344
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2345
    datetime.timedelta(0, 330)
 
2346
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2347
    datetime.timedelta(1, 200)
 
2348
    """
 
2349
    
 
2350
    # Parsing an RFC 3339 duration with regular expressions is not
 
2351
    # possible - there would have to be multiple places for the same
 
2352
    # values, like seconds.  The current code, while more esoteric, is
 
2353
    # cleaner without depending on a parsing library.  If Python had a
 
2354
    # built-in library for parsing we would use it, but we'd like to
 
2355
    # avoid excessive use of external libraries.
 
2356
    
 
2357
    # New type for defining tokens, syntax, and semantics all-in-one
 
2358
    Token = collections.namedtuple("Token", (
 
2359
        "regexp",  # To match token; if "value" is not None, must have
 
2360
                   # a "group" containing digits
 
2361
        "value",   # datetime.timedelta or None
 
2362
        "followers"))           # Tokens valid after this token
 
2363
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2364
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2365
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2366
    token_second = Token(re.compile(r"(\d+)S"),
 
2367
                         datetime.timedelta(seconds=1),
 
2368
                         frozenset((token_end, )))
 
2369
    token_minute = Token(re.compile(r"(\d+)M"),
 
2370
                         datetime.timedelta(minutes=1),
 
2371
                         frozenset((token_second, token_end)))
 
2372
    token_hour = Token(re.compile(r"(\d+)H"),
 
2373
                       datetime.timedelta(hours=1),
 
2374
                       frozenset((token_minute, token_end)))
 
2375
    token_time = Token(re.compile(r"T"),
 
2376
                       None,
 
2377
                       frozenset((token_hour, token_minute,
 
2378
                                  token_second)))
 
2379
    token_day = Token(re.compile(r"(\d+)D"),
 
2380
                      datetime.timedelta(days=1),
 
2381
                      frozenset((token_time, token_end)))
 
2382
    token_month = Token(re.compile(r"(\d+)M"),
 
2383
                        datetime.timedelta(weeks=4),
 
2384
                        frozenset((token_day, token_end)))
 
2385
    token_year = Token(re.compile(r"(\d+)Y"),
 
2386
                       datetime.timedelta(weeks=52),
 
2387
                       frozenset((token_month, token_end)))
 
2388
    token_week = Token(re.compile(r"(\d+)W"),
 
2389
                       datetime.timedelta(weeks=1),
 
2390
                       frozenset((token_end, )))
 
2391
    token_duration = Token(re.compile(r"P"), None,
 
2392
                           frozenset((token_year, token_month,
 
2393
                                      token_day, token_time,
 
2394
                                      token_week)))
 
2395
    # Define starting values
 
2396
    value = datetime.timedelta() # Value so far
 
2397
    found_token = None
 
2398
    followers = frozenset((token_duration, )) # Following valid tokens
 
2399
    s = duration                # String left to parse
 
2400
    # Loop until end token is found
 
2401
    while found_token is not token_end:
 
2402
        # Search for any currently valid tokens
 
2403
        for token in followers:
 
2404
            match = token.regexp.match(s)
 
2405
            if match is not None:
 
2406
                # Token found
 
2407
                if token.value is not None:
 
2408
                    # Value found, parse digits
 
2409
                    factor = int(match.group(1), 10)
 
2410
                    # Add to value so far
 
2411
                    value += factor * token.value
 
2412
                # Strip token from string
 
2413
                s = token.regexp.sub("", s, 1)
 
2414
                # Go to found token
 
2415
                found_token = token
 
2416
                # Set valid next tokens
 
2417
                followers = found_token.followers
 
2418
                break
1079
2419
        else:
1080
 
            logger.error(u"Unknown IPC command: %r", cmdline)
1081
 
        
1082
 
        # Keep calling this function
1083
 
        return True
 
2420
            # No currently valid tokens were found
 
2421
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
2422
                             .format(duration))
 
2423
    # End token found
 
2424
    return value
1084
2425
 
1085
2426
 
1086
2427
def string_to_delta(interval):
1087
2428
    """Parse a string and return a datetime.timedelta
1088
2429
    
1089
 
    >>> string_to_delta(u'7d')
 
2430
    >>> string_to_delta('7d')
1090
2431
    datetime.timedelta(7)
1091
 
    >>> string_to_delta(u'60s')
 
2432
    >>> string_to_delta('60s')
1092
2433
    datetime.timedelta(0, 60)
1093
 
    >>> string_to_delta(u'60m')
 
2434
    >>> string_to_delta('60m')
1094
2435
    datetime.timedelta(0, 3600)
1095
 
    >>> string_to_delta(u'24h')
 
2436
    >>> string_to_delta('24h')
1096
2437
    datetime.timedelta(1)
1097
 
    >>> string_to_delta(u'1w')
 
2438
    >>> string_to_delta('1w')
1098
2439
    datetime.timedelta(7)
1099
 
    >>> string_to_delta(u'5m 30s')
 
2440
    >>> string_to_delta('5m 30s')
1100
2441
    datetime.timedelta(0, 330)
1101
2442
    """
 
2443
    
 
2444
    try:
 
2445
        return rfc3339_duration_to_delta(interval)
 
2446
    except ValueError:
 
2447
        pass
 
2448
    
1102
2449
    timevalue = datetime.timedelta(0)
1103
2450
    for s in interval.split():
1104
2451
        try:
1105
 
            suffix = unicode(s[-1])
 
2452
            suffix = s[-1]
1106
2453
            value = int(s[:-1])
1107
 
            if suffix == u"d":
 
2454
            if suffix == "d":
1108
2455
                delta = datetime.timedelta(value)
1109
 
            elif suffix == u"s":
 
2456
            elif suffix == "s":
1110
2457
                delta = datetime.timedelta(0, value)
1111
 
            elif suffix == u"m":
 
