/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2016-06-03 17:23:10 UTC
  • Revision ID: teddy@recompile.se-20160603172310-ohavcfobfjb5v2hr
mandos: Bug fix: Only use the --no-use-agent option for GPG 1

* mandos (PGPEngine.__init__): Only use option "--no-use-agent" with
                               GPG 1, as GPG 2 does not support it.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008-2016 Teddy Hogeborn
 
15
# Copyright © 2008-2016 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
# 
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
# 
33
33
 
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
37
 
import SocketServer as socketserver
 
37
try:
 
38
    from future_builtins import *
 
39
except ImportError:
 
40
    pass
 
41
 
 
42
try:
 
43
    import SocketServer as socketserver
 
44
except ImportError:
 
45
    import socketserver
38
46
import socket
39
47
import argparse
40
48
import datetime
41
49
import errno
42
 
import gnutls.crypto
43
 
import gnutls.connection
44
 
import gnutls.errors
45
 
import gnutls.library.functions
46
 
import gnutls.library.constants
47
 
import gnutls.library.types
48
 
import ConfigParser as configparser
 
50
try:
 
51
    import ConfigParser as configparser
 
52
except ImportError:
 
53
    import configparser
49
54
import sys
50
55
import re
51
56
import os
60
65
import struct
61
66
import fcntl
62
67
import functools
63
 
import cPickle as pickle
 
68
try:
 
69
    import cPickle as pickle
 
70
except ImportError:
 
71
    import pickle
64
72
import multiprocessing
 
73
import types
 
74
import binascii
 
75
import tempfile
 
76
import itertools
 
77
import collections
 
78
import codecs
65
79
 
66
80
import dbus
67
81
import dbus.service
68
 
import gobject
69
 
import avahi
 
82
from gi.repository import GLib
70
83
from dbus.mainloop.glib import DBusGMainLoop
71
84
import ctypes
72
85
import ctypes.util
81
94
    except ImportError:
82
95
        SO_BINDTODEVICE = None
83
96
 
84
 
 
85
 
version = "1.3.0"
86
 
 
87
 
#logger = logging.getLogger('mandos')
88
 
logger = logging.Logger('mandos')
89
 
syslogger = (logging.handlers.SysLogHandler
90
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
 
              address = str("/dev/log")))
92
 
syslogger.setFormatter(logging.Formatter
93
 
                       ('Mandos [%(process)d]: %(levelname)s:'
94
 
                        ' %(message)s'))
95
 
logger.addHandler(syslogger)
96
 
 
97
 
console = logging.StreamHandler()
98
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
 
                                       ' %(levelname)s:'
100
 
                                       ' %(message)s'))
101
 
logger.addHandler(console)
 
97
if sys.version_info.major == 2:
 
98
    str = unicode
 
99
 
 
100
version = "1.7.7"
 
101
stored_state_file = "clients.pickle"
 
102
 
 
103
logger = logging.getLogger()
 
104
syslogger = None
 
105
 
 
106
try:
 
107
    if_nametoindex = ctypes.cdll.LoadLibrary(
 
108
        ctypes.util.find_library("c")).if_nametoindex
 
109
except (OSError, AttributeError):
 
110
    
 
111
    def if_nametoindex(interface):
 
112
        "Get an interface index the hard way, i.e. using fcntl()"
 
113
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
114
        with contextlib.closing(socket.socket()) as s:
 
115
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
116
                                struct.pack(b"16s16x", interface))
 
117
        interface_index = struct.unpack("I", ifreq[16:20])[0]
 
118
        return interface_index
 
119
 
 
120
 
 
121
def copy_function(func):
 
122
    """Make a copy of a function"""
 
123
    if sys.version_info.major == 2:
 
124
        return types.FunctionType(func.func_code,
 
125
                                  func.func_globals,
 
126
                                  func.func_name,
 
127
                                  func.func_defaults,
 
128
                                  func.func_closure)
 
129
    else:
 
130
        return types.FunctionType(func.__code__,
 
131
                                  func.__globals__,
 
132
                                  func.__name__,
 
133
                                  func.__defaults__,
 
134
                                  func.__closure__)
 
135
 
 
136
 
 
137
def initlogger(debug, level=logging.WARNING):
 
138
    """init logger and add loglevel"""
 
139
    
 
140
    global syslogger
 
141
    syslogger = (logging.handlers.SysLogHandler(
 
142
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
143
        address = "/dev/log"))
 
144
    syslogger.setFormatter(logging.Formatter
 
145
                           ('Mandos [%(process)d]: %(levelname)s:'
 
146
                            ' %(message)s'))
 
147
    logger.addHandler(syslogger)
 
148
    
 
149
    if debug:
 
150
        console = logging.StreamHandler()
 
151
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
152
                                               ' [%(process)d]:'
 
153
                                               ' %(levelname)s:'
 
154
                                               ' %(message)s'))
 
155
        logger.addHandler(console)
 
156
    logger.setLevel(level)
 
157
 
 
158
 
 
159
class PGPError(Exception):
 
160
    """Exception if encryption/decryption fails"""
 
161
    pass
 
162
 
 
163
 
 
164
class PGPEngine(object):
 
165
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
166
    
 
167
    def __init__(self):
 
168
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
169
        self.gpg = "gpg"
 
170
        try:
 
171
            output = subprocess.check_output(["gpgconf"])
 
172
            for line in output.splitlines():
 
173
                name, text, path = line.split(b":")
 
174
                if name == "gpg":
 
175
                    self.gpg = path
 
176
                    break
 
177
        except OSError as e:
 
178
            if e.errno != errno.ENOENT:
 
179
                raise
 
180
        self.gnupgargs = ['--batch',
 
181
                          '--homedir', self.tempdir,
 
182
                          '--force-mdc',
 
183
                          '--quiet']
 
184
        # Only GPG version 1 has the --no-use-agent option.
 
185
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
 
186
            self.gnupgargs.append("--no-use-agent")
 
187
    
 
188
    def __enter__(self):
 
189
        return self
 
190
    
 
191
    def __exit__(self, exc_type, exc_value, traceback):
 
192
        self._cleanup()
 
193
        return False
 
194
    
 
195
    def __del__(self):
 
196
        self._cleanup()
 
197
    
 
198
    def _cleanup(self):
 
199
        if self.tempdir is not None:
 
200
            # Delete contents of tempdir
 
201
            for root, dirs, files in os.walk(self.tempdir,
 
202
                                             topdown = False):
 
203
                for filename in files:
 
204
                    os.remove(os.path.join(root, filename))
 
205
                for dirname in dirs:
 
206
                    os.rmdir(os.path.join(root, dirname))
 
207
            # Remove tempdir
 
208
            os.rmdir(self.tempdir)
 
209
            self.tempdir = None
 
210
    
 
211
    def password_encode(self, password):
 
212
        # Passphrase can not be empty and can not contain newlines or
 
213
        # NUL bytes.  So we prefix it and hex encode it.
 
214
        encoded = b"mandos" + binascii.hexlify(password)
 
215
        if len(encoded) > 2048:
 
216
            # GnuPG can't handle long passwords, so encode differently
 
217
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
218
                       .replace(b"\n", b"\\n")
 
219
                       .replace(b"\0", b"\\x00"))
 
220
        return encoded
 
221
    
 
222
    def encrypt(self, data, password):
 
223
        passphrase = self.password_encode(password)
 
224
        with tempfile.NamedTemporaryFile(
 
225
                dir=self.tempdir) as passfile:
 
226
            passfile.write(passphrase)
 
227
            passfile.flush()
 
228
            proc = subprocess.Popen([self.gpg, '--symmetric',
 
229
                                     '--passphrase-file',
 
230
                                     passfile.name]
 
231
                                    + self.gnupgargs,
 
232
                                    stdin = subprocess.PIPE,
 
233
                                    stdout = subprocess.PIPE,
 
234
                                    stderr = subprocess.PIPE)
 
235
            ciphertext, err = proc.communicate(input = data)
 
236
        if proc.returncode != 0:
 
237
            raise PGPError(err)
 
238
        return ciphertext
 
239
    
 
240
    def decrypt(self, data, password):
 
241
        passphrase = self.password_encode(password)
 
242
        with tempfile.NamedTemporaryFile(
 
243
                dir = self.tempdir) as passfile:
 
244
            passfile.write(passphrase)
 
245
            passfile.flush()
 
246
            proc = subprocess.Popen([self.gpg, '--decrypt',
 
247
                                     '--passphrase-file',
 
248
                                     passfile.name]
 
249
                                    + self.gnupgargs,
 
250
                                    stdin = subprocess.PIPE,
 
251
                                    stdout = subprocess.PIPE,
 
252
                                    stderr = subprocess.PIPE)
 
253
            decrypted_plaintext, err = proc.communicate(input = data)
 
254
        if proc.returncode != 0:
 
255
            raise PGPError(err)
 
256
        return decrypted_plaintext
 
257
 
 
258
# Pretend that we have an Avahi module
 
259
class Avahi(object):
 
260
    """This isn't so much a class as it is a module-like namespace.
 
261
    It is instantiated once, and simulates having an Avahi module."""
 
262
    IF_UNSPEC = -1              # avahi-common/address.h
 
263
    PROTO_UNSPEC = -1           # avahi-common/address.h
 
264
    PROTO_INET = 0              # avahi-common/address.h
 
265
    PROTO_INET6 = 1             # avahi-common/address.h
 
266
    DBUS_NAME = "org.freedesktop.Avahi"
 
267
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
 
268
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
 
269
    DBUS_PATH_SERVER = "/"
 
270
    def string_array_to_txt_array(self, t):
 
271
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
 
272
                           for s in t), signature="ay")
 
273
    ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
 
274
    ENTRY_GROUP_COLLISION = 3   # avahi-common/defs.h
 
275
    ENTRY_GROUP_FAILURE = 4     # avahi-common/defs.h
 
276
    SERVER_INVALID = 0          # avahi-common/defs.h
 
277
    SERVER_REGISTERING = 1      # avahi-common/defs.h
 
278
    SERVER_RUNNING = 2          # avahi-common/defs.h
 
279
    SERVER_COLLISION = 3        # avahi-common/defs.h
 
280
    SERVER_FAILURE = 4          # avahi-common/defs.h
 
281
avahi = Avahi()
102
282
 
103
283
class AvahiError(Exception):
104
284
    def __init__(self, value, *args, **kwargs):
105
285
        self.value = value
106
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
107
 
    def __unicode__(self):
108
 
        return unicode(repr(self.value))
 
286
        return super(AvahiError, self).__init__(value, *args,
 
287
                                                **kwargs)
 
288
 
109
289
 
110
290
class AvahiServiceError(AvahiError):
111
291
    pass
112
292
 
 
293
 
113
294
class AvahiGroupError(AvahiError):
114
295
    pass
115
296
 
122
303
               Used to optionally bind to the specified interface.
123
304
    name: string; Example: 'Mandos'
124
305
    type: string; Example: '_mandos._tcp'.
125
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
306
     See <https://www.iana.org/assignments/service-names-port-numbers>
126
307
    port: integer; what port to announce
127
308
    TXT: list of strings; TXT record for the service
128
309
    domain: string; Domain to publish on, default to .local if empty.
134
315
    server: D-Bus Server
135
316
    bus: dbus.SystemBus()
136
317
    """
137
 
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
 
                 servicetype = None, port = None, TXT = None,
139
 
                 domain = "", host = "", max_renames = 32768,
140
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
318
    
 
319
    def __init__(self,
 
320
                 interface = avahi.IF_UNSPEC,
 
321
                 name = None,
 
322
                 servicetype = None,
 
323
                 port = None,
 
324
                 TXT = None,
 
325
                 domain = "",
 
326
                 host = "",
 
327
                 max_renames = 32768,
 
328
                 protocol = avahi.PROTO_UNSPEC,
 
329
                 bus = None):
141
330
        self.interface = interface
142
331
        self.name = name
143
332
        self.type = servicetype
152
341
        self.server = None
153
342
        self.bus = bus
154
343
        self.entry_group_state_changed_match = None
155
 
    def rename(self):
 
344
    
 
345
    def rename(self, remove=True):
156
346
        """Derived from the Avahi example code"""
157
347
        if self.rename_count >= self.max_renames:
158
348
            logger.critical("No suitable Zeroconf service name found"
159
349
                            " after %i retries, exiting.",
160
350
                            self.rename_count)
161
351
            raise AvahiServiceError("Too many renames")
162
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
352
        self.name = str(
 
353
            self.server.GetAlternativeServiceName(self.name))
 
354
        self.rename_count += 1
163
355
        logger.info("Changing Zeroconf service name to %r ...",
164
356
                    self.name)
165
 
        syslogger.setFormatter(logging.Formatter
166
 
                               ('Mandos (%s) [%%(process)d]:'
167
 
                                ' %%(levelname)s: %%(message)s'
168
 
                                % self.name))
169
 
        self.remove()
 
357
        if remove:
 
358
            self.remove()
170
359
        try:
171
360
            self.add()
172
361
        except dbus.exceptions.DBusException as error:
173
 
            logger.critical("DBusException: %s", error)
174
 
            self.cleanup()
175
 
            os._exit(1)
176
 
        self.rename_count += 1
 
362
            if (error.get_dbus_name()
 
363
                == "org.freedesktop.Avahi.CollisionError"):
 
364
                logger.info("Local Zeroconf service name collision.")
 
365
                return self.rename(remove=False)
 
366
            else:
 
367
                logger.critical("D-Bus Exception", exc_info=error)
 
368
                self.cleanup()
 
369
                os._exit(1)
 
370
    
177
371
    def remove(self):
178
372
        """Derived from the Avahi example code"""
179
373
        if self.entry_group_state_changed_match is not None:
181
375
            self.entry_group_state_changed_match = None
182
376
        if self.group is not None:
183
377
            self.group.Reset()
 
378
    
184
379
    def add(self):
185
380
        """Derived from the Avahi example code"""
186
381
        self.remove()
191
386
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
387
        self.entry_group_state_changed_match = (
193
388
            self.group.connect_to_signal(
194
 
                'StateChanged', self .entry_group_state_changed))
 
389
                'StateChanged', self.entry_group_state_changed))
195
390
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
196
391
                     self.name, self.type)
197
392
        self.group.AddService(
203
398
            dbus.UInt16(self.port),
204
399
            avahi.string_array_to_txt_array(self.TXT))
205
400
        self.group.Commit()
 
401
    
206
402
    def entry_group_state_changed(self, state, error):
207
403
        """Derived from the Avahi example code"""
208
404
        logger.debug("Avahi entry group state change: %i", state)
214
410
            self.rename()
215
411
        elif state == avahi.ENTRY_GROUP_FAILURE:
216
412
            logger.critical("Avahi: Error in group state changed %s",
217
 
                            unicode(error))
218
 
            raise AvahiGroupError("State changed: %s"
219
 
                                  % unicode(error))
 
413
                            str(error))
 
414
            raise AvahiGroupError("State changed: {!s}".format(error))
 
415
    
220
416
    def cleanup(self):
221
417
        """Derived from the Avahi example code"""
222
418
        if self.group is not None:
223
419
            try:
224
420
                self.group.Free()
225
421
            except (dbus.exceptions.UnknownMethodException,
226
 
                    dbus.exceptions.DBusException) as e:
 
422
                    dbus.exceptions.DBusException):
227
423
                pass
228
424
            self.group = None
229
425
        self.remove()
 
426
    
230
427
    def server_state_changed(self, state, error=None):
231
428
        """Derived from the Avahi example code"""
232
429
        logger.debug("Avahi server state change: %i", state)
233
 
        bad_states = { avahi.SERVER_INVALID:
234
 
                           "Zeroconf server invalid",
235
 
                       avahi.SERVER_REGISTERING: None,
236
 
                       avahi.SERVER_COLLISION:
237
 
                           "Zeroconf server name collision",
238
 
                       avahi.SERVER_FAILURE:
239
 
                           "Zeroconf server failure" }
 
430
        bad_states = {
 
431
            avahi.SERVER_INVALID: "Zeroconf server invalid",
 
432
            avahi.SERVER_REGISTERING: None,
 
433
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
 
434
            avahi.SERVER_FAILURE: "Zeroconf server failure",
 
435
        }
240
436
        if state in bad_states:
241
437
            if bad_states[state] is not None:
242
438
                if error is None:
245
441
                    logger.error(bad_states[state] + ": %r", error)
246
442
            self.cleanup()
247
443
        elif state == avahi.SERVER_RUNNING:
248
 
            self.add()
 
444
            try:
 
445
                self.add()
 
446
            except dbus.exceptions.DBusException as error:
 
447
                if (error.get_dbus_name()
 
448
                    == "org.freedesktop.Avahi.CollisionError"):
 
449
                    logger.info("Local Zeroconf service name"
 
450
                                " collision.")
 