2458
            elif suffix == "m":
1112
2459
                delta = datetime.timedelta(0, 0, 0, 0, value)
1113
 
            elif suffix == u"h":
 
2460
            elif suffix == "h":
1114
2461
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1115
 
            elif suffix == u"w":
 
2462
            elif suffix == "w":
1116
2463
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1117
2464
            else:
1118
 
                raise ValueError
1119
 
        except (ValueError, IndexError):
1120
 
            raise ValueError
 
2465
                raise ValueError("Unknown suffix {!r}".format(suffix))
 
2466
        except IndexError as e:
 
2467
            raise ValueError(*(e.args))
1121
2468
        timevalue += delta
1122
2469
    return timevalue
1123
2470
 
1124
2471
 
1125
 
def if_nametoindex(interface):
1126
 
    """Call the C function if_nametoindex(), or equivalent
1127
 
    
1128
 
    Note: This function cannot accept a unicode string."""
1129
 
    global if_nametoindex
1130
 
    try:
1131
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1132
 
                          (ctypes.util.find_library(u"c"))
1133
 
                          .if_nametoindex)
1134
 
    except (OSError, AttributeError):
1135
 
        logger.warning(u"Doing if_nametoindex the hard way")
1136
 
        def if_nametoindex(interface):
1137
 
            "Get an interface index the hard way, i.e. using fcntl()"
1138
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1139
 
            with closing(socket.socket()) as s:
1140
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1141
 
                                    struct.pack(str(u"16s16x"),
1142
 
                                                interface))
1143
 
            interface_index = struct.unpack(str(u"I"),
1144
 
                                            ifreq[16:20])[0]
1145
 
            return interface_index
1146
 
    return if_nametoindex(interface)
1147
 
 
1148
 
 
1149
2472
def daemon(nochdir = False, noclose = False):
1150
2473
    """See daemon(3).  Standard BSD Unix function.
1151
2474
    
1154
2477
        sys.exit()
1155
2478
    os.setsid()
1156
2479
    if not nochdir:
1157
 
        os.chdir(u"/")
 
2480
        os.chdir("/")
1158
2481
    if os.fork():
1159
2482
        sys.exit()
1160
2483
    if not noclose:
1161
2484
        # Close all standard open file descriptors
1162
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2485
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1163
2486
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1164
2487
            raise OSError(errno.ENODEV,
1165
 
                          u"/dev/null not a character device")
 
2488
                          "{} not a character device"
 
2489
                          .format(os.devnull))
1166
2490
        os.dup2(null, sys.stdin.fileno())
1167
2491
        os.dup2(null, sys.stdout.fileno())
1168
2492
        os.dup2(null, sys.stderr.fileno())
1172
2496
 
1173
2497
def main():
1174
2498
    
1175
 
    ######################################################################
 
2499
    ##################################################################
1176
2500
    # Parsing of options, both command line and config file
1177
2501
    
1178
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1179
 
    parser.add_option("-i", u"--interface", type=u"string",
1180
 
                      metavar="IF", help=u"Bind to interface IF")
1181
 
    parser.add_option("-a", u"--address", type=u"string",
1182
 
                      help=u"Address to listen for requests on")
1183
 
    parser.add_option("-p", u"--port", type=u"int",
1184
 
                      help=u"Port number to receive requests on")
1185
 
    parser.add_option("--check", action=u"store_true",
1186
 
                      help=u"Run self-test")
1187
 
    parser.add_option("--debug", action=u"store_true",
1188
 
                      help=u"Debug mode; run in foreground and log to"
1189
 
                      u" terminal")
1190
 
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1191
 
                      u" priority string (see GnuTLS documentation)")
1192
 
    parser.add_option("--servicename", type=u"string",
1193
 
                      metavar=u"NAME", help=u"Zeroconf service name")
1194
 
    parser.add_option("--configdir", type=u"string",
1195
 
                      default=u"/etc/mandos", metavar=u"DIR",
1196
 
                      help=u"Directory to search for configuration"
1197
 
                      u" files")
1198
 
    parser.add_option("--no-dbus", action=u"store_false",
1199
 
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
1200
 
                      u" system bus interface")
1201
 
    parser.add_option("--no-ipv6", action=u"store_false",
1202
 
                      dest=u"use_ipv6", help=u"Do not use IPv6")
1203
 
    options = parser.parse_args()[0]
 
2502
    parser = argparse.ArgumentParser()
 
2503
    parser.add_argument("-v", "--version", action="version",
 
2504
                        version = "%(prog)s {}".format(version),
 
2505
                        help="show version number and exit")
 
2506
    parser.add_argument("-i", "--interface", metavar="IF",
 
2507
                        help="Bind to interface IF")
 
2508
    parser.add_argument("-a", "--address",
 
2509
                        help="Address to listen for requests on")
 
2510
    parser.add_argument("-p", "--port", type=int,
 
2511
                        help="Port number to receive requests on")
 
2512
    parser.add_argument("--check", action="store_true",
 
2513
                        help="Run self-test")
 
2514
    parser.add_argument("--debug", action="store_true",
 
2515
                        help="Debug mode; run in foreground and log"
 
2516
                        " to terminal", default=None)
 
2517
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
2518
                        help="Debug level for stdout output")
 
2519
    parser.add_argument("--priority", help="GnuTLS"
 
2520
                        " priority string (see GnuTLS documentation)")
 
2521
    parser.add_argument("--servicename",
 
2522
                        metavar="NAME", help="Zeroconf service name")
 
2523
    parser.add_argument("--configdir",
 
2524
                        default="/etc/mandos", metavar="DIR",
 
2525
                        help="Directory to search for configuration"
 
2526
                        " files")
 
2527
    parser.add_argument("--no-dbus", action="store_false",
 
2528
                        dest="use_dbus", help="Do not provide D-Bus"
 
2529
                        " system bus interface", default=None)
 
2530
    parser.add_argument("--no-ipv6", action="store_false",
 
2531
                        dest="use_ipv6", help="Do not use IPv6",
 
2532
                        default=None)
 
2533
    parser.add_argument("--no-restore", action="store_false",
 
2534
                        dest="restore", help="Do not restore stored"
 
2535
                        " state", default=None)
 
2536
    parser.add_argument("--socket", type=int,
 
2537
                        help="Specify a file descriptor to a network"
 
2538
                        " socket to use instead of creating one")
 
2539
    parser.add_argument("--statedir", metavar="DIR",
 
2540
                        help="Directory to save/restore state in")
 
2541
    parser.add_argument("--foreground", action="store_true",
 
2542
                        help="Run in foreground", default=None)
 
2543
    parser.add_argument("--no-zeroconf", action="store_false",
 
2544
                        dest="zeroconf", help="Do not use Zeroconf",
 
2545
                        default=None)
 
2546
    
 
2547
    options = parser.parse_args()
1204
2548
    
1205
2549
    if options.check:
1206
2550
        import doctest
1207
 
        doctest.testmod()
1208
 
        sys.exit()
 
2551
        fail_count, test_count = doctest.testmod()
 
2552
        sys.exit(os.EX_OK if fail_count == 0 else 1)
1209
2553
    
1210
2554
    # Default values for config file for server-global settings
1211
 
    server_defaults = { u"interface": u"",
1212
 
                        u"address": u"",
1213
 
                        u"port": u"",
1214
 
                        u"debug": u"False",
1215
 
                        u"priority":
1216
 
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1217
 
                        u"servicename": u"Mandos",
1218
 
                        u"use_dbus": u"True",
1219
 
                        u"use_ipv6": u"True",
1220
 
                        }
 
2555
    server_defaults = { "interface": "",
 
2556
                        "address": "",
 
2557
                        "port": "",
 
2558
                        "debug": "False",
 
2559
                        "priority":
 
2560
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
 
2561
                        ":+SIGN-DSA-SHA256",
 
2562
                        "servicename": "Mandos",
 
2563
                        "use_dbus": "True",
 
2564
                        "use_ipv6": "True",
 
2565
                        "debuglevel": "",
 
2566
                        "restore": "True",
 
2567
                        "socket": "",
 
2568
                        "statedir": "/var/lib/mandos",
 
2569
                        "foreground": "False",
 
2570
                        "zeroconf": "True",
 
2571
                    }
1221
2572
    
1222
2573
    # Parse config file for server-global settings
1223
2574
    server_config = configparser.SafeConfigParser(server_defaults)
1224
2575
    del server_defaults
1225
 
    server_config.read(os.path.join(options.configdir,
1226
 
                                    u"mandos.conf"))
 
2576
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
1227
2577
    # Convert the SafeConfigParser object to a dict
1228
2578
    server_settings = server_config.defaults()
1229
2579
    # Use the appropriate methods on the non-string config options
1230
 
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
1231
 
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
2580
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
2581
        server_settings[option] = server_config.getboolean("DEFAULT",
1232
2582
                                                           option)
1233
2583
    if server_settings["port"]:
1234
 
        server_settings["port"] = server_config.getint(u"DEFAULT",
1235
 
                                                       u"port")
 
2584
        server_settings["port"] = server_config.getint("DEFAULT",
 
2585
                                                       "port")
 
2586
    if server_settings["socket"]:
 
2587
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2588
                                                         "socket")
 
2589
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2590
        # over with an opened os.devnull.  But we don't want this to
 
2591
        # happen with a supplied network socket.
 
2592
        if 0 <= server_settings["socket"] <= 2:
 
2593
            server_settings["socket"] = os.dup(server_settings
 
2594
                                               ["socket"])
1236
2595
    del server_config
1237
2596
    
1238
2597
    # Override the settings from the config file with command line
1239
2598
    # options, if set.
1240
 
    for option in (u"interface", u"address", u"port", u"debug",
1241
 
                   u"priority", u"servicename", u"configdir",
1242
 
                   u"use_dbus", u"use_ipv6"):
 
2599
    for option in ("interface", "address", "port", "debug",
 
2600
                   "priority", "servicename", "configdir", "use_dbus",
 
2601
                   "use_ipv6", "debuglevel", "restore", "statedir",
 
2602
                   "socket", "foreground", "zeroconf"):
1243
2603
        value = getattr(options, option)
1244
2604
        if value is not None:
1245
2605
            server_settings[option] = value
1246
2606
    del options
1247
2607
    # Force all strings to be unicode
1248
2608
    for option in server_settings.keys():
1249
 
        if type(server_settings[option]) is str:
1250
 
            server_settings[option] = unicode(server_settings[option])
 
2609
        if isinstance(server_settings[option], bytes):
 
2610
            server_settings[option] = (server_settings[option]
 
2611
                                       .decode("utf-8"))
 
2612
    # Force all boolean options to be boolean
 
2613
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2614
                   "foreground", "zeroconf"):
 
2615
        server_settings[option] = bool(server_settings[option])
 
2616
    # Debug implies foreground
 
2617
    if server_settings["debug"]:
 
2618
        server_settings["foreground"] = True
1251
2619
    # Now we have our good server settings in "server_settings"
1252
2620
    
1253
2621
    ##################################################################
1254
2622
    
 
2623
    if (not server_settings["zeroconf"]
 
2624
        and not (server_settings["port"]
 
2625
                 or server_settings["socket"] != "")):
 
2626
        parser.error("Needs port or socket to work without Zeroconf")
 