451
                    return self.rename(remove=False)
 
452
                else:
 
453
                    logger.critical("D-Bus Exception", exc_info=error)
 
454
                    self.cleanup()
 
455
                    os._exit(1)
249
456
        else:
250
457
            if error is None:
251
458
                logger.debug("Unknown state: %r", state)
252
459
            else:
253
460
                logger.debug("Unknown state: %r: %r", state, error)
 
461
    
254
462
    def activate(self):
255
463
        """Derived from the Avahi example code"""
256
464
        if self.server is None:
260
468
                                    follow_name_owner_changes=True),
261
469
                avahi.DBUS_INTERFACE_SERVER)
262
470
        self.server.connect_to_signal("StateChanged",
263
 
                                 self.server_state_changed)
 
471
                                      self.server_state_changed)
264
472
        self.server_state_changed(self.server.GetState())
265
473
 
266
474
 
 
475
class AvahiServiceToSyslog(AvahiService):
 
476
    def rename(self, *args, **kwargs):
 
477
        """Add the new name to the syslog messages"""
 
478
        ret = AvahiService.rename(self, *args, **kwargs)
 
479
        syslogger.setFormatter(logging.Formatter(
 
480
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
481
            .format(self.name)))
 
482
        return ret
 
483
 
 
484
# Pretend that we have a GnuTLS module
 
485
class GnuTLS(object):
 
486
    """This isn't so much a class as it is a module-like namespace.
 
487
    It is instantiated once, and simulates having a GnuTLS module."""
 
488
    
 
489
    _library = ctypes.cdll.LoadLibrary(
 
490
        ctypes.util.find_library("gnutls"))
 
491
    _need_version = b"3.3.0"
 
492
    def __init__(self):
 
493
        # Need to use class name "GnuTLS" here, since this method is
 
494
        # called before the assignment to the "gnutls" global variable
 
495
        # happens.
 
496
        if GnuTLS.check_version(self._need_version) is None:
 
497
            raise GnuTLS.Error("Needs GnuTLS {} or later"
 
498
                               .format(self._need_version))
 
499
    
 
500
    # Unless otherwise indicated, the constants and types below are
 
501
    # all from the gnutls/gnutls.h C header file.
 
502
    
 
503
    # Constants
 
504
    E_SUCCESS = 0
 
505
    E_INTERRUPTED = -52
 
506
    E_AGAIN = -28
 
507
    CRT_OPENPGP = 2
 
508
    CLIENT = 2
 
509
    SHUT_RDWR = 0
 
510
    CRD_CERTIFICATE = 1
 
511
    E_NO_CERTIFICATE_FOUND = -49
 
512
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
 
513
    
 
514
    # Types
 
515
    class session_int(ctypes.Structure):
 
516
        _fields_ = []
 
517
    session_t = ctypes.POINTER(session_int)
 
518
    class certificate_credentials_st(ctypes.Structure):
 
519
        _fields_ = []
 
520
    certificate_credentials_t = ctypes.POINTER(
 
521
        certificate_credentials_st)
 
522
    certificate_type_t = ctypes.c_int
 
523
    class datum_t(ctypes.Structure):
 
524
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
 
525
                    ('size', ctypes.c_uint)]
 
526
    class openpgp_crt_int(ctypes.Structure):
 
527
        _fields_ = []
 
528
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
529
    openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
 
530
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
 
531
    credentials_type_t = ctypes.c_int
 
532
    transport_ptr_t = ctypes.c_void_p
 
533
    close_request_t = ctypes.c_int
 
534
    
 
535
    # Exceptions
 
536
    class Error(Exception):
 
537
        # We need to use the class name "GnuTLS" here, since this
 
538
        # exception might be raised from within GnuTLS.__init__,
 
539
        # which is called before the assignment to the "gnutls"
 
540
        # global variable has happened.
 
541
        def __init__(self, message = None, code = None, args=()):
 
542
            # Default usage is by a message string, but if a return
 
543
            # code is passed, convert it to a string with
 
544
            # gnutls.strerror()
 
545
            self.code = code
 
546
            if message is None and code is not None:
 
547
                message = GnuTLS.strerror(code)
 
548
            return super(GnuTLS.Error, self).__init__(
 
549
                message, *args)
 
550
    
 
551
    class CertificateSecurityError(Error):
 
552
        pass
 
553
    
 
554
    # Classes
 
555
    class Credentials(object):
 
556
        def __init__(self):
 
557
            self._c_object = gnutls.certificate_credentials_t()
 
558
            gnutls.certificate_allocate_credentials(
 
559
                ctypes.byref(self._c_object))
 
560
            self.type = gnutls.CRD_CERTIFICATE
 
561
        
 
562
        def __del__(self):
 
563
            gnutls.certificate_free_credentials(self._c_object)
 
564
    
 
565
    class ClientSession(object):
 
566
        def __init__(self, socket, credentials = None):
 
567
            self._c_object = gnutls.session_t()
 
568
            gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
 
569
            gnutls.set_default_priority(self._c_object)
 
570
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
 
571
            gnutls.handshake_set_private_extensions(self._c_object,
 
572
                                                    True)
 
573
            self.socket = socket
 
574
            if credentials is None:
 
575
                credentials = gnutls.Credentials()
 
576
            gnutls.credentials_set(self._c_object, credentials.type,
 
577
                                   ctypes.cast(credentials._c_object,
 
578
                                               ctypes.c_void_p))
 
579
            self.credentials = credentials
 
580
        
 
581
        def __del__(self):
 
582
            gnutls.deinit(self._c_object)
 
583
        
 
584
        def handshake(self):
 
585
            return gnutls.handshake(self._c_object)
 
586
        
 
587
        def send(self, data):
 
588
            data = bytes(data)
 
589
            data_len = len(data)
 
590
            while data_len > 0:
 
591
                data_len -= gnutls.record_send(self._c_object,
 
592
                                               data[-data_len:],
 
593
                                               data_len)
 
594
        
 
595
        def bye(self):
 
596
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
597
    
 
598
    # Error handling functions
 
599
    def _error_code(result):
 
600
        """A function to raise exceptions on errors, suitable
 
601
        for the 'restype' attribute on ctypes functions"""
 
602
        if result >= 0:
 
603
            return result
 
604
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
 
605
            raise gnutls.CertificateSecurityError(code = result)
 
606
        raise gnutls.Error(code = result)
 
607
    
 
608
    def _retry_on_error(result, func, arguments):
 
609
        """A function to retry on some errors, suitable
 
610
        for the 'errcheck' attribute on ctypes functions"""
 
611
        while result < 0:
 
612
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
 
613
                return _error_code(result)
 
614
            result = func(*arguments)
 
615
        return result
 
616
    
 
617
    # Unless otherwise indicated, the function declarations below are
 
618
    # all from the gnutls/gnutls.h C header file.
 
619
    
 
620
    # Functions
 
621
    priority_set_direct = _library.gnutls_priority_set_direct
 
622
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
623
                                    ctypes.POINTER(ctypes.c_char_p)]
 
624
    priority_set_direct.restype = _error_code
 
625
    
 
626
    init = _library.gnutls_init
 
627
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
628
    init.restype = _error_code
 
629
    
 
630
    set_default_priority = _library.gnutls_set_default_priority
 
631
    set_default_priority.argtypes = [session_t]
 
632
    set_default_priority.restype = _error_code
 
633
    
 
634
    record_send = _library.gnutls_record_send
 
635
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
636
                            ctypes.c_size_t]
 
637
    record_send.restype = ctypes.c_ssize_t
 
638
    record_send.errcheck = _retry_on_error
 
639
    
 
640
    certificate_allocate_credentials = (
 
641
        _library.gnutls_certificate_allocate_credentials)
 
642
    certificate_allocate_credentials.argtypes = [
 
643
        ctypes.POINTER(certificate_credentials_t)]
 
644
    certificate_allocate_credentials.restype = _error_code
 
645
    
 
646
    certificate_free_credentials = (
 
647
        _library.gnutls_certificate_free_credentials)
 
648
    certificate_free_credentials.argtypes = [certificate_credentials_t]
 
649
    certificate_free_credentials.restype = None
 
650
    
 
651
    handshake_set_private_extensions = (
 
652
        _library.gnutls_handshake_set_private_extensions)
 
653
    handshake_set_private_extensions.argtypes = [session_t,
 
654
                                                 ctypes.c_int]
 
655
    handshake_set_private_extensions.restype = None
 
656
    
 
657
    credentials_set = _library.gnutls_credentials_set
 
658
    credentials_set.argtypes = [session_t, credentials_type_t,
 
659
                                ctypes.c_void_p]
 
660
    credentials_set.restype = _error_code
 
661
    
 
662
    strerror = _library.gnutls_strerror
 
663
    strerror.argtypes = [ctypes.c_int]
 
664
    strerror.restype = ctypes.c_char_p
 
665
    
 
666
    certificate_type_get = _library.gnutls_certificate_type_get
 
667
    certificate_type_get.argtypes = [session_t]
 
668
    certificate_type_get.restype = _error_code
 
669
    
 
670
    certificate_get_peers = _library.gnutls_certificate_get_peers
 
671
    certificate_get_peers.argtypes = [session_t,
 
672
                                      ctypes.POINTER(ctypes.c_uint)]
 
673
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
 
674
    
 
675
    global_set_log_level = _library.gnutls_global_set_log_level
 
676
    global_set_log_level.argtypes = [ctypes.c_int]
 
677
    global_set_log_level.restype = None
 
678
    
 
679
    global_set_log_function = _library.gnutls_global_set_log_function
 
680
    global_set_log_function.argtypes = [log_func]
 
681
    global_set_log_function.restype = None
 
682
    
 
683
    deinit = _library.gnutls_deinit
 
684
    deinit.argtypes = [session_t]
 
685
    deinit.restype = None
 
686
    
 
687
    handshake = _library.gnutls_handshake
 
688
    handshake.argtypes = [session_t]
 
689
    handshake.restype = _error_code
 
690
    handshake.errcheck = _retry_on_error
 
691
    
 
692
    transport_set_ptr = _library.gnutls_transport_set_ptr
 
693
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
694
    transport_set_ptr.restype = None
 
695
    
 
696
    bye = _library.gnutls_bye
 
697
    bye.argtypes = [session_t, close_request_t]
 
698
    bye.restype = _error_code
 
699
    bye.errcheck = _retry_on_error
 
700
    
 
701
    check_version = _library.gnutls_check_version
 
702
    check_version.argtypes = [ctypes.c_char_p]
 
703
    check_version.restype = ctypes.c_char_p
 
704
    
 
705
    # All the function declarations below are from gnutls/openpgp.h
 
706
    
 
707
    openpgp_crt_init = _library.gnutls_openpgp_crt_init
 
708
    openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
 
709
    openpgp_crt_init.restype = _error_code
 
710
    
 
711
    openpgp_crt_import = _library.gnutls_openpgp_crt_import
 
712
    openpgp_crt_import.argtypes = [openpgp_crt_t,
 
713
                                   ctypes.POINTER(datum_t),
 
714
                                   openpgp_crt_fmt_t]
 
715
    openpgp_crt_import.restype = _error_code
 
716
    
 
717
    openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
 
718
    openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
 
719
                                        ctypes.POINTER(ctypes.c_uint)]
 
720
    openpgp_crt_verify_self.restype = _error_code
 
721
    
 
722
    openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
 
723
    openpgp_crt_deinit.argtypes = [openpgp_crt_t]
 
724
    openpgp_crt_deinit.restype = None
 
725
    
 
726
    openpgp_crt_get_fingerprint = (
 
727
        _library.gnutls_openpgp_crt_get_fingerprint)
 
728
    openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
 
729
                                            ctypes.c_void_p,
 
730
                                            ctypes.POINTER(
 
731
                                                ctypes.c_size_t)]
 
732
    openpgp_crt_get_fingerprint.restype = _error_code
 
733
    
 
734
    # Remove non-public functions
 
735
    del _error_code, _retry_on_error
 
736
# Create the global "gnutls" object, simulating a module
 
737
gnutls = GnuTLS()
 
738
 
 
739
def call_pipe(connection,       # : multiprocessing.Connection
 
740
              func, *args, **kwargs):
 
741
    """This function is meant to be called by multiprocessing.Process
 
742
    
 
743
    This function runs func(*args, **kwargs), and writes the resulting
 
744
    return value on the provided multiprocessing.Connection.
 
745
    """
 
746
    connection.send(func(*args, **kwargs))
 
747
    connection.close()
 
748
 
267
749
class Client(object):
268
750
    """A representation of a client host served by this server.
269
751
    
270
752
    Attributes:
271
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
753
    approved:   bool(); 'None' if not yet approved/disapproved
272
754
    approval_delay: datetime.timedelta(); Time to wait for approval
273
755
    approval_duration: datetime.timedelta(); Duration of one approval
274
756
    checker:    subprocess.Popen(); a running checker process used
275
757
                                    to see if the client lives.
276
758
                                    'None' if no process is running.
277
 
    checker_callback_tag: a gobject event source tag, or None
 
759
    checker_callback_tag: a GLib event source tag, or None
278
760
    checker_command: string; External command which is run to check
279
761
                     if client lives.  %() expansions are done at
280
762
                     runtime with vars(self) as dict, so that for
281
763
                     instance %(name)s can be used in the command.
282
 
    checker_initiator_tag: a gobject event source tag, or None
 
764
    checker_initiator_tag: a GLib event source tag, or None
283
765
    created:    datetime.datetime(); (UTC) object creation
 
766
    client_structure: Object describing what attributes a client has
 
767
                      and is used for storing the client at exit
284
768
    current_checker_command: string; current running checker_command
285
 
    disable_hook:  If set, called by disable() as disable_hook(self)
286
 
    disable_initiator_tag: a gobject event source tag, or None
 
769
    disable_initiator_tag: a GLib event source tag, or None
287
770
    enabled:    bool()
288
771
    fingerprint: string (40 or 32 hexadecimal digits); used to
289
772
                 uniquely identify the client
291
774
    interval:   datetime.timedelta(); How often to start a new checker
292
775
    last_approval_request: datetime.datetime(); (UTC) or None
293
776
    last_checked_ok: datetime.datetime(); (UTC) or None
294
 
    last_enabled: datetime.datetime(); (UTC)
 
777
    last_checker_status: integer between 0 and 255 reflecting exit
 
778
                         status of last checker. -1 reflects crashed
 
779
                         checker, -2 means no checker completed yet.
 
780
    last_checker_signal: The signal which killed the last checker, if
 
781
                         last_checker_status is -1
 
782
    last_enabled: datetime.datetime(); (UTC) or None
295
783
    name:       string; from the config file, used in log messages and
296
784
                        D-Bus identifiers
297
785
    secret:     bytestring; sent verbatim (over TLS) to client
298
786
    timeout:    datetime.timedelta(); How long from last_checked_ok
299
787
                                      until this client is disabled
 
788
    extended_timeout:   extra long timeout when secret has been sent
300
789
    runtime_expansions: Allowed attributes for runtime expansion.
 
790
    expires:    datetime.datetime(); time (UTC) when a client will be
 
791
                disabled, or None
 
792
    server_settings: The server_settings dict from main()
301
793
    """
302
794
    
303
795
    runtime_expansions = ("approval_delay", "approval_duration",
304
 
                          "created", "enabled", "fingerprint",
305
 
                          "host", "interval", "last_checked_ok",
 
796
                          "created", "enabled", "expires",
 
797
                          "fingerprint", "host", "interval",
 
798
                          "last_approval_request", "last_checked_ok",
306
799
                          "last_enabled", "name", "timeout")
 
800
    client_defaults = {
 
801
        "timeout": "PT5M",
 
802
        "extended_timeout": "PT15M",
 
803
        "interval": "PT2M",
 
804
        "checker": "fping -q -- %%(host)s",
 
805
        "host": "",
 
806
        "approval_delay": "PT0S",
 
807
        "approval_duration": "PT1S",
 
808
        "approved_by_default": "True",
 
809
        "enabled": "True",
 
810
    }
307
811
    
308
812
    @staticmethod
309
 
    def _timedelta_to_milliseconds(td):
310
 
        "Convert a datetime.timedelta() to milliseconds"
311
 
        return ((td.days * 24 * 60 * 60 * 1000)
312
 
                + (td.seconds * 1000)
313
 
                + (td.microseconds // 1000))
314
 
    
315
 
    def timeout_milliseconds(self):
316
 
        "Return the 'timeout' attribute in milliseconds"
317
 
        return self._timedelta_to_milliseconds(self.timeout)
318
 
    
319
 
    def interval_milliseconds(self):
320
 
        "Return the 'interval' attribute in milliseconds"
321
 
        return self._timedelta_to_milliseconds(self.interval)
322
 
 
323
 
    def approval_delay_milliseconds(self):
324
 
        return self._timedelta_to_milliseconds(self.approval_delay)
325
 
    
326
 
    def __init__(self, name = None, disable_hook=None, config=None):
327
 
        """Note: the 'checker' key in 'config' sets the
328
 
        'checker_command' attribute and *not* the 'checker'
329
 
        attribute."""
 