2627
    
1255
2628
    # For convenience
1256
 
    debug = server_settings[u"debug"]
1257
 
    use_dbus = server_settings[u"use_dbus"]
1258
 
    use_ipv6 = server_settings[u"use_ipv6"]
1259
 
    
1260
 
    if not debug:
1261
 
        syslogger.setLevel(logging.WARNING)
1262
 
        console.setLevel(logging.WARNING)
1263
 
    
1264
 
    if server_settings[u"servicename"] != u"Mandos":
1265
 
        syslogger.setFormatter(logging.Formatter
1266
 
                               (u'Mandos (%s) [%%(process)d]:'
1267
 
                                u' %%(levelname)s: %%(message)s'
1268
 
                                % server_settings[u"servicename"]))
 
2629
    debug = server_settings["debug"]
 
2630
    debuglevel = server_settings["debuglevel"]
 
2631
    use_dbus = server_settings["use_dbus"]
 
2632
    use_ipv6 = server_settings["use_ipv6"]
 
2633
    stored_state_path = os.path.join(server_settings["statedir"],
 
2634
                                     stored_state_file)
 
2635
    foreground = server_settings["foreground"]
 
2636
    zeroconf = server_settings["zeroconf"]
 
2637
    
 
2638
    if debug:
 
2639
        initlogger(debug, logging.DEBUG)
 
2640
    else:
 
2641
        if not debuglevel:
 
2642
            initlogger(debug)
 
2643
        else:
 
2644
            level = getattr(logging, debuglevel.upper())
 
2645
            initlogger(debug, level)
 
2646
    
 
2647
    if server_settings["servicename"] != "Mandos":
 
2648
        syslogger.setFormatter(
 
2649
            logging.Formatter('Mandos ({}) [%(process)d]:'
 
2650
                              ' %(levelname)s: %(message)s'.format(
 
2651
                                  server_settings["servicename"])))
1269
2652
    
1270
2653
    # Parse config file with clients
1271
 
    client_defaults = { u"timeout": u"1h",
1272
 
                        u"interval": u"5m",
1273
 
                        u"checker": u"fping -q -- %%(host)s",
1274
 
                        u"host": u"",
1275
 
                        }
1276
 
    client_config = configparser.SafeConfigParser(client_defaults)
1277
 
    client_config.read(os.path.join(server_settings[u"configdir"],
1278
 
                                    u"clients.conf"))
 
2654
    client_config = configparser.SafeConfigParser(Client
 
2655
                                                  .client_defaults)
 
2656
    client_config.read(os.path.join(server_settings["configdir"],
 
2657
                                    "clients.conf"))
1279
2658
    
1280
2659
    global mandos_dbus_service
1281
2660
    mandos_dbus_service = None
1282
2661
    
1283
 
    tcp_server = MandosServer((server_settings[u"address"],
1284
 
                               server_settings[u"port"]),
1285
 
                              ClientHandler,
1286
 
                              interface=server_settings[u"interface"],
1287
 
                              use_ipv6=use_ipv6,
1288
 
                              gnutls_priority=
1289
 
                              server_settings[u"priority"],
1290
 
                              use_dbus=use_dbus)
1291
 
    pidfilename = u"/var/run/mandos.pid"
1292
 
    try:
1293
 
        pidfile = open(pidfilename, u"w")
1294
 
    except IOError:
1295
 
        logger.error(u"Could not open file %r", pidfilename)
 
2662
    socketfd = None
 
2663
    if server_settings["socket"] != "":
 
2664
        socketfd = server_settings["socket"]
 
2665
    tcp_server = MandosServer(
 
2666
        (server_settings["address"], server_settings["port"]),
 
2667
        ClientHandler,
 
2668
        interface=(server_settings["interface"] or None),
 
2669
        use_ipv6=use_ipv6,
 
2670
        gnutls_priority=server_settings["priority"],
 
2671
        use_dbus=use_dbus,
 
2672
        socketfd=socketfd)
 
2673
    if not foreground:
 
2674
        pidfilename = "/run/mandos.pid"
 
2675
        if not os.path.isdir("/run/."):
 
2676
            pidfilename = "/var/run/mandos.pid"
 
2677
        pidfile = None
 
2678
        try:
 
2679
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
 
2680
        except IOError as e:
 
2681
            logger.error("Could not open file %r", pidfilename,
 
2682
                         exc_info=e)
1296
2683
    
1297
 
    try:
1298
 
        uid = pwd.getpwnam(u"_mandos").pw_uid
1299
 
        gid = pwd.getpwnam(u"_mandos").pw_gid
1300
 
    except KeyError:
 
2684
    for name in ("_mandos", "mandos", "nobody"):
1301
2685
        try:
1302
 
            uid = pwd.getpwnam(u"mandos").pw_uid
1303
 
            gid = pwd.getpwnam(u"mandos").pw_gid
 
2686
            uid = pwd.getpwnam(name).pw_uid
 
2687
            gid = pwd.getpwnam(name).pw_gid
 
2688
            break
1304
2689
        except KeyError:
1305
 
            try:
1306
 
                uid = pwd.getpwnam(u"nobody").pw_uid
1307
 
                gid = pwd.getpwnam(u"nobody").pw_gid
1308
 
            except KeyError:
1309
 
                uid = 65534
1310
 
                gid = 65534
 
2690
            continue
 
2691
    else:
 
2692
        uid = 65534
 
2693
        gid = 65534
1311
2694
    try:
1312
2695
        os.setgid(gid)
1313
2696
        os.setuid(uid)
1314
 
    except OSError, error:
1315
 
        if error[0] != errno.EPERM:
1316
 
            raise error
 
2697
    except OSError as error:
 
2698
        if error.errno != errno.EPERM:
 