813
    def config_parser(config):
 
814
        """Construct a new dict of client settings of this form:
 
815
        { client_name: {setting_name: value, ...}, ...}
 
816
        with exceptions for any special settings as defined above.
 
817
        NOTE: Must be a pure function. Must return the same result
 
818
        value given the same arguments.
 
819
        """
 
820
        settings = {}
 
821
        for client_name in config.sections():
 
822
            section = dict(config.items(client_name))
 
823
            client = settings[client_name] = {}
 
824
            
 
825
            client["host"] = section["host"]
 
826
            # Reformat values from string types to Python types
 
827
            client["approved_by_default"] = config.getboolean(
 
828
                client_name, "approved_by_default")
 
829
            client["enabled"] = config.getboolean(client_name,
 
830
                                                  "enabled")
 
831
            
 
832
            # Uppercase and remove spaces from fingerprint for later
 
833
            # comparison purposes with return value from the
 
834
            # fingerprint() function
 
835
            client["fingerprint"] = (section["fingerprint"].upper()
 
836
                                     .replace(" ", ""))
 
837
            if "secret" in section:
 
838
                client["secret"] = codecs.decode(section["secret"]
 
839
                                                 .encode("utf-8"),
 
840
                                                 "base64")
 
841
            elif "secfile" in section:
 
842
                with open(os.path.expanduser(os.path.expandvars
 
843
                                             (section["secfile"])),
 
844
                          "rb") as secfile:
 
845
                    client["secret"] = secfile.read()
 
846
            else:
 
847
                raise TypeError("No secret or secfile for section {}"
 
848
                                .format(section))
 
849
            client["timeout"] = string_to_delta(section["timeout"])
 
850
            client["extended_timeout"] = string_to_delta(
 
851
                section["extended_timeout"])
 
852
            client["interval"] = string_to_delta(section["interval"])
 
853
            client["approval_delay"] = string_to_delta(
 
854
                section["approval_delay"])
 
855
            client["approval_duration"] = string_to_delta(
 
856
                section["approval_duration"])
 
857
            client["checker_command"] = section["checker"]
 
858
            client["last_approval_request"] = None
 
859
            client["last_checked_ok"] = None
 
860
            client["last_checker_status"] = -2
 
861
        
 
862
        return settings
 
863
    
 
864
    def __init__(self, settings, name = None, server_settings=None):
330
865
        self.name = name
331
 
        if config is None:
332
 
            config = {}
 
866
        if server_settings is None:
 
867
            server_settings = {}
 
868
        self.server_settings = server_settings
 
869
        # adding all client settings
 
870
        for setting, value in settings.items():
 
871
            setattr(self, setting, value)
 
872
        
 
873
        if self.enabled:
 
874
            if not hasattr(self, "last_enabled"):
 
875
                self.last_enabled = datetime.datetime.utcnow()
 
876
            if not hasattr(self, "expires"):
 
877
                self.expires = (datetime.datetime.utcnow()
 
878
                                + self.timeout)
 
879
        else:
 
880
            self.last_enabled = None
 
881
            self.expires = None
 
882
        
333
883
        logger.debug("Creating client %r", self.name)
334
 
        # Uppercase and remove spaces from fingerprint for later
335
 
        # comparison purposes with return value from the fingerprint()
336
 
        # function
337
 
        self.fingerprint = (config["fingerprint"].upper()
338
 
                            .replace(" ", ""))
339
884
        logger.debug("  Fingerprint: %s", self.fingerprint)
340
 
        if "secret" in config:
341
 
            self.secret = config["secret"].decode("base64")
342
 
        elif "secfile" in config:
343
 
            with open(os.path.expanduser(os.path.expandvars
344
 
                                         (config["secfile"])),
345
 
                      "rb") as secfile:
346
 
                self.secret = secfile.read()
347
 
        else:
348
 
            raise TypeError("No secret or secfile for client %s"
349
 
                            % self.name)
350
 
        self.host = config.get("host", "")
351
 
        self.created = datetime.datetime.utcnow()
352
 
        self.enabled = False
353
 
        self.last_approval_request = None
354
 
        self.last_enabled = None
355
 
        self.last_checked_ok = None
356
 
        self.timeout = string_to_delta(config["timeout"])
357
 
        self.interval = string_to_delta(config["interval"])
358
 
        self.disable_hook = disable_hook
 
885
        self.created = settings.get("created",
 
886
                                    datetime.datetime.utcnow())
 
887
        
 
888
        # attributes specific for this server instance
359
889
        self.checker = None
360
890
        self.checker_initiator_tag = None
361
891
        self.disable_initiator_tag = None
362
892
        self.checker_callback_tag = None
363
 
        self.checker_command = config["checker"]
364
893
        self.current_checker_command = None
365
 
        self.last_connect = None
366
 
        self._approved = None
367
 
        self.approved_by_default = config.get("approved_by_default",
368
 
                                              True)
 
894
        self.approved = None
369
895
        self.approvals_pending = 0
370
 
        self.approval_delay = string_to_delta(
371
 
            config["approval_delay"])
372
 
        self.approval_duration = string_to_delta(
373
 
            config["approval_duration"])
374
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
896
        self.changedstate = multiprocessing_manager.Condition(
 
897
            multiprocessing_manager.Lock())
 
898
        self.client_structure = [attr
 
899
                                 for attr in self.__dict__.keys()
 
900
                                 if not attr.startswith("_")]
 
901
        self.client_structure.append("client_structure")
 
902
        
 
903
        for name, t in inspect.getmembers(
 
904
                type(self), lambda obj: isinstance(obj, property)):
 
905
            if not name.startswith("_"):
 
906
                self.client_structure.append(name)
375
907
    
 
908
    # Send notice to process children that client state has changed
376
909
    def send_changedstate(self):
377
 
        self.changedstate.acquire()
378
 
        self.changedstate.notify_all()
379
 
        self.changedstate.release()
380
 
        
 
910
        with self.changedstate:
 
911
            self.changedstate.notify_all()
 
912
    
381
913
    def enable(self):
382
914
        """Start this client's checker and timeout hooks"""
383
915
        if getattr(self, "enabled", False):
384
916
            # Already enabled
385
917
            return
386
 
        self.send_changedstate()
 
918
        self.expires = datetime.datetime.utcnow() + self.timeout
 
919
        self.enabled = True
387
920
        self.last_enabled = datetime.datetime.utcnow()
388
 
        # Schedule a new checker to be started an 'interval' from now,
389
 
        # and every interval from then on.
390
 
        self.checker_initiator_tag = (gobject.timeout_add
391
 
                                      (self.interval_milliseconds(),
392
 
                                       self.start_checker))
393
 
        # Schedule a disable() when 'timeout' has passed
394
 
        self.disable_initiator_tag = (gobject.timeout_add
395
 
                                   (self.timeout_milliseconds(),
396
 
                                    self.disable))
397
 
        self.enabled = True
398
 
        # Also start a new checker *right now*.
399
 
        self.start_checker()
 
921
        self.init_checker()
 
922
        self.send_changedstate()
400
923
    
401
924
    def disable(self, quiet=True):
402
925
        """Disable this client."""
403
926
        if not getattr(self, "enabled", False):
404
927
            return False
405
928
        if not quiet:
406
 
            self.send_changedstate()
407
 
        if not quiet:
408
929
            logger.info("Disabling client %s", self.name)
409
 
        if getattr(self, "disable_initiator_tag", False):
410
 
            gobject.source_remove(self.disable_initiator_tag)
 
930
        if getattr(self, "disable_initiator_tag", None) is not None:
 
931
            GLib.source_remove(self.disable_initiator_tag)
411
932
            self.disable_initiator_tag = None
412
 
        if getattr(self, "checker_initiator_tag", False):
413
 
            gobject.source_remove(self.checker_initiator_tag)
 
933
        self.expires = None
 
934
        if getattr(self, "checker_initiator_tag", None) is not None:
 
935
            GLib.source_remove(self.checker_initiator_tag)
414
936
            self.checker_initiator_tag = None
415
937
        self.stop_checker()
416
 
        if self.disable_hook:
417
 
            self.disable_hook(self)
418
938
        self.enabled = False
419
 
        # Do not run this again if called by a gobject.timeout_add
 
939
        if not quiet:
 
940
            self.send_changedstate()
 
941
        # Do not run this again if called by a GLib.timeout_add
420
942
        return False
421
943
    
422
944
    def __del__(self):
423
 
        self.disable_hook = None
424
945
        self.disable()
425
946
    
426
 
    def checker_callback(self, pid, condition, command):
 
947
    def init_checker(self):
 
948
        # Schedule a new checker to be started an 'interval' from now,
 
949
        # and every interval from then on.
 
950
        if self.checker_initiator_tag is not None:
 
951
            GLib.source_remove(self.checker_initiator_tag)
 
952
        self.checker_initiator_tag = GLib.timeout_add(
 
953
            int(self.interval.total_seconds() * 1000),
 
954
            self.start_checker)
 
955
        # Schedule a disable() when 'timeout' has passed
 
956
        if self.disable_initiator_tag is not None:
 
957
            GLib.source_remove(self.disable_initiator_tag)
 
958
        self.disable_initiator_tag = GLib.timeout_add(
 
959
            int(self.timeout.total_seconds() * 1000), self.disable)
 
960
        # Also start a new checker *right now*.
 
961
        self.start_checker()
 
962
    
 
963
    def checker_callback(self, source, condition, connection,
 
964
                         command):
427
965
        """The checker has completed, so take appropriate actions."""
428
966
        self.checker_callback_tag = None
429
967
        self.checker = None
430
 
        if os.WIFEXITED(condition):
431
 
            exitstatus = os.WEXITSTATUS(condition)
432
 
            if exitstatus == 0:
 
968
        # Read return code from connection (see call_pipe)
 
969
        returncode = connection.recv()
 
970
        connection.close()
 
971
        
 
972
        if returncode >= 0:
 
973
            self.last_checker_status = returncode
 
974
            self.last_checker_signal = None
 
975
            if self.last_checker_status == 0:
433
976
                logger.info("Checker for %(name)s succeeded",
434
977
                            vars(self))
435
978
                self.checked_ok()
436
979
            else:
437
 
                logger.info("Checker for %(name)s failed",
438
 
                            vars(self))
 
980
                logger.info("Checker for %(name)s failed", vars(self))
439
981
        else:
 
982
            self.last_checker_status = -1
 
983
            self.last_checker_signal = -returncode
440
984
            logger.warning("Checker for %(name)s crashed?",
441
985
                           vars(self))
 
986
        return False
442
987
    
443
988
    def checked_ok(self):
444
 
        """Bump up the timeout for this client.
445
 
        
446
 
        This should only be called when the client has been seen,
447
 
        alive and well.
448
 
        """
 
989
        """Assert that the client has been seen, alive and well."""
449
990
        self.last_checked_ok = datetime.datetime.utcnow()
450
 
        gobject.source_remove(self.disable_initiator_tag)
451
 
        self.disable_initiator_tag = (gobject.timeout_add
452
 
                                      (self.timeout_milliseconds(),
453
 
                                       self.disable))
 
991
        self.last_checker_status = 0
 
992
        self.last_checker_signal = None
 
993
        self.bump_timeout()
 
994
    
 
995
    def bump_timeout(self, timeout=None):
 
996
        """Bump up the timeout for this client."""
 
997
        if timeout is None:
 
998
            timeout = self.timeout
 
999
        if self.disable_initiator_tag is not None:
 
1000
            GLib.source_remove(self.disable_initiator_tag)
 
1001
            self.disable_initiator_tag = None
 
1002
        if getattr(self, "enabled", False):
 
1003
            self.disable_initiator_tag = GLib.timeout_add(
 
1004
                int(timeout.total_seconds() * 1000), self.disable)
 
1005
            self.expires = datetime.datetime.utcnow() + timeout
454
1006
    
455
1007
    def need_approval(self):
456
1008
        self.last_approval_request = datetime.datetime.utcnow()
461
1013
        If a checker already exists, leave it running and do
462
1014
        nothing."""
463
1015
        # The reason for not killing a running checker is that if we
464
 
        # did that, then if a checker (for some reason) started
465
 
        # running slowly and taking more than 'interval' time, the
466
 
        # client would inevitably timeout, since no checker would get
467
 
        # a chance to run to completion.  If we instead leave running
 
1016
        # did that, and if a checker (for some reason) started running
 
1017
        # slowly and taking more than 'interval' time, then the client
 
1018
        # would inevitably timeout, since no checker would get a
 
1019
        # chance to run to completion.  If we instead leave running
468
1020
        # checkers alone, the checker would have to take more time
469
1021
        # than 'timeout' for the client to be disabled, which is as it
470
1022
        # should be.
471
1023
        
472
 
        # If a checker exists, make sure it is not a zombie
473
 
        try:
474
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
475
 
        except (AttributeError, OSError) as error:
476
 
            if (isinstance(error, OSError)
477
 
                and error.errno != errno.ECHILD):
478
 
                raise error
479
 
        else:
480
 
            if pid:
481
 
                logger.warning("Checker was a zombie")
482
 
                gobject.source_remove(self.checker_callback_tag)
483
 
                self.checker_callback(pid, status,
484
 
                                      self.current_checker_command)
 
1024
        if self.checker is not None and not self.checker.is_alive():
 
1025
            logger.warning("Checker was not alive; joining")
 
1026
            self.checker.join()
 
1027
            self.checker = None
485
1028
        # Start a new checker if needed
486
1029
        if self.checker is None:
 
1030
            # Escape attributes for the shell
 
1031
            escaped_attrs = {
 
1032
                attr: re.escape(str(getattr(self, attr)))
 
1033
                for attr in self.runtime_expansions }
487
1034
            try:
488
 
                # In case checker_command has exactly one % operator
489
 
                command = self.checker_command % self.host
490
 
            except TypeError:
491
 
                # Escape attributes for the shell
492
 
                escaped_attrs = dict(
493
 
                    (attr,
494
 
                     re.escape(unicode(str(getattr(self, attr, "")),
495
 
                                       errors=
496
 
                                       'replace')))
497
 
                    for attr in
498
 
                    self.runtime_expansions)
499
 
 
500
 
                try:
501
 
                    command = self.checker_command % escaped_attrs
502
 
                except TypeError as error:
503
 
                    logger.error('Could not format string "%s":'
504
 
                                 ' %s', self.checker_command, error)
505
 
                    return True # Try again later
 
1035
                command = self.checker_command % escaped_attrs
 
1036
            except TypeError as error:
 
1037
                logger.error('Could not format string "%s"',
 
1038
                             self.checker_command,
 
1039
                             exc_info=error)
 
1040
                return True     # Try again later
506
1041
            self.current_checker_command = command
507
 
            try:
508
 
                logger.info("Starting checker %r for %s",
509
 
                            command, self.name)
510
 
                # We don't need to redirect stdout and stderr, since
511
 
                # in normal mode, that is already done by daemon(),
512
 
                # and in debug mode we don't want to.  (Stdin is
513
 
                # always replaced by /dev/null.)
514
 
                self.checker = subprocess.Popen(command,
515
 
                                                close_fds=True,
516
 
                                                shell=True, cwd="/")
517
 
                self.checker_callback_tag = (gobject.child_watch_add
518
 
                                             (self.checker.pid,
519
 
                                              self.checker_callback,
520
 
                                              data=command))
521
 
                # The checker may have completed before the gobject
522
 
                # watch was added.  Check for this.
523
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
524
 
                if pid:
525
 
                    gobject.source_remove(self.checker_callback_tag)
526
 
                    self.checker_callback(pid, status, command)
527
 
            except OSError as error:
528
 
                logger.error("Failed to start subprocess: %s",
529
 
                             error)
530
 
        # Re-run this periodically if run by gobject.timeout_add
 
1042
            logger.info("Starting checker %r for %s", command,
 
1043
                        self.name)
 
1044
            # We don't need to redirect stdout and stderr, since
 
1045
            # in normal mode, that is already done by daemon(),
 
1046
            # and in debug mode we don't want to.  (Stdin is
 
1047
            # always replaced by /dev/null.)
 
1048
            # The exception is when not debugging but nevertheless
 
1049
            # running in the foreground; use the previously
 
1050
            # created wnull.
 