2699
            raise
1317
2700
    
1318
 
    # Enable all possible GnuTLS debugging
1319
2701
    if debug:
 
2702
        # Enable all possible GnuTLS debugging
 
2703
        
1320
2704
        # "Use a log level over 10 to enable all debugging options."
1321
2705
        # - GnuTLS manual
1322
2706
        gnutls.library.functions.gnutls_global_set_log_level(11)
1323
2707
        
1324
2708
        @gnutls.library.types.gnutls_log_func
1325
2709
        def debug_gnutls(level, string):
1326
 
            logger.debug(u"GnuTLS: %s", string[:-1])
1327
 
        
1328
 
        (gnutls.library.functions
1329
 
         .gnutls_global_set_log_function(debug_gnutls))
 
2710
            logger.debug("GnuTLS: %s", string[:-1])
 
2711
        
 
2712
        gnutls.library.functions.gnutls_global_set_log_function(
 
2713
            debug_gnutls)
 
2714
        
 
2715
        # Redirect stdin so all checkers get /dev/null
 
2716
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2717
        os.dup2(null, sys.stdin.fileno())
 
2718
        if null > 2:
 
2719
            os.close(null)
 
2720
    
 
2721
    # Need to fork before connecting to D-Bus
 
2722
    if not foreground:
 
2723
        # Close all input and output, do double fork, etc.
 
2724
        daemon()
 
2725
    
 
2726
    # multiprocessing will use threads, so before we use gobject we
 
2727
    # need to inform gobject that threads will be used.
 
2728
    gobject.threads_init()
1330
2729
    
1331
2730
    global main_loop
1332
2731
    # From the Avahi example code
1333
 
    DBusGMainLoop(set_as_default=True )
 
2732
    DBusGMainLoop(set_as_default=True)
1334
2733
    main_loop = gobject.MainLoop()
1335
2734
    bus = dbus.SystemBus()
1336
2735
    # End of Avahi example code
1337
2736
    if use_dbus:
1338
 
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1339
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1340
 
    service = AvahiService(name = server_settings[u"servicename"],
1341
 
                           servicetype = u"_mandos._tcp",
1342
 
                           protocol = protocol, bus = bus)
1343
 
    if server_settings["interface"]:
1344
 
        service.interface = (if_nametoindex
1345
 
                             (str(server_settings[u"interface"])))
 
2737
        try:
 
2738
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
2739
                                            bus,
 
2740
                                            do_not_queue=True)
 
2741
            old_bus_name = dbus.service.BusName(
 
2742
                "se.bsnet.fukt.Mandos", bus,
 
2743
                do_not_queue=True)
 
2744
        except dbus.exceptions.DBusException as e:
 
2745
            logger.error("Disabling D-Bus:", exc_info=e)
 
2746
            use_dbus = False
 
2747
            server_settings["use_dbus"] = False
 
2748
            tcp_server.use_dbus = False
 
2749
    if zeroconf:
 
2750
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2751
        service = AvahiServiceToSyslog(
 
2752
            name = server_settings["servicename"],
 
2753
            servicetype = "_mandos._tcp",
 
2754
            protocol = protocol,
 
2755
            bus = bus)
 
2756
        if server_settings["interface"]:
 
2757
            service.interface = if_nametoindex(
 
2758
                server_settings["interface"].encode("utf-8"))
 
2759
    
 
2760
    global multiprocessing_manager
 
2761
    multiprocessing_manager = multiprocessing.Manager()
1346
2762
    
1347
2763
    client_class = Client
1348
2764
    if use_dbus:
1349
2765
        client_class = functools.partial(ClientDBus, bus = bus)
1350
 
    tcp_server.clients.update(set(
1351
 
            client_class(name = section,
1352
 
                         config= dict(client_config.items(section)))
1353
 
            for section in client_config.sections()))
 
2766
    
 
2767
    client_settings = Client.config_parser(client_config)
 
2768
    old_client_settings = {}
 
2769
    clients_data = {}
 
2770
    
 
2771
    # This is used to redirect stdout and stderr for checker processes
 
2772
    global wnull
 
2773
    wnull = open(os.devnull, "w") # A writable /dev/null
 
2774
    # Only used if server is running in foreground but not in debug
 
2775
    # mode
 
2776
    if debug or not foreground:
 
2777
        wnull.close()
 
2778
    
 
2779
    # Get client data and settings from last running state.
 
2780
    if server_settings["restore"]:
 
2781
        try:
 
2782
            with open(stored_state_path, "rb") as stored_state:
 
2783
                clients_data, old_client_settings = pickle.load(
 
2784
                    stored_state)
 
2785
            os.remove(stored_state_path)
 
2786
        except IOError as e:
 
2787
            if e.errno == errno.ENOENT:
 
2788
                logger.warning("Could not load persistent state:"
 
2789
                               " {}".format(os.strerror(e.errno)))
 
2790
            else:
 
2791
                logger.critical("Could not load persistent state:",
 
2792
                                exc_info=e)
 
2793
                raise
 
2794
        except EOFError as e:
 
2795
            logger.warning("Could not load persistent state: "
 
2796
                           "EOFError:",
 
2797
                           exc_info=e)
 
2798
    
 
2799
    with PGPEngine() as pgp:
 
2800
        for client_name, client in clients_data.items():
 
2801
            # Skip removed clients
 
2802
            if client_name not in client_settings:
 
2803
                continue
 
2804
            
 
2805
            # Decide which value to use after restoring saved state.
 
2806
            # We have three different values: Old config file,
 
2807
            # new config file, and saved state.
 
2808
            # New config value takes precedence if it differs from old
 
2809
            # config value, otherwise use saved state.
 
2810
            for name, value in client_settings[client_name].items():
 
2811
                try:
 
2812
                    # For each value in new config, check if it
 
2813
                    # differs from the old config value (Except for
 
2814
                    # the "secret" attribute)
 
2815
                    if (name != "secret"
 
2816
                        and (value !=
 
2817
                             old_client_settings[client_name][name])):
 
2818
                        client[name] = value
 
2819
                except KeyError:
 
2820
                    pass
 
2821
            
 
2822
            # Clients who has passed its expire date can still be
 
2823
            # enabled if its last checker was successful.  A Client
 
2824
            # whose checker succeeded before we stored its state is
 
2825
            # assumed to have successfully run all checkers during
 
2826
            # downtime.
 
2827
            if client["enabled"]:
 
2828
                if datetime.datetime.utcnow() >= client["expires"]:
 
2829
                    if not client["last_checked_ok"]:
 
2830
                        logger.warning(
 
2831
                            "disabling client {} - Client never "
 
2832
                            "performed a successful checker".format(
 
2833
                                client_name))
 
2834
                        client["enabled"] = False
 
2835
                    elif client["last_checker_status"] != 0:
 
2836
                        logger.warning(
 
2837
                            "disabling client {} - Client last"
 
2838
                            " checker failed with error code"
 
2839
                            " {}".format(
 
2840
                                client_name,
 
2841
                                client["last_checker_status"]))
 
2842
                        client["enabled"] = False
 
2843
                    else:
 
2844
                        client["expires"] = (
 
2845
                            datetime.datetime.utcnow()
 
2846
                            + client["timeout"])
 
2847
                        logger.debug("Last checker succeeded,"
 
2848
                                     " keeping {} enabled".format(
 
2849
                                         client_name))
 
2850
            try:
 
2851
                client["secret"] = pgp.decrypt(
 
2852
                    client["encrypted_secret"],
 
2853
                    client_settings[client_name]["secret"])
 
2854
            except PGPError:
 
2855
                # If decryption fails, we use secret from new settings
 
2856
                logger.debug("Failed to decrypt {} old secret".format(
 
2857
                    client_name))
 
2858
                client["secret"] = (client_settings[client_name]
 
2859
                                    ["secret"])
 
2860
    
 
2861
    # Add/remove clients based on new changes made to config
 
2862
    for client_name in (set(old_client_settings)
 
2863
                        - set(client_settings)):
 
2864
        del clients_data[client_name]
 
2865
    for client_name in (set(client_settings)
 
2866
                        - set(old_client_settings)):
 
2867
        clients_data[client_name] = client_settings[client_name]
 
2868
    
 
2869
    # Create all client objects
 
2870
    for client_name, client in clients_data.items():
 
2871
        tcp_server.clients[client_name] = client_class(
 
2872
            name = client_name,
 
2873
            settings = client,
 
2874
            server_settings = server_settings)
 
2875
    
1354
2876
    if not tcp_server.clients:
1355
 
        logger.warning(u"No clients defined")
1356
 
    
1357
 
    if debug:
1358
 
        # Redirect stdin so all checkers get /dev/null
1359
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1360
 
        os.dup2(null, sys.stdin.fileno())
1361
 
        if null > 2:
1362
 
            os.close(null)
1363
 
    else:
1364
 
        # No console logging
1365
 
        logger.removeHandler(console)
1366
 
        # Close all input and output, do double fork, etc.
1367
 
        daemon()
1368
 
    
1369
 
    try:
1370
 
        with closing(pidfile):
 
2877
        logger.warning("No clients defined")
 
2878
    
 
2879
    if not foreground:
 
2880
        if pidfile is not None:
1371
2881
            pid = os.getpid()
1372
 
            pidfile.write(str(pid) + "\n")
 
2882
            try:
 
2883
                with pidfile:
 
2884
                    print(pid, file=pidfile)
 
2885
            except IOError:
 
2886
                logger.error("Could not write to file %r with PID %d",
 
2887
                             pidfilename, pid)
1373
2888
        del pidfile
1374
 
    except IOError:
1375
 
        logger.error(u"Could not write to file %r with PID %d",
1376
 
                     pidfilename, pid)
1377
 
    except NameError:
1378
 
        # "pidfile" was never created
1379
 
        pass
1380
 
    del pidfilename
1381
 
    
1382
 
    def cleanup():
1383
 
        "Cleanup function; run on exit"
1384
 
        service.cleanup()
1385
 
        
1386
 
        while tcp_server.clients:
1387
 
            client = tcp_server.clients.pop()
1388
 
            client.disable_hook = None
1389
 
            client.disable()
1390
 
    
1391
 
    atexit.register(cleanup)
1392
 
    
1393
 
    if not debug:
1394
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
2889
        del pidfilename
 
2890
    
1395
2891
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1396
2892
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1397
2893
    
1398
2894
    if use_dbus:
1399
 
        class MandosDBusService(dbus.service.Object):
 
2895
        
 
2896
        @alternate_dbus_interfaces(
 
2897
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
 
2898
        class MandosDBusService(DBusObjectWithObjectManager):
1400
2899
            """A D-Bus proxy object"""
 
2900
            
1401
2901
            def __init__(self):
1402
 
                dbus.service.Object.__init__(self, bus, u"/")
1403
 
            _interface = u"se.bsnet.fukt.Mandos"
1404
 
            
1405
 
            @dbus.service.signal(_interface, signature=u"oa{sv}")
1406
 
            def ClientAdded(self, objpath, properties):
1407
 
                "D-Bus signal"
1408
 
                pass
1409
 
            
1410
 
            @dbus.service.signal(_interface, signature=u"s")
1411
 
            def ClientNotFound(self, fingerprint):
1412
 
                "D-Bus signal"
1413
 
                pass
1414
 
            
1415
 
            @dbus.service.signal(_interface, signature=u"os")
 
2902
                dbus.service.Object.__init__(self, bus, "/")
 
2903
            
 
2904
            _interface = "se.recompile.Mandos"
 
2905
            
 
2906
            @dbus.service.signal(_interface, signature="o")
 