1051
            popen_args = { "close_fds": True,
 
1052
                           "shell": True,
 
1053
                           "cwd": "/" }
 
1054
            if (not self.server_settings["debug"]
 
1055
                and self.server_settings["foreground"]):
 
1056
                popen_args.update({"stdout": wnull,
 
1057
                                   "stderr": wnull })
 
1058
            pipe = multiprocessing.Pipe(duplex = False)
 
1059
            self.checker = multiprocessing.Process(
 
1060
                target = call_pipe,
 
1061
                args = (pipe[1], subprocess.call, command),
 
1062
                kwargs = popen_args)
 
1063
            self.checker.start()
 
1064
            self.checker_callback_tag = GLib.io_add_watch(
 
1065
                pipe[0].fileno(), GLib.IO_IN,
 
1066
                self.checker_callback, pipe[0], command)
 
1067
        # Re-run this periodically if run by GLib.timeout_add
531
1068
        return True
532
1069
    
533
1070
    def stop_checker(self):
534
1071
        """Force the checker process, if any, to stop."""
535
1072
        if self.checker_callback_tag:
536
 
            gobject.source_remove(self.checker_callback_tag)
 
1073
            GLib.source_remove(self.checker_callback_tag)
537
1074
            self.checker_callback_tag = None
538
1075
        if getattr(self, "checker", None) is None:
539
1076
            return
540
1077
        logger.debug("Stopping checker for %(name)s", vars(self))
541
 
        try:
542
 
            os.kill(self.checker.pid, signal.SIGTERM)
543
 
            #time.sleep(0.5)
544
 
            #if self.checker.poll() is None:
545
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
546
 
        except OSError as error:
547
 
            if error.errno != errno.ESRCH: # No such process
548
 
                raise
 
1078
        self.checker.terminate()
549
1079
        self.checker = None
550
1080
 
551
 
def dbus_service_property(dbus_interface, signature="v",
552
 
                          access="readwrite", byte_arrays=False):
 
1081
 
 
1082
def dbus_service_property(dbus_interface,
 
1083
                          signature="v",
 
1084
                          access="readwrite",
 
1085
                          byte_arrays=False):
553
1086
    """Decorators for marking methods of a DBusObjectWithProperties to
554
1087
    become properties on the D-Bus.
555
1088
    
564
1097
    # "Set" method, so we fail early here:
565
1098
    if byte_arrays and signature != "ay":
566
1099
        raise ValueError("Byte arrays not supported for non-'ay'"
567
 
                         " signature %r" % signature)
 
1100
                         " signature {!r}".format(signature))
 
1101
    
568
1102
    def decorator(func):
569
1103
        func._dbus_is_property = True
570
1104
        func._dbus_interface = dbus_interface
575
1109
            func._dbus_name = func._dbus_name[:-14]
576
1110
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
577
1111
        return func
 
1112
    
 
1113
    return decorator
 
1114
 
 
1115
 
 
1116
def dbus_interface_annotations(dbus_interface):
 
1117
    """Decorator for marking functions returning interface annotations
 
1118
    
 
1119
    Usage:
 
1120
    
 
1121
    @dbus_interface_annotations("org.example.Interface")
 
1122
    def _foo(self):  # Function name does not matter
 
1123
        return {"org.freedesktop.DBus.Deprecated": "true",
 
1124
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1125
                    "false"}
 
1126
    """
 
1127
    
 
1128
    def decorator(func):
 
1129
        func._dbus_is_interface = True
 
1130
        func._dbus_interface = dbus_interface
 
1131
        func._dbus_name = dbus_interface
 
1132
        return func
 
1133
    
 
1134
    return decorator
 
1135
 
 
1136
 
 
1137
def dbus_annotations(annotations):
 
1138
    """Decorator to annotate D-Bus methods, signals or properties
 
1139
    Usage:
 
1140
    
 
1141
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
 
1142
                       "org.freedesktop.DBus.Property."
 
1143
                       "EmitsChangedSignal": "false"})
 
1144
    @dbus_service_property("org.example.Interface", signature="b",
 
1145
                           access="r")
 
1146
    def Property_dbus_property(self):
 
1147
        return dbus.Boolean(False)
 
1148
    
 
1149
    See also the DBusObjectWithAnnotations class.
 
1150
    """
 
1151
    
 
1152
    def decorator(func):
 
1153
        func._dbus_annotations = annotations
 
1154
        return func
 
1155
    
578
1156
    return decorator
579
1157
 
580
1158
 
581
1159
class DBusPropertyException(dbus.exceptions.DBusException):
582
1160
    """A base class for D-Bus property-related exceptions
583
1161
    """
584
 
    def __unicode__(self):
585
 
        return unicode(str(self))
 
1162
    pass
586
1163
 
587
1164
 
588
1165
class DBusPropertyAccessException(DBusPropertyException):
597
1174
    pass
598
1175
 
599
1176
 
600
 
class DBusObjectWithProperties(dbus.service.Object):
 
1177
class DBusObjectWithAnnotations(dbus.service.Object):
 
1178
    """A D-Bus object with annotations.
 
1179
    
 
1180
    Classes inheriting from this can use the dbus_annotations
 
1181
    decorator to add annotations to methods or signals.
 
1182
    """
 
1183
    
 
1184
    @staticmethod
 
1185
    def _is_dbus_thing(thing):
 
1186
        """Returns a function testing if an attribute is a D-Bus thing
 
1187
        
 
1188
        If called like _is_dbus_thing("method") it returns a function
 
1189
        suitable for use as predicate to inspect.getmembers().
 
1190
        """
 
1191
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
 
1192
                                   False)
 
1193
    
 
1194
    def _get_all_dbus_things(self, thing):
 
1195
        """Returns a generator of (name, attribute) pairs
 
1196
        """
 
1197
        return ((getattr(athing.__get__(self), "_dbus_name", name),
 
1198
                 athing.__get__(self))
 
1199
                for cls in self.__class__.__mro__
 
1200
                for name, athing in
 
1201
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
1202
    
 
1203
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1204
                         out_signature = "s",
 
1205
                         path_keyword = 'object_path',
 
1206
                         connection_keyword = 'connection')
 
1207
    def Introspect(self, object_path, connection):
 
1208
        """Overloading of standard D-Bus method.
 
1209
        
 
1210
        Inserts annotation tags on methods and signals.
 
1211
        """
 
1212
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
1213
                                                   connection)
 
1214
        try:
 
1215
            document = xml.dom.minidom.parseString(xmlstring)
 
1216
            
 
1217
            for if_tag in document.getElementsByTagName("interface"):
 
1218
                # Add annotation tags
 
1219
                for typ in ("method", "signal"):
 
1220
                    for tag in if_tag.getElementsByTagName(typ):
 
1221
                        annots = dict()
 
1222
                        for name, prop in (self.
 
1223
                                           _get_all_dbus_things(typ)):
 
1224
                            if (name == tag.getAttribute("name")
 
1225
                                and prop._dbus_interface
 
1226
                                == if_tag.getAttribute("name")):
 
1227
                                annots.update(getattr(
 
1228
                                    prop, "_dbus_annotations", {}))
 
1229
                        for name, value in annots.items():
 
1230
                            ann_tag = document.createElement(
 
1231
                                "annotation")
 
1232
                            ann_tag.setAttribute("name", name)
 
1233
                            ann_tag.setAttribute("value", value)
 
1234
                            tag.appendChild(ann_tag)
 
1235
                # Add interface annotation tags
 
1236
                for annotation, value in dict(
 
1237
                    itertools.chain.from_iterable(
 
1238
                        annotations().items()
 
1239
                        for name, annotations
 
1240
                        in self._get_all_dbus_things("interface")
 
1241
                        if name == if_tag.getAttribute("name")
 
1242
                        )).items():
 
1243
                    ann_tag = document.createElement("annotation")
 
1244
                    ann_tag.setAttribute("name", annotation)
 
1245
                    ann_tag.setAttribute("value", value)
 
1246
                    if_tag.appendChild(ann_tag)
 
1247
                # Fix argument name for the Introspect method itself
 
1248
                if (if_tag.getAttribute("name")
 
1249
                                == dbus.INTROSPECTABLE_IFACE):
 
1250
                    for cn in if_tag.getElementsByTagName("method"):
 
1251
                        if cn.getAttribute("name") == "Introspect":
 
1252
                            for arg in cn.getElementsByTagName("arg"):
 
1253
                                if (arg.getAttribute("direction")
 
1254
                                    == "out"):
 
1255
                                    arg.setAttribute("name",
 
1256
                                                     "xml_data")
 
1257
            xmlstring = document.toxml("utf-8")
 
1258
            document.unlink()
 
1259
        except (AttributeError, xml.dom.DOMException,
 
1260
                xml.parsers.expat.ExpatError) as error:
 
1261
            logger.error("Failed to override Introspection method",
 
1262
                         exc_info=error)
 
1263
        return xmlstring
 
1264
 
 
1265
 
 
1266
class DBusObjectWithProperties(DBusObjectWithAnnotations):
601
1267
    """A D-Bus object with properties.
602
 
 
 
1268
    
603
1269
    Classes inheriting from this can use the dbus_service_property
604
1270
    decorator to expose methods as D-Bus properties.  It exposes the
605
1271
    standard Get(), Set(), and GetAll() methods on the D-Bus.
606
1272
    """
607
1273
    
608
 
    @staticmethod
609
 
    def _is_dbus_property(obj):
610
 
        return getattr(obj, "_dbus_is_property", False)
611
 
    
612
 
    def _get_all_dbus_properties(self):
613
 
        """Returns a generator of (name, attribute) pairs
614
 
        """
615
 
        return ((prop._dbus_name, prop)
616
 
                for name, prop in
617
 
                inspect.getmembers(self, self._is_dbus_property))
618
 
    
619
1274
    def _get_dbus_property(self, interface_name, property_name):
620
1275
        """Returns a bound method if one exists which is a D-Bus
621
1276
        property with the specified name and interface.
622
1277
        """
623
 
        for name in (property_name,
624
 
                     property_name + "_dbus_property"):
625
 
            prop = getattr(self, name, None)
626
 
            if (prop is None
627
 
                or not self._is_dbus_property(prop)
628
 
                or prop._dbus_name != property_name
629
 
                or (interface_name and prop._dbus_interface
630
 
                    and interface_name != prop._dbus_interface)):
631
 
                continue
632
 
            return prop
 
1278
        for cls in self.__class__.__mro__:
 
1279
            for name, value in inspect.getmembers(
 
1280
                    cls, self._is_dbus_thing("property")):
 
1281
                if (value._dbus_name == property_name
 
1282
                    and value._dbus_interface == interface_name):
 
1283
                    return value.__get__(self)
 
1284
        
633
1285
        # No such property
634
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
635
 
                                   + interface_name + "."
636
 
                                   + property_name)
637
 
    
638
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
1286
        raise DBusPropertyNotFound("{}:{}.{}".format(
 
1287
            self.dbus_object_path, interface_name, property_name))
 
1288
    
 
1289
    @classmethod
 
1290
    def _get_all_interface_names(cls):
 
1291
        """Get a sequence of all interfaces supported by an object"""
 
1292
        return (name for name in set(getattr(getattr(x, attr),
 
1293
                                             "_dbus_interface", None)
 
1294
                                     for x in (inspect.getmro(cls))
 
1295
                                     for attr in dir(x))
 
1296
                if name is not None)
 
1297
    
 
1298
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1299
                         in_signature="ss",
639
1300
                         out_signature="v")
640
1301
    def Get(self, interface_name, property_name):
641
1302
        """Standard D-Bus property Get() method, see D-Bus standard.
659
1320
            # The byte_arrays option is not supported yet on
660
1321
            # signatures other than "ay".
661
1322
            if prop._dbus_signature != "ay":
662
 
                raise ValueError
663
 
            value = dbus.ByteArray(''.join(unichr(byte)
664
 
                                           for byte in value))
 
1323
                raise ValueError("Byte arrays not supported for non-"
 
1324
                                 "'ay' signature {!r}"
 
1325
                                 .format(prop._dbus_signature))
 
1326
            value = dbus.ByteArray(b''.join(chr(byte)
 
1327
                                            for byte in value))
665
1328
        prop(value)
666
1329
    
667
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
1330
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1331
                         in_signature="s",
668
1332
                         out_signature="a{sv}")
669
1333
    def GetAll(self, interface_name):
670
1334
        """Standard D-Bus property GetAll() method, see D-Bus
671
1335
        standard.
672
 
 
 
1336
        
673
1337
        Note: Will not include properties with access="write".
674
1338
        """
675
 
        all = {}
676
 
        for name, prop in self._get_all_dbus_properties():
 
1339
        properties = {}
 
1340
        for name, prop in self._get_all_dbus_things("property"):
677
1341
            if (interface_name
678
1342
                and interface_name != prop._dbus_interface):
679
1343
                # Interface non-empty but did not match
683
1347
                continue
684
1348
            value = prop()
685
1349
            if not hasattr(value, "variant_level"):
686
 
                all[name] = value
 
1350
                properties[name] = value
687
1351
                continue
688
 
            all[name] = type(value)(value, variant_level=
689
 
                                    value.variant_level+1)
690
 
        return dbus.Dictionary(all, signature="sv")
 
1352
            properties[name] = type(value)(
 
1353
                value, variant_level = value.variant_level + 1)
 
1354
        return dbus.Dictionary(properties, signature="sv")
 
1355
    
 
1356
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
 
1357
    def PropertiesChanged(self, interface_name, changed_properties,
 
1358
                          invalidated_properties):
 
1359
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
 
1360
        standard.
 
1361
        """
 
1362
        pass
691
1363
    
692
1364
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
693
1365
                         out_signature="s",
694
1366
                         path_keyword='object_path',
695
1367
                         connection_keyword='connection')
696
1368
    def Introspect(self, object_path, connection):
697
 
        """Standard D-Bus method, overloaded to insert property tags.
 
1369
        """Overloading of standard D-Bus method.
 
1370
        
 
1371
        Inserts property tags and interface annotation tags.
698
1372
        """
699
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
700
 
                                                   connection)
 
1373
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1374
                                                         object_path,
 
1375
                                                         connection)
701
1376
        try:
702
1377
            document = xml.dom.minidom.parseString(xmlstring)
 
1378
            
703
1379
            def make_tag(document, name, prop):
704
1380
                e = document.createElement("property")
705
1381
                e.setAttribute("name", name)
706
1382
                e.setAttribute("type", prop._dbus_signature)
707
1383
                e.setAttribute("access", prop._dbus_access)
708
1384
                return e
 
1385
            
709
1386
            for if_tag in document.getElementsByTagName("interface"):
 
1387
                # Add property tags
710
1388
                for tag in (make_tag(document, name, prop)
711
1389
                            for name, prop
712
 
                            in self._get_all_dbus_properties()
 
1390
                            in self._get_all_dbus_things("property")
713
1391
                            if prop._dbus_interface
714
1392
                            == if_tag.getAttribute("name")):
715
1393
                    if_tag.appendChild(tag)
 
1394
                # Add annotation tags for properties
 
1395
                for tag in if_tag.getElementsByTagName("property"):
 
1396
                    annots = dict()
 
1397
                    for name, prop in self._get_all_dbus_things(
 
1398
                            "property"):
 
1399
                        if (name == tag.getAttribute("name")
 
1400
                            and prop._dbus_interface
 
1401
                            == if_tag.getAttribute("name")):
 
1402
                            annots.update(getattr(
 
1403
                                prop, "_dbus_annotations", {}))
 
1404
                    for name, value in annots.items():
 
1405
                        ann_tag = document.createElement(
 
1406
                            "annotation")
 
1407
                        ann_tag.setAttribute("name", name)
 
1408
                        ann_tag.setAttribute("value", value)
 
1409
                        tag.appendChild(ann_tag)
716
1410
                # Add the names to the return values for the
717
1411
                # "org.freedesktop.DBus.Properties" methods
718
1412
                if (if_tag.getAttribute("name")
733
1427
        except (AttributeError, xml.dom.DOMException,
734
1428
                xml.parsers.expat.ExpatError) as error:
735
1429
            logger.error("Failed to override Introspection method",
736
 
                         error)
737
 
        return xmlstring
738
 
 
739
 
 
 
1430
                         exc_info=error)
 
1431
        return xmlstring
 
1432
 
 
1433
try:
 
1434
    dbus.OBJECT_MANAGER_IFACE
 
1435
except AttributeError:
 
1436
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
 
1437
 
 
1438
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
 
1439
    """A D-Bus object with an ObjectManager.
 
1440
    
 
1441
    Classes inheriting from this exposes the standard
 
1442
    GetManagedObjects call and the InterfacesAdded and
 
1443
    InterfacesRemoved signals on the standard
 
1444
    "org.freedesktop.DBus.ObjectManager" interface.
 
1445
    
 
1446
    Note: No signals are sent automatically; they must be sent
 
1447
    manually.
 
1448
    """
 
1449
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
1450
                         out_signature = "a{oa{sa{sv}}}")
 
1451
    def GetManagedObjects(self):
 
1452
        """This function must be overridden"""
 
1453
        raise NotImplementedError()
 
1454
    
 
1455
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
 
1456
                         signature = "oa{sa{sv}}")
 
1457
    def InterfacesAdded(self, object_path, interfaces_and_properties):
 
1458
        pass
 
1459
    
 
1460
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
 
1461
    def InterfacesRemoved(self, object_path, interfaces):
 
1462
        pass
 
1463
    
 
1464
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1465
                         out_signature = "s",
 
1466
                         path_keyword = 'object_path',
 
1467
                         connection_keyword = 'connection')
 
1468
    def Introspect(self, object_path, connection):
 
1469
        """Overloading of standard D-Bus method.
 
1470
        
 
1471
        Override return argument name of GetManagedObjects to be
 
1472
        "objpath_interfaces_and_properties"
 
1473
        """
 
1474
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1475
                                                         object_path,
 
1476
                                                         connection)
 
1477
        try:
 
1478
            document = xml.dom.minidom.parseString(xmlstring)
 
1479
            
 
1480
            for if_tag in document.getElementsByTagName("interface"):
 
1481
                # Fix argument name for the GetManagedObjects method
 
1482
                if (if_tag.getAttribute("name")
 
1483
                                == dbus.OBJECT_MANAGER_IFACE):
 
1484
                    for cn in if_tag.getElementsByTagName("method"):
 
1485
                        if (cn.getAttribute("name")
 
1486
                            == "GetManagedObjects"):
 
1487
                            for arg in cn.getElementsByTagName("arg"):
 
1488
                                if (arg.getAttribute("direction")
 
1489
                                    == "out"):
 
1490
                                    arg.setAttribute(
 
1491
                                        "name",
 
1492
                                        "objpath_interfaces"
 
1493
                                        "_and_properties")
 
1494
            xmlstring = document.toxml("utf-8")
 
1495
            document.unlink()
 
1496
        except (AttributeError, xml.dom.DOMException,
 
1497
                xml.parsers.expat.ExpatError) as error:
 
1498
            logger.error("Failed to override Introspection method",
 
1499
                         exc_info = error)
 
1500
        return xmlstring
 
1501
 
 
1502
def datetime_to_dbus(dt, variant_level=0):
 
1503
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
1504
    if dt is None:
 
1505
        return dbus.String("", variant_level = variant_level)
 
1506
    return dbus.String(dt.isoformat(), variant_level=variant_level)
 
1507
 
 
1508
 
 
1509
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1510
    """A class decorator; applied to a subclass of
 
1511
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1512
    interface names according to the "alt_interface_names" mapping.
 
1513
    Usage:
 
1514
    
 
1515
    @alternate_dbus_interfaces({"org.example.Interface":
 
1516
                                    "net.example.AlternateInterface"})
 
1517
    class SampleDBusObject(dbus.service.Object):
 
1518
        @dbus.service.method("org.example.Interface")
 
1519
        def SampleDBusMethod():
 
1520
            pass
 
1521
    
 
1522
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1523
    reachable via two interfaces: "org.example.Interface" and
 
1524
    "net.example.AlternateInterface", the latter of which will have
 
1525
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1526
    "true", unless "deprecate" is passed with a False value.
 
1527
    
 
1528
    This works for methods and signals, and also for D-Bus properties
 
1529
    (from DBusObjectWithProperties) and interfaces (from the
 
1530
    dbus_interface_annotations decorator).
 
1531
    """
 
1532
    
 
1533
    def wrapper(cls):
 
1534
        for orig_interface_name, alt_interface_name in (
 
1535
                alt_interface_names.items()):
 
1536
            attr = {}
 
1537
            interface_names = set()
 
1538
            # Go though all attributes of the class
 
1539
            for attrname, attribute in inspect.getmembers(cls):
 
1540
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
1541
                # with the wrong interface name
 
1542
                if (not hasattr(attribute, "_dbus_interface")
 
1543
                    or not attribute._dbus_interface.startswith(
 
1544
                        orig_interface_name)):
 
1545
                    continue
 
1546
                # Create an alternate D-Bus interface name based on
 
1547
                # the current name
 
1548
                alt_interface = attribute._dbus_interface.replace(
 
1549
                    orig_interface_name, alt_interface_name)
 
1550
                interface_names.add(alt_interface)
 
1551
                # Is this a D-Bus signal?
 
1552
                if getattr(attribute, "_dbus_is_signal", False):
 
1553
                    # Extract the original non-method undecorated
 
1554
                    # function by black magic
 
1555
                    if sys.version_info.major == 2:
 
1556
                        nonmethod_func = (dict(
 
1557
                            zip(attribute.func_code.co_freevars,
 
1558
                                attribute.__closure__))
 
1559
                                          ["func"].cell_contents)
 
1560
                    else:
 
1561
                        nonmethod_func = (dict(
 
1562
                            zip(attribute.__code__.co_freevars,
 
1563
                                attribute.__closure__))
 
1564
                                          ["func"].cell_contents)
 
1565
                    # Create a new, but exactly alike, function
 
1566
                    # object, and decorate it to be a new D-Bus signal
 
1567
                    # with the alternate D-Bus interface name
 
1568
                    new_function = copy_function(nonmethod_func)
 
1569
                    new_function = (dbus.service.signal(
 
1570
                        alt_interface,
 
1571
                        attribute._dbus_signature)(new_function))
 
1572
                    # Copy annotations, if any
 
1573
                    try:
 
1574
                        new_function._dbus_annotations = dict(
 
1575
                            attribute._dbus_annotations)
 
1576
                    except AttributeError:
 
1577
                        pass
 
1578
                    # Define a creator of a function to call both the
 
1579
                    # original and alternate functions, so both the
 
1580
                    # original and alternate signals gets sent when
 
1581
                    # the function is called
 
1582
                    def fixscope(func1, func2):
 
1583
                        """This function is a scope container to pass
 
1584
                        func1 and func2 to the "call_both" function
 
1585
                        outside of its arguments"""
 
1586
                        
 
1587
                        @functools.wraps(func2)
 
1588
                        def call_both(*args, **kwargs):
 
1589
                            """This function will emit two D-Bus
 
1590
                            signals by calling func1 and func2"""
 
1591
                            func1(*args, **kwargs)
 
1592
                            func2(*args, **kwargs)
 
1593
                        # Make wrapper function look like a D-Bus signal
 
1594
                        for name, attr in inspect.getmembers(func2):
 
1595
                            if name.startswith("_dbus_"):
 
1596
                                setattr(call_both, name, attr)
 
1597
                        
 
1598
                        return call_both
 
1599
                    # Create the "call_both" function and add it to
 
1600
                    # the class
 
1601
                    attr[attrname] = fixscope(attribute, new_function)
 
1602
                # Is this a D-Bus method?
 
1603
                elif getattr(attribute, "_dbus_is_method", False):
 
1604
                    # Create a new, but exactly alike, function
 
1605
                    # object.  Decorate it to be a new D-Bus method
 
1606
                    # with the alternate D-Bus interface name.  Add it
 
1607
                    # to the class.
 
1608
                    attr[attrname] = (
 
1609
                        dbus.service.method(
 
1610
                            alt_interface,
 
1611
                            attribute._dbus_in_signature,
 
1612
                            attribute._dbus_out_signature)
 
1613
                        (copy_function(attribute)))
 
1614
                    # Copy annotations, if any
 
1615
                    try:
 
1616
                        attr[attrname]._dbus_annotations = dict(
 
1617
                            attribute._dbus_annotations)
 
1618
                    except AttributeError:
 
1619
                        pass
 
1620
                # Is this a D-Bus property?
 
1621
                elif getattr(attribute, "_dbus_is_property", False):
 
1622
                    # Create a new, but exactly alike, function
 
1623
                    # object, and decorate it to be a new D-Bus
 
1624
                    # property with the alternate D-Bus interface
 
1625
                    # name.  Add it to the class.
 
1626
                    attr[attrname] = (dbus_service_property(
 
1627
                        alt_interface, attribute._dbus_signature,
 
1628
                        attribute._dbus_access,
 
1629
                        attribute._dbus_get_args_options
 
1630
                        ["byte_arrays"])
 
1631
                                      (copy_function(attribute)))
 
1632
                    # Copy annotations, if any
 
1633
                    try:
 
1634
                        attr[attrname]._dbus_annotations = dict(
 
1635
                            attribute._dbus_annotations)
 
1636
                    except AttributeError:
 
1637
                        pass
 
1638
                # Is this a D-Bus interface?
 
1639
                elif getattr(attribute, "_dbus_is_interface", False):
 
1640
                    # Create a new, but exactly alike, function
 
1641
                    # object.  Decorate it to be a new D-Bus interface
 
1642
                    # with the alternate D-Bus interface name.  Add it
 
1643
                    # to the class.
 
1644
                    attr[attrname] = (
 
1645
                        dbus_interface_annotations(alt_interface)
 
1646
                        (copy_function(attribute)))
 
1647
            if deprecate:
 
1648
                # Deprecate all alternate interfaces
 
1649
                iname="_AlternateDBusNames_interface_annotation{}"
 
1650
                for interface_name in interface_names:
 
1651
                    
 
1652
                    @dbus_interface_annotations(interface_name)
 
1653
                    def func(self):
 
1654
                        return { "org.freedesktop.DBus.Deprecated":
 
1655
                                 "true" }
 
1656
                    # Find an unused name
 
1657
                    for aname in (iname.format(i)
 
1658
                                  for i in itertools.count()):
 
1659
                        if aname not in attr:
 
1660
                            attr[aname] = func
 
1661
                            break
 
1662
            if interface_names:
 
1663
                # Replace the class with a new subclass of it with
 
1664
                # methods, signals, etc. as created above.
 
1665
                if sys.version_info.major == 2:
 
1666
                    cls = type(b"{}Alternate".format(cls.__name__),
 
1667
                               (cls, ), attr)
 
1668
                else:
 
1669
                    cls = type("{}Alternate".format(cls.__name__),
 
1670
                               (cls, ), attr)
 
1671
        return cls
 
1672
    
 
1673
    return wrapper
 
1674
 
 
1675
 
 
1676
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1677
                            "se.bsnet.fukt.Mandos"})
740
1678
class ClientDBus(Client, DBusObjectWithProperties):
741
1679
    """A Client class using D-Bus
742
1680
    
746
1684
    """
747
1685
    
748
1686
    runtime_expansions = (Client.runtime_expansions
749
 
                          + ("dbus_object_path",))
 
1687
                          + ("dbus_object_path", ))
 
1688
    
 
1689
    _interface = "se.recompile.Mandos.Client"
750
1690
    
751
1691
    # dbus.service.Object doesn't use super(), so we can't either.
752
1692
    
753
1693
    def __init__(self, bus = None, *args, **kwargs):
754
 
        self._approvals_pending = 0
755
1694
        self.bus = bus
756
1695
        Client.__init__(self, *args, **kwargs)
757
1696
        # Only now, when this client is initialized, can it show up on
758
1697
        # the D-Bus
759
 
        client_object_name = unicode(self.name).translate(
 
1698
        client_object_name = str(self.name).translate(
760
1699
            {ord("."): ord("_"),
761
1700
             ord("-"): ord("_")})
762
 
        self.dbus_object_path = (dbus.ObjectPath
763
 
                                 ("/clients/" + client_object_name))
 
1701
        self.dbus_object_path = dbus.ObjectPath(
 
1702
            "/clients/" + client_object_name)
764
1703
        DBusObjectWithProperties.__init__(self, self.bus,
765
1704
                                          self.dbus_object_path)
766
 
        
767
 
    def _get_approvals_pending(self):
768
 
        return self._approvals_pending
769
 
    def _set_approvals_pending(self, value):
770
 
        old_value = self._approvals_pending
771
 
        self._approvals_pending = value
772
 
        bval = bool(value)
773
 
        if (hasattr(self, "dbus_object_path")
774
 
            and bval is not bool(old_value)):
775
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
776
 
            self.PropertyChanged(dbus.String("ApprovalPending"),
777
 
                                 dbus_bool)
778
 
 
779
 
    approvals_pending = property(_get_approvals_pending,
780
 
                                 _set_approvals_pending)
781
 
    del _get_approvals_pending, _set_approvals_pending
782
 
    
783
 
    @staticmethod
784
 
    def _datetime_to_dbus(dt, variant_level=0):
785
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
786
 
        return dbus.String(dt.isoformat(),
787
 
                           variant_level=variant_level)
788
 
    
789
 
    def enable(self):
790
 
        oldstate = getattr(self, "enabled", False)
791
 
        r = Client.enable(self)
792
 
        if oldstate != self.enabled:
793
 
            # Emit D-Bus signals
794
 
            self.PropertyChanged(dbus.String("Enabled"),
795
 
                                 dbus.Boolean(True, variant_level=1))
796
 
            self.PropertyChanged(
797
 
                dbus.String("LastEnabled"),
798
 
                self._datetime_to_dbus(self.last_enabled,
799
 
                                       variant_level=1))
800
 
        return r
801
 
    
802
 
    def disable(self, quiet = False):
803
 
        oldstate = getattr(self, "enabled", False)
804
 
        r = Client.disable(self, quiet=quiet)
805
 
        if not quiet and oldstate != self.enabled:
806
 
            # Emit D-Bus signal
807
 
            self.PropertyChanged(dbus.String("Enabled"),
808
 
                                 dbus.Boolean(False, variant_level=1))
809
 
        return r
 
1705
    
 
1706
    def notifychangeproperty(transform_func, dbus_name,
 
1707
                             type_func=lambda x: x,
 
1708
                             variant_level=1,
 
1709
                             invalidate_only=False,
 
1710
                             _interface=_interface):
 
1711
        """ Modify a variable so that it's a property which announces
 
1712
        its changes to DBus.
 
1713
        
 
1714
        transform_fun: Function that takes a value and a variant_level
 
1715
                       and transforms it to a D-Bus type.
 
1716
        dbus_name: D-Bus name of the variable
 
1717
        type_func: Function that transform the value before sending it
 
1718
                   to the D-Bus.  Default: no transform
 
1719
        variant_level: D-Bus variant level.  Default: 1
 
1720
        """
 
1721
        attrname = "_{}".format(dbus_name)
 
1722
        
 
1723
        def setter(self, value):
 
1724
            if hasattr(self, "dbus_object_path"):
 
1725
                if (not hasattr(self, attrname) or
 
1726
                    type_func(getattr(self, attrname, None))
 
1727
                    != type_func(value)):
 
1728
                    if invalidate_only:
 
1729
                        self.PropertiesChanged(
 
1730
                            _interface, dbus.Dictionary(),
 
1731
                            dbus.Array((dbus_name, )))
 
1732
                    else:
 
1733
                        dbus_value = transform_func(
 
1734
                            type_func(value),
 
1735
                            variant_level = variant_level)
 
1736
                        self.PropertyChanged(dbus.String(dbus_name),
 
1737
                                             dbus_value)
 
1738
                        self.PropertiesChanged(
 
1739
                            _interface,
 
1740
                            dbus.Dictionary({ dbus.String(dbus_name):
 
1741
                                              dbus_value }),
 
1742
                            dbus.Array())
 
1743
            setattr(self, attrname, value)
 
1744
        
 
1745
        return property(lambda self: getattr(self, attrname), setter)
 
1746
    
 
1747
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1748
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1749
                                             "ApprovalPending",
 
1750
                                             type_func = bool)
 
1751
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1752
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1753
                                        "LastEnabled")
 
1754
    checker = notifychangeproperty(
 
1755
        dbus.Boolean, "CheckerRunning",
 
1756
        type_func = lambda checker: checker is not None)
 
1757
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1758
                                           "LastCheckedOK")
 
1759
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1760
                                               "LastCheckerStatus")
 
1761
    last_approval_request = notifychangeproperty(
 
1762
        datetime_to_dbus, "LastApprovalRequest")
 
1763
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1764
                                               "ApprovedByDefault")
 
1765
    approval_delay = notifychangeproperty(
 
1766
        dbus.UInt64, "ApprovalDelay",
 
1767
        type_func = lambda td: td.total_seconds() * 1000)
 
1768
    approval_duration = notifychangeproperty(
 
1769
        dbus.UInt64, "ApprovalDuration",
 
1770
        type_func = lambda td: td.total_seconds() * 1000)
 
1771
    host = notifychangeproperty(dbus.String, "Host")
 
1772
    timeout = notifychangeproperty(
 
1773
        dbus.UInt64, "Timeout",
 
1774
        type_func = lambda td: td.total_seconds() * 1000)
 
1775
    extended_timeout = notifychangeproperty(
 
1776
        dbus.UInt64, "ExtendedTimeout",
 
1777
        type_func = lambda td: td.total_seconds() * 1000)
 