2907
            def ClientAdded(self, objpath):
 
2908
                "D-Bus signal"
 
2909
                pass
 
2910
            
 
2911
            @dbus.service.signal(_interface, signature="ss")
 
2912
            def ClientNotFound(self, fingerprint, address):
 
2913
                "D-Bus signal"
 
2914
                pass
 
2915
            
 
2916
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
2917
                               "true"})
 
2918
            @dbus.service.signal(_interface, signature="os")
1416
2919
            def ClientRemoved(self, objpath, name):
1417
2920
                "D-Bus signal"
1418
2921
                pass
1419
2922
            
1420
 
            @dbus.service.method(_interface, out_signature=u"ao")
 
2923
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
2924
                               "true"})
 
2925
            @dbus.service.method(_interface, out_signature="ao")
1421
2926
            def GetAllClients(self):
1422
2927
                "D-Bus method"
1423
 
                return dbus.Array(c.dbus_object_path
1424
 
                                  for c in tcp_server.clients)
 
2928
                return dbus.Array(c.dbus_object_path for c in
 
2929
                                  tcp_server.clients.itervalues())
1425
2930
            
 
2931
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
2932
                               "true"})
1426
2933
            @dbus.service.method(_interface,
1427
 
                                 out_signature=u"a{oa{sv}}")
 
2934
                                 out_signature="a{oa{sv}}")
1428
2935
            def GetAllClientsWithProperties(self):
1429
2936
                "D-Bus method"
1430
2937
                return dbus.Dictionary(
1431
 
                    ((c.dbus_object_path, c.GetAllProperties())
1432
 
                     for c in tcp_server.clients),
1433
 
                    signature=u"oa{sv}")
 
2938
                    { c.dbus_object_path: c.GetAll(
 
2939
                        "se.recompile.Mandos.Client")
 
2940
                      for c in tcp_server.clients.itervalues() },
 
2941
                    signature="oa{sv}")
1434
2942
            
1435
 
            @dbus.service.method(_interface, in_signature=u"o")
 
2943
            @dbus.service.method(_interface, in_signature="o")
1436
2944
            def RemoveClient(self, object_path):
1437
2945
                "D-Bus method"
1438
 
                for c in tcp_server.clients:
 
2946
                for c in tcp_server.clients.itervalues():
1439
2947
                    if c.dbus_object_path == object_path:
1440
 
                        tcp_server.clients.remove(c)
 
2948
                        del tcp_server.clients[c.name]
1441
2949
                        c.remove_from_connection()
1442
 
                        # Don't signal anything except ClientRemoved
1443
 
                        c.disable(signal=False)
1444
 
                        # Emit D-Bus signal
1445
 
                        self.ClientRemoved(object_path, c.name)
 
2950
                        # Don't signal the disabling
 
2951
                        c.disable(quiet=True)
 
2952
                        # Emit D-Bus signal for removal
 
2953
                        self.client_removed_signal(c)
1446
2954
                        return
1447
 
                raise KeyError
 
2955
                raise KeyError(object_path)
1448
2956
            
1449
2957
            del _interface
 
2958
            
 
2959
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
2960
                                 out_signature = "a{oa{sa{sv}}}")
 
2961
            def GetManagedObjects(self):
 
2962
                """D-Bus method"""
 
2963
                return dbus.Dictionary(
 
2964
                    { client.dbus_object_path:
 
2965
                      dbus.Dictionary(
 
2966
                          { interface: client.GetAll(interface)
 
2967
                            for interface in
 
2968
                                 client._get_all_interface_names()})
 
2969
                      for client in tcp_server.clients.values()})
 
2970
            
 
2971
            def client_added_signal(self, client):
 
2972
                """Send the new standard signal and the old signal"""
 
2973
                if use_dbus:
 
2974
                    # New standard signal
 
2975
                    self.InterfacesAdded(
 
2976
                        client.dbus_object_path,
 
2977
                        dbus.Dictionary(
 
2978
                            { interface: client.GetAll(interface)
 
2979
                              for interface in
 
2980
                              client._get_all_interface_names()}))
 
2981
                    # Old signal
 
2982
                    self.ClientAdded(client.dbus_object_path)
 
2983
            
 
2984
            def client_removed_signal(self, client):
 
2985
                """Send the new standard signal and the old signal"""
 
2986
                if use_dbus:
 
2987
                    # New standard signal
 
2988
                    self.InterfacesRemoved(
 
2989
                        client.dbus_object_path,
 
2990
                        client._get_all_interface_names())
 
2991
                    # Old signal
 
2992
                    self.ClientRemoved(client.dbus_object_path,
 
2993
                                       client.name)
1450
2994
        
1451
2995
        mandos_dbus_service = MandosDBusService()
1452
2996
    
1453
 
    for client in tcp_server.clients:
 
2997
    def cleanup():
 
2998
        "Cleanup function; run on exit"
 
2999
        if zeroconf:
 
3000
            service.cleanup()
 
3001
        
 
3002
        multiprocessing.active_children()
 
3003
        wnull.close()
 
3004
        if not (tcp_server.clients or client_settings):
 
3005
            return
 
3006
        
 
3007
        # Store client before exiting. Secrets are encrypted with key
 
3008
        # based on what config file has. If config file is
 
3009
        # removed/edited, old secret will thus be unrecovable.
 
3010
        clients = {}
 
3011
        with PGPEngine() as pgp:
 
3012
            for client in tcp_server.clients.itervalues():
 
3013
                key = client_settings[client.name]["secret"]
 
3014
                client.encrypted_secret = pgp.encrypt(client.secret,
 
3015
                                                      key)
 
3016
                client_dict = {}
 
3017
                
 
3018
                # A list of attributes that can not be pickled
 
3019
                # + secret.
 
3020
                exclude = { "bus", "changedstate", "secret",
 
3021
                            "checker", "server_settings" }
 
3022
                for name, typ in inspect.getmembers(dbus.service
 
3023
                                                    .Object):
 
3024
                    exclude.add(name)
 
3025
                
 
3026
                client_dict["encrypted_secret"] = (client
 
3027
                                                   .encrypted_secret)
 
3028
                for attr in client.client_structure:
 
3029
                    if attr not in exclude:
 
3030
                        client_dict[attr] = getattr(client, attr)
 
3031
                
 
3032
                clients[client.name] = client_dict
 
3033
                del client_settings[client.name]["secret"]
 
3034
        
 
3035
        try:
 
3036
            with tempfile.NamedTemporaryFile(
 
3037
                    mode='wb',
 
3038
                    suffix=".pickle",
 
3039
                    prefix='clients-',
 
3040
                    dir=os.path.dirname(stored_state_path),
 
3041
                    delete=False) as stored_state:
 
3042
                pickle.dump((clients, client_settings), stored_state)
 
3043
                tempname = stored_state.name
 
3044
            os.rename(tempname, stored_state_path)
 
3045
        except (IOError, OSError) as e:
 
3046
            if not debug:
 
3047
                try:
 
3048
                    os.remove(tempname)
 
3049
                except NameError:
 
3050
                    pass
 
3051
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
3052
                logger.warning("Could not save persistent state: {}"
 
3053
                               .format(os.strerror(e.errno)))
 
3054
            else:
 
3055
                logger.warning("Could not save persistent state:",
 
3056
                               exc_info=e)
 
3057
                raise
 
3058
        
 
3059
        # Delete all clients, and settings from config
 
3060
        while tcp_server.clients:
 
3061
            name, client = tcp_server.clients.popitem()
 
3062
            if use_dbus:
 
3063
                client.remove_from_connection()
 
3064
            # Don't signal the disabling
 
3065
            client.disable(quiet=True)
 
3066
            # Emit D-Bus signal for removal
 
3067
            mandos_dbus_service.client_removed_signal(client)
 
3068
        client_settings.clear()
 
3069
    
 
3070
    atexit.register(cleanup)
 
3071
    
 
3072
    for client in tcp_server.clients.itervalues():
1454
3073
        if use_dbus:
1455
 
            # Emit D-Bus signal
1456
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path,
1457
 
                                            client.GetAllProperties())
1458
 
        client.enable()
 
3074
            # Emit D-Bus signal for adding
 
3075
            mandos_dbus_service.client_added_signal(client)
 
3076
        # Need to initiate checking of clients
 
3077
        if client.enabled:
 
3078
            client.init_checker()
1459
3079
    
1460
3080
    tcp_server.enable()
1461
3081
    tcp_server.server_activate()
1462
3082
    
1463
3083
    # Find out what port we got
1464
 
    service.port = tcp_server.socket.getsockname()[1]
 
3084
    if zeroconf:
 
3085
        service.port = tcp_server.socket.getsockname()[1]
1465
3086
    if use_ipv6:
1466
 
        logger.info(u"Now listening on address %r, port %d,"
1467
 
                    " flowinfo %d, scope_id %d"
1468
 
                    % tcp_server.socket.getsockname())
 
3087
        logger.info("Now listening on address %r, port %d,"
 
3088
                    " flowinfo %d, scope_id %d",
 
3089
                    *tcp_server.socket.getsockname())
1469
3090
    else:                       # IPv4
1470
 
        logger.info(u"Now listening on address %r, port %d"
1471
 
                    % tcp_server.socket.getsockname())
 
3091
        logger.info("Now listening on address %r, port %d",
 
3092
                    *tcp_server.socket.getsockname())
1472
3093
    
1473
3094
    #service.interface = tcp_server.socket.getsockname()[3]
1474
3095
    
1475
3096
    try:
1476
 
        # From the Avahi example code
1477
 
        try:
1478
 
            service.activate()
1479
 
        except dbus.exceptions.DBusException, error:
1480
 
            logger.critical(u"DBusException: %s", error)
1481
 
            sys.exit(1)
1482
 
        # End of Avahi example code
 
3097
        if zeroconf:
 
3098
            # From the Avahi example code
 
3099
            try:
 
3100
                service.activate()
 
3101
            except dbus.exceptions.DBusException as error:
 
3102
                logger.critical("D-Bus Exception", exc_info=error)
 
3103
                cleanup()
 
3104
                sys.exit(1)
 
3105
            # End of Avahi example code
1483
3106
        
1484
3107
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1485
3108
                             lambda *args, **kwargs:
1486
3109
                             (tcp_server.handle_request
1487
3110
                              (*args[2:], **kwargs) or True))
1488
3111
        
1489
 
        logger.debug(u"Starting main loop")
 
3112
        logger.debug("Starting main loop")
1490
3113
        main_loop.run()
1491
 
    except AvahiError, error:
1492
 
        logger.critical(u"AvahiError: %s", error)
 
3114
    except AvahiError as error:
 
3115
        logger.critical("Avahi Error", exc_info=error)
 
3116
        cleanup()
1493
3117
        sys.exit(1)
1494
3118
    except KeyboardInterrupt:
1495
3119
        if debug:
1496
 
            print >> sys.stderr
1497
 
        logger.debug(u"Server received KeyboardInterrupt")
1498
 
    logger.debug(u"Server exiting")
 
3120
            print("", file=sys.stderr)
 
3121
        logger.debug("Server received KeyboardInterrupt")
 
3122
    logger.debug("Server exiting")
 
3123
    # Must run before the D-Bus bus name gets deregistered
 
3124
    cleanup()
 
3125
 
1499
3126
 
1500
3127
if __name__ == '__main__':
1501
3128
    main()