1778
    interval = notifychangeproperty(
 
1779
        dbus.UInt64, "Interval",
 
1780
        type_func = lambda td: td.total_seconds() * 1000)
 
1781
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1782
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
 
1783
                                  invalidate_only=True)
 
1784
    
 
1785
    del notifychangeproperty
810
1786
    
811
1787
    def __del__(self, *args, **kwargs):
812
1788
        try:
817
1793
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
818
1794
        Client.__del__(self, *args, **kwargs)
819
1795
    
820
 
    def checker_callback(self, pid, condition, command,
821
 
                         *args, **kwargs):
822
 
        self.checker_callback_tag = None
823
 
        self.checker = None
824
 
        # Emit D-Bus signal
825
 
        self.PropertyChanged(dbus.String("CheckerRunning"),
826
 
                             dbus.Boolean(False, variant_level=1))
827
 
        if os.WIFEXITED(condition):
828
 
            exitstatus = os.WEXITSTATUS(condition)
 
1796
    def checker_callback(self, source, condition,
 
1797
                         connection, command, *args, **kwargs):
 
1798
        ret = Client.checker_callback(self, source, condition,
 
1799
                                      connection, command, *args,
 
1800
                                      **kwargs)
 
1801
        exitstatus = self.last_checker_status
 
1802
        if exitstatus >= 0:
829
1803
            # Emit D-Bus signal
830
1804
            self.CheckerCompleted(dbus.Int16(exitstatus),
831
 
                                  dbus.Int64(condition),
 
1805
                                  # This is specific to GNU libC
 
1806
                                  dbus.Int64(exitstatus << 8),
832
1807
                                  dbus.String(command))
833
1808
        else:
834
1809
            # Emit D-Bus signal
835
1810
            self.CheckerCompleted(dbus.Int16(-1),
836
 
                                  dbus.Int64(condition),
 
1811
                                  dbus.Int64(
 
1812
                                      # This is specific to GNU libC
 
1813
                                      (exitstatus << 8)
 
1814
                                      | self.last_checker_signal),
837
1815
                                  dbus.String(command))
838
 
        
839
 
        return Client.checker_callback(self, pid, condition, command,
840
 
                                       *args, **kwargs)
841
 
    
842
 
    def checked_ok(self, *args, **kwargs):
843
 
        Client.checked_ok(self, *args, **kwargs)
844
 
        # Emit D-Bus signal
845
 
        self.PropertyChanged(
846
 
            dbus.String("LastCheckedOK"),
847
 
            (self._datetime_to_dbus(self.last_checked_ok,
848
 
                                    variant_level=1)))
849
 
    
850
 
    def need_approval(self, *args, **kwargs):
851
 
        r = Client.need_approval(self, *args, **kwargs)
852
 
        # Emit D-Bus signal
853
 
        self.PropertyChanged(
854
 
            dbus.String("LastApprovalRequest"),
855
 
            (self._datetime_to_dbus(self.last_approval_request,
856
 
                                    variant_level=1)))
857
 
        return r
 
1816
        return ret
858
1817
    
859
1818
    def start_checker(self, *args, **kwargs):
860
 
        old_checker = self.checker
861
 
        if self.checker is not None:
862
 
            old_checker_pid = self.checker.pid
863
 
        else:
864
 
            old_checker_pid = None
 
1819
        old_checker_pid = getattr(self.checker, "pid", None)
865
1820
        r = Client.start_checker(self, *args, **kwargs)
866
1821
        # Only if new checker process was started
867
1822
        if (self.checker is not None
868
1823
            and old_checker_pid != self.checker.pid):
869
1824
            # Emit D-Bus signal
870
1825
            self.CheckerStarted(self.current_checker_command)
871
 
            self.PropertyChanged(
872
 
                dbus.String("CheckerRunning"),
873
 
                dbus.Boolean(True, variant_level=1))
874
1826
        return r
875
1827
    
876
 
    def stop_checker(self, *args, **kwargs):
877
 
        old_checker = getattr(self, "checker", None)
878
 
        r = Client.stop_checker(self, *args, **kwargs)
879
 
        if (old_checker is not None
880
 
            and getattr(self, "checker", None) is None):
881
 
            self.PropertyChanged(dbus.String("CheckerRunning"),
882
 
                                 dbus.Boolean(False, variant_level=1))
883
 
        return r
884
 
 
885
1828
    def _reset_approved(self):
886
 
        self._approved = None
 
1829
        self.approved = None
887
1830
        return False
888
1831
    
889
1832
    def approve(self, value=True):
 
1833
        self.approved = value
 
1834
        GLib.timeout_add(int(self.approval_duration.total_seconds()
 
1835
                             * 1000), self._reset_approved)
890
1836
        self.send_changedstate()
891
 
        self._approved = value
892
 
        gobject.timeout_add(self._timedelta_to_milliseconds
893
 
                            (self.approval_duration),
894
 
                            self._reset_approved)
895
 
    
896
1837
    
897
1838
    ## D-Bus methods, signals & properties
898
 
    _interface = "se.bsnet.fukt.Mandos.Client"
 
1839
    
 
1840
    ## Interfaces
899
1841
    
900
1842
    ## Signals
901
1843
    
912
1854
        pass
913
1855
    
914
1856
    # PropertyChanged - signal
 
1857
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
915
1858
    @dbus.service.signal(_interface, signature="sv")
916
1859
    def PropertyChanged(self, property, value):
917
1860
        "D-Bus signal"
951
1894
        self.checked_ok()
952
1895
    
953
1896
    # Enable - method
 
1897
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
954
1898
    @dbus.service.method(_interface)
955
1899
    def Enable(self):
956
1900
        "D-Bus method"
957
1901
        self.enable()
958
1902
    
959
1903
    # StartChecker - method
 
1904
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
960
1905
    @dbus.service.method(_interface)
961
1906
    def StartChecker(self):
962
1907
        "D-Bus method"
963
1908
        self.start_checker()
964
1909
    
965
1910
    # Disable - method
 
1911
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
966
1912
    @dbus.service.method(_interface)
967
1913
    def Disable(self):
968
1914
        "D-Bus method"
969
1915
        self.disable()
970
1916
    
971
1917
    # StopChecker - method
 
1918
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
972
1919
    @dbus.service.method(_interface)
973
1920
    def StopChecker(self):
974
1921
        self.stop_checker()
981
1928
        return dbus.Boolean(bool(self.approvals_pending))
982
1929
    
983
1930
    # ApprovedByDefault - property
984
 
    @dbus_service_property(_interface, signature="b",
 
1931
    @dbus_service_property(_interface,
 
1932
                           signature="b",
985
1933
                           access="readwrite")
986
1934
    def ApprovedByDefault_dbus_property(self, value=None):
987
1935
        if value is None:       # get
988
1936
            return dbus.Boolean(self.approved_by_default)
989
1937
        self.approved_by_default = bool(value)
990
 
        # Emit D-Bus signal
991
 
        self.PropertyChanged(dbus.String("ApprovedByDefault"),
992
 
                             dbus.Boolean(value, variant_level=1))
993
1938
    
994
1939
    # ApprovalDelay - property
995
 
    @dbus_service_property(_interface, signature="t",
 
1940
    @dbus_service_property(_interface,
 
1941
                           signature="t",
996
1942
                           access="readwrite")
997
1943
    def ApprovalDelay_dbus_property(self, value=None):
998
1944
        if value is None:       # get
999
 
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1945
            return dbus.UInt64(self.approval_delay.total_seconds()
 
1946
                               * 1000)
1000
1947
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1001
 
        # Emit D-Bus signal
1002
 
        self.PropertyChanged(dbus.String("ApprovalDelay"),
1003
 
                             dbus.UInt64(value, variant_level=1))
1004
1948
    
1005
1949
    # ApprovalDuration - property
1006
 
    @dbus_service_property(_interface, signature="t",
 
1950
    @dbus_service_property(_interface,
 
1951
                           signature="t",
1007
1952
                           access="readwrite")
1008
1953
    def ApprovalDuration_dbus_property(self, value=None):
1009
1954
        if value is None:       # get
1010
 
            return dbus.UInt64(self._timedelta_to_milliseconds(
1011
 
                    self.approval_duration))
 
1955
            return dbus.UInt64(self.approval_duration.total_seconds()
 
1956
                               * 1000)
1012
1957
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1013
 
        # Emit D-Bus signal
1014
 
        self.PropertyChanged(dbus.String("ApprovalDuration"),
1015
 
                             dbus.UInt64(value, variant_level=1))
1016
1958
    
1017
1959
    # Name - property
 
1960
    @dbus_annotations(
 
1961
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1018
1962
    @dbus_service_property(_interface, signature="s", access="read")
1019
1963
    def Name_dbus_property(self):
1020
1964
        return dbus.String(self.name)
1021
1965
    
1022
1966
    # Fingerprint - property
 
1967
    @dbus_annotations(
 
1968
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1023
1969
    @dbus_service_property(_interface, signature="s", access="read")
1024
1970
    def Fingerprint_dbus_property(self):
1025
1971
        return dbus.String(self.fingerprint)
1026
1972
    
1027
1973
    # Host - property
1028
 
    @dbus_service_property(_interface, signature="s",
 
1974
    @dbus_service_property(_interface,
 
1975
                           signature="s",
1029
1976
                           access="readwrite")
1030
1977
    def Host_dbus_property(self, value=None):
1031
1978
        if value is None:       # get
1032
1979
            return dbus.String(self.host)
1033
 
        self.host = value
1034
 
        # Emit D-Bus signal
1035
 
        self.PropertyChanged(dbus.String("Host"),
1036
 
                             dbus.String(value, variant_level=1))
 
1980
        self.host = str(value)
1037
1981
    
1038
1982
    # Created - property
 
1983
    @dbus_annotations(
 
1984
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1039
1985
    @dbus_service_property(_interface, signature="s", access="read")
1040
1986
    def Created_dbus_property(self):
1041
 
        return dbus.String(self._datetime_to_dbus(self.created))
 
1987
        return datetime_to_dbus(self.created)
1042
1988
    
1043
1989
    # LastEnabled - property
1044
1990
    @dbus_service_property(_interface, signature="s", access="read")
1045
1991
    def LastEnabled_dbus_property(self):
1046
 
        if self.last_enabled is None:
1047
 
            return dbus.String("")
1048
 
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
1992
        return datetime_to_dbus(self.last_enabled)
1049
1993
    
1050
1994
    # Enabled - property
1051
 
    @dbus_service_property(_interface, signature="b",
 
1995
    @dbus_service_property(_interface,
 
1996
                           signature="b",
1052
1997
                           access="readwrite")
1053
1998
    def Enabled_dbus_property(self, value=None):
1054
1999
        if value is None:       # get
1059
2004
            self.disable()
1060
2005
    
1061
2006
    # LastCheckedOK - property
1062
 
    @dbus_service_property(_interface, signature="s",
 
2007
    @dbus_service_property(_interface,
 
2008
                           signature="s",
1063
2009
                           access="readwrite")
1064
2010
    def LastCheckedOK_dbus_property(self, value=None):
1065
2011
        if value is not None:
1066
2012
            self.checked_ok()
1067
2013
            return
1068
 
        if self.last_checked_ok is None:
1069
 
            return dbus.String("")
1070
 
        return dbus.String(self._datetime_to_dbus(self
1071
 
                                                  .last_checked_ok))
 
2014
        return datetime_to_dbus(self.last_checked_ok)
 
2015
    
 
2016
    # LastCheckerStatus - property
 
2017
    @dbus_service_property(_interface, signature="n", access="read")
 
2018
    def LastCheckerStatus_dbus_property(self):
 
2019
        return dbus.Int16(self.last_checker_status)
 
2020
    
 
2021
    # Expires - property
 
2022
    @dbus_service_property(_interface, signature="s", access="read")
 
2023
    def Expires_dbus_property(self):
 
2024
        return datetime_to_dbus(self.expires)
1072
2025
    
1073
2026
    # LastApprovalRequest - property
1074
2027
    @dbus_service_property(_interface, signature="s", access="read")
1075
2028
    def LastApprovalRequest_dbus_property(self):
1076
 
        if self.last_approval_request is None:
1077
 
            return dbus.String("")
1078
 
        return dbus.String(self.
1079
 
                           _datetime_to_dbus(self
1080
 
                                             .last_approval_request))
 
2029
        return datetime_to_dbus(self.last_approval_request)
1081
2030
    
1082
2031
    # Timeout - property
1083
 
    @dbus_service_property(_interface, signature="t",
 
2032
    @dbus_service_property(_interface,
 
2033
                           signature="t",
1084
2034
                           access="readwrite")
1085
2035
    def Timeout_dbus_property(self, value=None):
1086
2036
        if value is None:       # get
1087
 
            return dbus.UInt64(self.timeout_milliseconds())
 
2037
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
 
2038
        old_timeout = self.timeout
1088
2039
        self.timeout = datetime.timedelta(0, 0, 0, value)
1089
 
        # Emit D-Bus signal
1090
 
        self.PropertyChanged(dbus.String("Timeout"),
1091
 
                             dbus.UInt64(value, variant_level=1))
1092
 
        if getattr(self, "disable_initiator_tag", None) is None:
1093
 
            return
1094
 
        # Reschedule timeout
1095
 
        gobject.source_remove(self.disable_initiator_tag)
1096
 
        self.disable_initiator_tag = None
1097
 
        time_to_die = (self.
1098
 
                       _timedelta_to_milliseconds((self
1099
 
                                                   .last_checked_ok
1100
 
                                                   + self.timeout)
1101
 
                                                  - datetime.datetime
1102
 
                                                  .utcnow()))
1103
 
        if time_to_die <= 0:
1104
 
            # The timeout has passed
1105
 
            self.disable()
1106
 
        else:
1107
 
            self.disable_initiator_tag = (gobject.timeout_add
1108
 
                                          (time_to_die, self.disable))
 
2040
        # Reschedule disabling
 
2041
        if self.enabled:
 
2042
            now = datetime.datetime.utcnow()
 
2043
            self.expires += self.timeout - old_timeout
 
2044
            if self.expires <= now:
 
2045
                # The timeout has passed
 
2046
                self.disable()
 
2047
            else:
 
2048
                if (getattr(self, "disable_initiator_tag", None)
 
2049
                    is None):
 
2050
                    return
 
2051
                GLib.source_remove(self.disable_initiator_tag)
 
2052
                self.disable_initiator_tag = GLib.timeout_add(
 
2053
                    int((self.expires - now).total_seconds() * 1000),
 
2054
                    self.disable)
 
2055
    
 
2056
    # ExtendedTimeout - property
 
2057
    @dbus_service_property(_interface,
 
2058
                           signature="t",
 
2059
                           access="readwrite")
 
2060
    def ExtendedTimeout_dbus_property(self, value=None):
 
2061
        if value is None:       # get
 
2062
            return dbus.UInt64(self.extended_timeout.total_seconds()
 
2063
                               * 1000)
 
2064
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1109
2065
    
1110
2066
    # Interval - property
1111
 
    @dbus_service_property(_interface, signature="t",
 
2067
    @dbus_service_property(_interface,
 
2068
                           signature="t",
1112
2069
                           access="readwrite")
1113
2070
    def Interval_dbus_property(self, value=None):
1114
2071
        if value is None:       # get
1115
 
            return dbus.UInt64(self.interval_milliseconds())
 
2072
            return dbus.UInt64(self.interval.total_seconds() * 1000)
1116
2073
        self.interval = datetime.timedelta(0, 0, 0, value)
1117
 
        # Emit D-Bus signal
1118
 
        self.PropertyChanged(dbus.String("Interval"),
1119
 
                             dbus.UInt64(value, variant_level=1))
1120
2074
        if getattr(self, "checker_initiator_tag", None) is None:
1121
2075
            return
1122
 
        # Reschedule checker run
1123
 
        gobject.source_remove(self.checker_initiator_tag)
1124
 
        self.checker_initiator_tag = (gobject.timeout_add
1125
 
                                      (value, self.start_checker))
1126
 
        self.start_checker()    # Start one now, too
1127
 
 
 
2076
        if self.enabled:
 
2077
            # Reschedule checker run
 
2078
            GLib.source_remove(self.checker_initiator_tag)
 
2079
            self.checker_initiator_tag = GLib.timeout_add(
 
2080
                value, self.start_checker)
 
2081
            self.start_checker() # Start one now, too
 
2082
    
1128
2083
    # Checker - property
1129
 
    @dbus_service_property(_interface, signature="s",
 
2084
    @dbus_service_property(_interface,
 
2085
                           signature="s",
1130
2086
                           access="readwrite")
1131
2087
    def Checker_dbus_property(self, value=None):
1132
2088
        if value is None:       # get
1133
2089
            return dbus.String(self.checker_command)
1134
 
        self.checker_command = value
1135
 
        # Emit D-Bus signal
1136
 
        self.PropertyChanged(dbus.String("Checker"),
1137
 
                             dbus.String(self.checker_command,
1138
 
                                         variant_level=1))
 
2090
        self.checker_command = str(value)
1139
2091
    
1140
2092
    # CheckerRunning - property
1141
 
    @dbus_service_property(_interface, signature="b",
 
2093
    @dbus_service_property(_interface,
 
2094
                           signature="b",
1142
2095
                           access="readwrite")
1143
2096
    def CheckerRunning_dbus_property(self, value=None):
1144
2097
        if value is None:       # get
1149
2102
            self.stop_checker()
1150
2103
    
1151
2104
    # ObjectPath - property
 
2105
    @dbus_annotations(
 
2106
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
 
2107
         "org.freedesktop.DBus.Deprecated": "true"})
1152
2108
    @dbus_service_property(_interface, signature="o", access="read")
1153
2109
    def ObjectPath_dbus_property(self):
1154
2110
        return self.dbus_object_path # is already a dbus.ObjectPath
1155
2111
    
1156
2112
    # Secret = property
1157
 
    @dbus_service_property(_interface, signature="ay",
1158
 
                           access="write", byte_arrays=True)
 
2113
    @dbus_annotations(
 
2114
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
 
2115
         "invalidates"})
 
2116
    @dbus_service_property(_interface,
 
2117
                           signature="ay",
 
2118
                           access="write",
 
2119
                           byte_arrays=True)
1159
2120
    def Secret_dbus_property(self, value):
1160
 
        self.secret = str(value)
 
2121
        self.secret = bytes(value)
1161
2122
    
1162
2123
    del _interface
1163
2124
 
1167
2128
        self._pipe = child_pipe
1168
2129
        self._pipe.send(('init', fpr, address))
1169
2130
        if not self._pipe.recv():
1170
 
            raise KeyError()
1171
 
 
 
2131
            raise KeyError(fpr)
 
2132
    
1172
2133
    def __getattribute__(self, name):
1173
 
        if(name == '_pipe'):
 
2134
        if name == '_pipe':
1174
2135
            return super(ProxyClient, self).__getattribute__(name)
1175
2136
        self._pipe.send(('getattr', name))
1176
2137
        data = self._pipe.recv()
1177
2138
        if data[0] == 'data':
1178
2139
            return data[1]
1179
2140
        if data[0] == 'function':
 
2141
            
1180
2142
            def func(*args, **kwargs):
1181
2143
                self._pipe.send(('funcall', name, args, kwargs))
1182
2144
                return self._pipe.recv()[1]
 
2145
            
1183
2146
            return func
1184
 
 
 
2147
    
1185
2148
    def __setattr__(self, name, value):
1186
 
        if(name == '_pipe'):
 
2149
        if name == '_pipe':
1187
2150
            return super(ProxyClient, self).__setattr__(name, value)
1188
2151
        self._pipe.send(('setattr', name, value))
1189
2152
 
1197
2160
    def handle(self):
1198
2161
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1199
2162
            logger.info("TCP connection from: %s",
1200
 
                        unicode(self.client_address))
 
2163
                        str(self.client_address))
1201
2164
            logger.debug("Pipe FD: %d",
1202
2165
                         self.server.child_pipe.fileno())
1203
 
 
1204
 
            session = (gnutls.connection
1205
 
                       .ClientSession(self.request,
1206
 
                                      gnutls.connection
1207
 
                                      .X509Credentials()))
1208
 
 
1209
 
            # Note: gnutls.connection.X509Credentials is really a
1210
 
            # generic GnuTLS certificate credentials object so long as
1211
 
            # no X.509 keys are added to it.  Therefore, we can use it
1212
 
            # here despite using OpenPGP certificates.
1213
 
 
 
2166
            
 
2167
            session = gnutls.ClientSession(self.request)
 
2168
            
1214
2169
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1215
2170
            #                      "+AES-256-CBC", "+SHA1",
1216
2171
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1219
2174
            priority = self.server.gnutls_priority
1220
2175
            if priority is None:
1221
2176
                priority = "NORMAL"
1222
 
            (gnutls.library.functions
1223
 
             .gnutls_priority_set_direct(session._c_object,
1224
 
                                         priority, None))
1225
 
 
 
2177
            gnutls.priority_set_direct(session._c_object, priority,
 
2178
                                       None)
 
2179
            
1226
2180
            # Start communication using the Mandos protocol
1227
2181
            # Get protocol number
1228
2182
            line = self.request.makefile().readline()
1229
2183
            logger.debug("Protocol version: %r", line)
1230
2184
            try:
1231
2185
                if int(line.strip().split()[0]) > 1:
1232
 
                    raise RuntimeError
 
2186
                    raise RuntimeError(line)
1233
2187
            except (ValueError, IndexError, RuntimeError) as error:
1234
2188
                logger.error("Unknown protocol version: %s", error)
1235
2189
                return
1236
 
 
 
2190
            
1237
2191
            # Start GnuTLS connection
1238
2192
            try:
1239
2193
                session.handshake()
1240
 
            except gnutls.errors.GNUTLSError as error:
 
2194
            except gnutls.Error as error:
1241
2195
                logger.warning("Handshake failed: %s", error)
1242
2196
                # Do not run session.bye() here: the session is not
1243
2197
                # established.  Just abandon the request.
1244
2198
                return
1245
2199
            logger.debug("Handshake succeeded")
1246
 
 
 
2200
            
1247
2201
            approval_required = False
1248
2202
            try:
1249
2203
                try:
1250
 
                    fpr = self.fingerprint(self.peer_certificate
1251
 
                                           (session))
1252
 
                except (TypeError,
1253
 
                        gnutls.errors.GNUTLSError) as error:
 
2204
                    fpr = self.fingerprint(
 
2205
                        self.peer_certificate(session))
 
2206
                except (TypeError, gnutls.Error) as error:
1254
2207
                    logger.warning("Bad certificate: %s", error)
1255
2208
                    return
1256
2209
                logger.debug("Fingerprint: %s", fpr)
1257
 
 
 
2210
                
1258
2211
                try:
1259
2212
                    client = ProxyClient(child_pipe, fpr,
1260
2213
                                         self.client_address)
1268
2221
                
1269
2222
                while True:
1270
2223
                    if not client.enabled:
1271
 
                        logger.warning("Client %s is disabled",
1272
 
                                       client.name)
 
2224
                        logger.info("Client %s is disabled",
 
2225
                                    client.name)
1273
2226
                        if self.server.use_dbus:
1274
2227
                            # Emit D-Bus signal
1275
 
                            client.Rejected("Disabled")                    
 
2228
                            client.Rejected("Disabled")
1276
2229
                        return
1277
2230
                    
1278
 
                    if client._approved or not client.approval_delay:
 
2231
                    if client.approved or not client.approval_delay:
1279
2232
                        #We are approved or approval is disabled
1280
2233
                        break
1281
 
                    elif client._approved is None:
 
2234
                    elif client.approved is None:
1282
2235
                        logger.info("Client %s needs approval",
1283
2236
                                    client.name)
1284
2237
                        if self.server.use_dbus:
1285
2238
                            # Emit D-Bus signal
1286
2239
                            client.NeedApproval(
1287
 
                                client.approval_delay_milliseconds(),
1288
 
                                client.approved_by_default)
 
2240
                                client.approval_delay.total_seconds()
 
2241
                                * 1000, client.approved_by_default)
1289
2242
                    else:
1290
2243
                        logger.warning("Client %s was not approved",
1291
2244
                                       client.name)
1295
2248
                        return
1296
2249
                    
1297
2250
                    #wait until timeout or approved
1298
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1299
2251
                    time = datetime.datetime.now()
1300
2252
                    client.changedstate.acquire()
1301
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
2253
                    client.changedstate.wait(delay.total_seconds())
1302
2254
                    client.changedstate.release()
1303
2255
                    time2 = datetime.datetime.now()
1304
2256
                    if (time2 - time) >= delay:
1315
2267
                    else:
1316
2268
                        delay -= time2 - time
1317
2269
                
1318
 
                sent_size = 0
1319
 
                while sent_size < len(client.secret):
1320
 
                    try:
1321
 
                        sent = session.send(client.secret[sent_size:])
1322
 
                    except gnutls.errors.GNUTLSError as error:
1323
 
                        logger.warning("gnutls send failed")
1324
 
                        return
1325
 
                    logger.debug("Sent: %d, remaining: %d",
1326
 
                                 sent, len(client.secret)
1327
 
                                 - (sent_size + sent))
1328
 
                    sent_size += sent
1329
 
 
 
2270
                try:
 
2271
                    session.send(client.secret)
 
2272
                except gnutls.Error as error:
 
2273
                    logger.warning("gnutls send failed",
 
2274
                                   exc_info = error)
 
2275
                    return
 
2276
                
1330
2277
                logger.info("Sending secret to %s", client.name)
1331
 
                # bump the timeout as if seen
1332
 
                client.checked_ok()
 
2278
                # bump the timeout using extended_timeout
 
2279
                client.bump_timeout(client.extended_timeout)
1333
2280
                if self.server.use_dbus:
1334
2281
                    # Emit D-Bus signal
1335
2282
                    client.GotSecret()
1339
2286
                    client.approvals_pending -= 1
1340
2287
                try:
1341
2288
                    session.bye()
1342
 
                except gnutls.errors.GNUTLSError as error:
1343
 
                    logger.warning("GnuTLS bye failed")
 
2289
                except gnutls.Error as error:
 
2290
                    logger.warning("GnuTLS bye failed",
 
2291
                                   exc_info=error)
1344
2292
    
1345
2293
    @staticmethod
1346
2294
    def peer_certificate(session):
1347
2295
        "Return the peer's OpenPGP certificate as a bytestring"
1348
2296
        # If not an OpenPGP certificate...
1349
 
        if (gnutls.library.functions
1350
 
            .gnutls_certificate_type_get(session._c_object)
1351
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1352
 
            # ...do the normal thing
1353
 
            return session.peer_certificate
 
2297
        if (gnutls.certificate_type_get(session._c_object)
 
2298
            != gnutls.CRT_OPENPGP):
 
2299
            # ...return invalid data
 
2300
            return b""
1354
2301
        list_size = ctypes.c_uint(1)
1355
 
        cert_list = (gnutls.library.functions
1356
 
                     .gnutls_certificate_get_peers
 
2302
        cert_list = (gnutls.certificate_get_peers
1357
2303
                     (session._c_object, ctypes.byref(list_size)))
1358
2304
        if not bool(cert_list) and list_size.value != 0:
1359
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1360
 
                                            " certificate")
 
2305
            raise gnutls.Error("error getting peer certificate")
1361
2306
        if list_size.value == 0:
1362
2307
            return None
1363
2308
        cert = cert_list[0]
1367
2312
    def fingerprint(openpgp):
1368
2313
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1369
2314
        # New GnuTLS "datum" with the OpenPGP public key
1370
 
        datum = (gnutls.library.types
1371
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1372
 
                                             ctypes.POINTER
1373
 
                                             (ctypes.c_ubyte)),
1374
 
                                 ctypes.c_uint(len(openpgp))))
 
2315
        datum = gnutls.datum_t(
 
2316
            ctypes.cast(ctypes.c_char_p(openpgp),
 
2317
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2318
            ctypes.c_uint(len(openpgp)))
1375
2319
        # New empty GnuTLS certificate
1376
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1377
 
        (gnutls.library.functions
1378
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
2320
        crt = gnutls.openpgp_crt_t()
 
2321
        gnutls.openpgp_crt_init(ctypes.byref(crt))
1379
2322
        # Import the OpenPGP public key into the certificate
1380
 
        (gnutls.library.functions
1381
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1382
 
                                    gnutls.library.constants
1383
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
2323
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
 
2324
                                  gnutls.OPENPGP_FMT_RAW)
1384
2325
        # Verify the self signature in the key
1385
2326
        crtverify = ctypes.c_uint()
1386
 
        (gnutls.library.functions
1387
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1388
 
                                         ctypes.byref(crtverify)))
 
2327
        gnutls.openpgp_crt_verify_self(crt, 0,
 
2328
                                       ctypes.byref(crtverify))
1389
2329
        if crtverify.value != 0:
1390
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1391
 
            raise (gnutls.errors.CertificateSecurityError
1392
 
                   ("Verify failed"))
 
2330
            gnutls.openpgp_crt_deinit(crt)
 
2331
            raise gnutls.CertificateSecurityError("Verify failed")
1393
2332
        # New buffer for the fingerprint
1394
2333
        buf = ctypes.create_string_buffer(20)
1395
2334
        buf_len = ctypes.c_size_t()
1396
2335
        # Get the fingerprint from the certificate into the buffer
1397
 
        (gnutls.library.functions
1398
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1399
 
                                             ctypes.byref(buf_len)))
 
2336
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
2337
                                           ctypes.byref(buf_len))
1400
2338
        # Deinit the certificate
1401
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
2339
        gnutls.openpgp_crt_deinit(crt)
1402
2340
        # Convert the buffer to a Python bytestring
1403
2341
        fpr = ctypes.string_at(buf, buf_len.value)
1404
2342
        # Convert the bytestring to hexadecimal notation
1405
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
2343
        hex_fpr = binascii.hexlify(fpr).upper()
1406
2344
        return hex_fpr
1407
2345
 
1408
2346
 
1409
2347
class MultiprocessingMixIn(object):
1410
2348
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
2349
    
1411
2350
    def sub_process_main(self, request, address):
1412
2351
        try:
1413
2352
            self.finish_request(request, address)
1414
 
        except:
 
2353
        except Exception:
1415
2354
            self.handle_error(request, address)
1416
2355
        self.close_request(request)
1417
 
            
 
2356
    
1418
2357
    def process_request(self, request, address):
1419
2358
        """Start a new process to process the request."""
1420
 
        multiprocessing.Process(target = self.sub_process_main,
1421
 
                                args = (request, address)).start()
 
2359
        proc = multiprocessing.Process(target = self.sub_process_main,
 
2360
                                       args = (request, address))
 
2361
        proc.start()
 
2362
        return proc
 
2363
 
1422
2364
 
1423
2365
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1424
2366
    """ adds a pipe to the MixIn """
 
2367
    
1425
2368
    def process_request(self, request, client_address):
1426
2369
        """Overrides and wraps the original process_request().
1427
2370
        
1428
2371
        This function creates a new pipe in self.pipe
1429
2372
        """
1430
2373
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1431
 
 
1432
 
        super(MultiprocessingMixInWithPipe,
1433
 
              self).process_request(request, client_address)
 
2374
        
 
2375
        proc = MultiprocessingMixIn.process_request(self, request,
 
2376
                                                    client_address)
1434
2377
        self.child_pipe.close()
1435
 
        self.add_pipe(parent_pipe)
1436
 
 
1437
 
    def add_pipe(self, parent_pipe):
 
2378
        self.add_pipe(parent_pipe, proc)
 
2379
    
 
2380
    def add_pipe(self, parent_pipe, proc):
1438
2381
        """Dummy function; override as necessary"""
1439
 
        raise NotImplementedError
 
2382
        raise NotImplementedError()
 
2383
 
1440
2384
 
1441
2385
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1442
2386
                     socketserver.TCPServer, object):
1447
2391
        interface:      None or a network interface name (string)
1448
2392
        use_ipv6:       Boolean; to use IPv6 or not
1449
2393
    """
 
2394
    
1450
2395
    def __init__(self, server_address, RequestHandlerClass,
1451
 
                 interface=None, use_ipv6=True):
 
2396
                 interface=None,
 
2397
                 use_ipv6=True,
 
2398
                 socketfd=None):
 
2399
        """If socketfd is set, use that file descriptor instead of
 
2400
        creating a new one with socket.socket().
 
2401
        """
1452
2402
        self.interface = interface
1453
2403
        if use_ipv6:
1454
2404
            self.address_family = socket.AF_INET6
 
2405
        if socketfd is not None:
 
2406
            # Save the file descriptor
 
2407
            self.socketfd = socketfd
 
2408
            # Save the original socket.socket() function
 
2409
            self.socket_socket = socket.socket
 
2410
            # To implement --socket, we monkey patch socket.socket.
 
2411
            # 
 
2412
            # (When socketserver.TCPServer is a new-style class, we
 
2413
            # could make self.socket into a property instead of monkey
 
2414
            # patching socket.socket.)
 
2415
            # 
 
2416
            # Create a one-time-only replacement for socket.socket()
 
2417
            @functools.wraps(socket.socket)
 
2418
            def socket_wrapper(*args, **kwargs):
 
2419
                # Restore original function so subsequent calls are
 
2420
                # not affected.
 
2421
                socket.socket = self.socket_socket
 
2422
                del self.socket_socket
 
2423
                # This time only, return a new socket object from the
 
2424
                # saved file descriptor.
 
2425
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
2426
            # Replace socket.socket() function with wrapper
 
2427
            socket.socket = socket_wrapper
 
2428
        # The socketserver.TCPServer.__init__ will call
 
2429
        # socket.socket(), which might be our replacement,
 
2430
        # socket_wrapper(), if socketfd was set.
1455
2431
        socketserver.TCPServer.__init__(self, server_address,
1456
2432
                                        RequestHandlerClass)
 
2433
    
1457
2434
    def server_bind(self):
1458
2435
        """This overrides the normal server_bind() function
1459
2436
        to bind to an interface if one was specified, and also NOT to
1465
2442
                             self.interface)
1466
2443
            else:
1467
2444
                try:
1468
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1469
 
                                           SO_BINDTODEVICE,
1470
 
                                           str(self.interface
1471
 
                                               + '\0'))
 
2445
                    self.socket.setsockopt(
 
2446
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
 
2447
                        (self.interface + "\0").encode("utf-8"))
1472
2448
                except socket.error as error:
1473
 
                    if error[0] == errno.EPERM:
1474
 
                        logger.error("No permission to"
1475
 
                                     " bind to interface %s",
1476
 
                                     self.interface)
1477
 
                    elif error[0] == errno.ENOPROTOOPT:
 
2449
                    if error.errno == errno.EPERM:
 
2450
                        logger.error("No permission to bind to"
 
2451
                                     " interface %s", self.interface)
 
2452
                    elif error.errno == errno.ENOPROTOOPT:
1478
2453
                        logger.error("SO_BINDTODEVICE not available;"
1479
2454
                                     " cannot bind to interface %s",
1480
2455
                                     self.interface)
 
2456
                    elif error.errno == errno.ENODEV:
 
2457
                        logger.error("Interface %s does not exist,"
 
2458
                                     " cannot bind", self.interface)
1481
2459
                    else:
1482
2460
                        raise
1483
2461
        # Only bind(2) the socket if we really need to.
1486
2464
                if self.address_family == socket.AF_INET6:
1487
2465
                    any_address = "::" # in6addr_any
1488
2466
                else:
1489
 
                    any_address = socket.INADDR_ANY
 
2467
                    any_address = "0.0.0.0" # INADDR_ANY
1490
2468
                self.server_address = (any_address,
1491
2469
                                       self.server_address[1])
1492
2470
            elif not self.server_address[1]:
1493
 
                self.server_address = (self.server_address[0],
1494
 
                                       0)
 
2471
                self.server_address = (self.server_address[0], 0)
1495
2472
#                 if self.interface:
1496
2473
#                     self.server_address = (self.server_address[0],
1497
2474
#                                            0, # port
1509
2486
        gnutls_priority GnuTLS priority string
1510
2487
        use_dbus:       Boolean; to emit D-Bus signals or not
1511
2488
    
1512
 
    Assumes a gobject.MainLoop event loop.
 
2489
    Assumes a GLib.MainLoop event loop.
1513
2490
    """
 
2491
    
1514
2492
    def __init__(self, server_address, RequestHandlerClass,
1515
 
                 interface=None, use_ipv6=True, clients=None,
1516
 
                 gnutls_priority=None, use_dbus=True):
 
2493
                 interface=None,
 
2494
                 use_ipv6=True,
 
2495
                 clients=None,
 
2496
                 gnutls_priority=None,
 
2497
                 use_dbus=True,
 
2498
                 socketfd=None):
1517
2499
        self.enabled = False
1518
2500
        self.clients = clients
1519
2501
        if self.clients is None:
1520
 
            self.clients = set()
 
2502
            self.clients = {}
1521
2503
        self.use_dbus = use_dbus
1522
2504
        self.gnutls_priority = gnutls_priority
1523
2505
        IPv6_TCPServer.__init__(self, server_address,
1524
2506
                                RequestHandlerClass,
1525
2507
                                interface = interface,
1526
 
                                use_ipv6 = use_ipv6)
 
2508
                                use_ipv6 = use_ipv6,
 
2509
                                socketfd = socketfd)
 
2510
    
1527
2511
    def server_activate(self):
1528
2512
        if self.enabled:
1529
2513
            return socketserver.TCPServer.server_activate(self)
 
2514
    
1530
2515
    def enable(self):
1531
2516
        self.enabled = True
1532
 
    def add_pipe(self, parent_pipe):
 
2517
    
 
2518
    def add_pipe(self, parent_pipe, proc):
1533
2519
        # Call "handle_ipc" for both data and EOF events
1534
 
        gobject.io_add_watch(parent_pipe.fileno(),
1535
 
                             gobject.IO_IN | gobject.IO_HUP,
1536
 
                             functools.partial(self.handle_ipc,
1537
 
                                               parent_pipe = parent_pipe))
1538
 
        
1539
 
    def handle_ipc(self, source, condition, parent_pipe=None,
 
2520
        GLib.io_add_watch(
 
2521
            parent_pipe.fileno(),
 
2522
            GLib.IO_IN | GLib.IO_HUP,
 
2523
            functools.partial(self.handle_ipc,
 
2524
                              parent_pipe = parent_pipe,
 
2525
                              proc = proc))
 
2526
    
 
2527
    def handle_ipc(self, source, condition,
 
2528
                   parent_pipe=None,
 
2529
                   proc = None,
1540
2530
                   client_object=None):
1541
 
        condition_names = {
1542
 
            gobject.IO_IN: "IN",   # There is data to read.
1543
 
            gobject.IO_OUT: "OUT", # Data can be written (without
1544
 
                                    # blocking).
1545
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1546
 
            gobject.IO_ERR: "ERR", # Error condition.
1547
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1548
 
                                    # broken, usually for pipes and
1549
 
                                    # sockets).
1550
 
            }
1551
 
        conditions_string = ' | '.join(name
1552
 
                                       for cond, name in
1553
 
                                       condition_names.iteritems()
1554
 
                                       if cond & condition)
1555
 
        # error or the other end of multiprocessing.Pipe has closed
1556
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
2531
        # error, or the other end of multiprocessing.Pipe has closed
 
2532
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
 
2533
            # Wait for other process to exit
 
2534
            proc.join()
1557
2535
            return False
1558
2536
        
1559
2537
        # Read a request from the child
1564
2542
            fpr = request[1]
1565
2543
            address = request[2]
1566
2544
            
1567
 
            for c in self.clients:
 
2545
            for c in self.clients.values():
1568
2546
                if c.fingerprint == fpr:
1569
2547
                    client = c
1570
2548
                    break
1571
2549
            else:
1572
 
                logger.warning("Client not found for fingerprint: %s, ad"
1573
 
                               "dress: %s", fpr, address)
 
2550
                logger.info("Client not found for fingerprint: %s, ad"
 
2551
                            "dress: %s", fpr, address)
1574
2552
                if self.use_dbus:
1575
2553
                    # Emit D-Bus signal
1576
 
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
2554
                    mandos_dbus_service.ClientNotFound(fpr,
 
2555
                                                       address[0])
1577
2556
                parent_pipe.send(False)
1578
2557
                return False
1579
2558
            
1580
 
            gobject.io_add_watch(parent_pipe.fileno(),
1581
 
                                 gobject.IO_IN | gobject.IO_HUP,
1582
 
                                 functools.partial(self.handle_ipc,
1583
 
                                                   parent_pipe = parent_pipe,
1584
 
                                                   client_object = client))
 
2559
            GLib.io_add_watch(
 
2560
                parent_pipe.fileno(),
 
2561
                GLib.IO_IN | GLib.IO_HUP,
 
2562
                functools.partial(self.handle_ipc,
 
2563
                                  parent_pipe = parent_pipe,
 
2564
                                  proc = proc,
 
2565
                                  client_object = client))
1585
2566
            parent_pipe.send(True)
1586
 
            # remove the old hook in favor of the new above hook on same fileno
 
2567
            # remove the old hook in favor of the new above hook on
 
2568
            # same fileno
1587
2569
            return False
1588
2570
        if command == 'funcall':
1589
2571
            funcname = request[1]
1590
2572
            args = request[2]
1591
2573
            kwargs = request[3]
1592
2574
            
1593
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1594
 
 
 
2575
            parent_pipe.send(('data', getattr(client_object,
 
2576
                                              funcname)(*args,
 
2577
                                                        **kwargs)))
 
2578
        
1595
2579
        if command == 'getattr':
1596
2580
            attrname = request[1]
1597
 
            if callable(client_object.__getattribute__(attrname)):
1598
 
                parent_pipe.send(('function',))
 
2581
            if isinstance(client_object.__getattribute__(attrname),
 
2582
                          collections.Callable):
 
2583
                parent_pipe.send(('function', ))
1599
2584
            else:
1600
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
2585
                parent_pipe.send((
 
2586
                    'data', client_object.__getattribute__(attrname)))
1601
2587
        
1602
2588
        if command == 'setattr':
1603
2589
            attrname = request[1]
1604
2590
            value = request[2]
1605
2591
            setattr(client_object, attrname, value)
1606
 
 
 
2592
        
1607
2593
        return True
1608
2594
 
1609
2595
 
 
2596
def rfc3339_duration_to_delta(duration):
 
2597
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2598
    
 
2599
    >>> rfc3339_duration_to_delta("P7D")
 
2600
    datetime.timedelta(7)
 
2601
    >>> rfc3339_duration_to_delta("PT60S")
 
2602
    datetime.timedelta(0, 60)
 
2603
    >>> rfc3339_duration_to_delta("PT60M")
 
2604
    datetime.timedelta(0, 3600)
 
2605
    >>> rfc3339_duration_to_delta("PT24H")
 
2606
    datetime.timedelta(1)
 
2607
    >>> rfc3339_duration_to_delta("P1W")
 
2608
    datetime.timedelta(7)
 
2609
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2610
    datetime.timedelta(0, 330)
 
2611
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2612
    datetime.timedelta(1, 200)
 
2613
    """
 
2614
    
 
2615
    # Parsing an RFC 3339 duration with regular expressions is not
 
2616
    # possible - there would have to be multiple places for the same
 
2617
    # values, like seconds.  The current code, while more esoteric, is
 
2618
    # cleaner without depending on a parsing library.  If Python had a
 
2619
    # built-in library for parsing we would use it, but we'd like to
 
2620
    # avoid excessive use of external libraries.
 
2621
    
 
2622
    # New type for defining tokens, syntax, and semantics all-in-one
 
2623
    Token = collections.namedtuple("Token", (
 
2624
        "regexp",  # To match token; if "value" is not None, must have
 
2625
                   # a "group" containing digits
 
2626
        "value",   # datetime.timedelta or None
 
2627
        "followers"))           # Tokens valid after this token
 
2628
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2629
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2630
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2631
    token_second = Token(re.compile(r"(\d+)S"),
 
2632
                         datetime.timedelta(seconds=1),
 
2633
                         frozenset((token_end, )))
 
2634
    token_minute = Token(re.compile(r"(\d+)M"),
 
2635
                         datetime.timedelta(minutes=1),
 
2636
                         frozenset((token_second, token_end)))
 
2637
    token_hour = Token(re.compile(r"(\d+)H"),
 
2638
                       datetime.timedelta(hours=1),
 
2639
                       frozenset((token_minute, token_end)))
 
2640
    token_time = Token(re.compile(r"T"),
 
2641
                       None,
 
2642
                       frozenset((token_hour, token_minute,
 
2643
                                  token_second)))
 
2644
    token_day = Token(re.compile(r"(\d+)D"),
 
2645
                      datetime.timedelta(days=1),
 
2646
                      frozenset((token_time, token_end)))
 
2647
    token_month = Token(re.compile(r"(\d+)M"),
 
2648
                        datetime.timedelta(weeks=4),
 
2649
                        frozenset((token_day, token_end)))
 
2650
    token_year = Token(re.compile(r"(\d+)Y"),
 
2651
                       datetime.timedelta(weeks=52),
 
2652
                       frozenset((token_month, token_end)))
 
2653
    token_week = Token(re.compile(r"(\d+)W"),
 
2654
                       datetime.timedelta(weeks=1),
 
2655
                       frozenset((token_end, )))
 
2656
    token_duration = Token(re.compile(r"P"), None,
 
2657
                           frozenset((token_year, token_month,
 
2658
                                      token_day, token_time,
 
2659
                                      token_week)))
 
2660
    # Define starting values
 
2661
    value = datetime.timedelta() # Value so far
 
2662
    found_token = None
 
2663
    followers = frozenset((token_duration, )) # Following valid tokens
 
2664
    s = duration                # String left to parse
 
2665
    # Loop until end token is found
 
2666
    while found_token is not token_end:
 
2667
        # Search for any currently valid tokens
 
2668
        for token in followers:
 
2669
            match = token.regexp.match(s)
 
2670
            if match is not None:
 
2671
                # Token found
 
2672
                if token.value is not None:
 
2673
                    # Value found, parse digits
 
2674
                    factor = int(match.group(1), 10)
 
2675
                    # Add to value so far
 
2676
                    value += factor * token.value
 
2677
                # Strip token from string
 
2678
                s = token.regexp.sub("", s, 1)
 
2679
                # Go to found token
 
2680
                found_token = token
 
2681
                # Set valid next tokens
 
2682
                followers = found_token.followers
 
2683
                break
 
2684
        else:
 
2685
            # No currently valid tokens were found
 
2686
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
2687
                             .format(duration))
 
2688
    # End token found
 
2689
    return value
 
2690
 
 
2691
 
1610
2692
def string_to_delta(interval):
1611
2693
    """Parse a string and return a datetime.timedelta
1612
2694
    
1623
2705
    >>> string_to_delta('5m 30s')
1624
2706
    datetime.timedelta(0, 330)
1625
2707
    """
 
2708
    
 
2709
    try:
 
2710
        return rfc3339_duration_to_delta(interval)
 
2711
    except ValueError:
 
2712
        pass
 
2713
    
1626
2714
    timevalue = datetime.timedelta(0)
1627
2715
    for s in interval.split():
1628
2716
        try:
1629
 
            suffix = unicode(s[-1])
 
2717
            suffix = s[-1]
1630
2718
            value = int(s[:-1])
1631
2719
            if suffix == "d":
1632
2720
                delta = datetime.timedelta(value)
1639
2727
            elif suffix == "w":
1640
2728
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1641
2729
            else:
1642
 
                raise ValueError("Unknown suffix %r" % suffix)
1643
 
        except (ValueError, IndexError) as e:
 
2730
                raise ValueError("Unknown suffix {!r}".format(suffix))
 
2731
        except IndexError as e:
1644
2732
            raise ValueError(*(e.args))
1645
2733
        timevalue += delta
1646
2734
    return timevalue
1647
2735
 
1648
2736
 
1649
 
def if_nametoindex(interface):
1650
 
    """Call the C function if_nametoindex(), or equivalent
1651
 
    
1652
 
    Note: This function cannot accept a unicode string."""
1653
 
    global if_nametoindex
1654
 
    try:
1655
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1656
 
                          (ctypes.util.find_library("c"))
1657
 
                          .if_nametoindex)
1658
 
    except (OSError, AttributeError):
1659
 
        logger.warning("Doing if_nametoindex the hard way")
1660
 
        def if_nametoindex(interface):
1661
 
            "Get an interface index the hard way, i.e. using fcntl()"
1662
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1663
 
            with contextlib.closing(socket.socket()) as s:
1664
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1665
 
                                    struct.pack(str("16s16x"),
1666
 
                                                interface))
1667
 
            interface_index = struct.unpack(str("I"),
1668
 
                                            ifreq[16:20])[0]
1669
 
            return interface_index
1670
 
    return if_nametoindex(interface)
1671
 
 
1672
 
 
1673
2737
def daemon(nochdir = False, noclose = False):
1674
2738
    """See daemon(3).  Standard BSD Unix function.
1675
2739
    
1683
2747
        sys.exit()
1684
2748
    if not noclose:
1685
2749
        # Close all standard open file descriptors
1686
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2750
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1687
2751
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1688
2752
            raise OSError(errno.ENODEV,
1689
 
                          "%s not a character device"
1690
 
                          % os.path.devnull)
 
2753
                          "{} not a character device"
 
2754
                          .format(os.devnull))
1691
2755
        os.dup2(null, sys.stdin.fileno())
1692
2756
        os.dup2(null, sys.stdout.fileno())
1693
2757
        os.dup2(null, sys.stderr.fileno())
1702
2766
    
1703
2767
    parser = argparse.ArgumentParser()
1704
2768
    parser.add_argument("-v", "--version", action="version",
1705
 
                        version = "%%(prog)s %s" % version,
 
2769
                        version = "%(prog)s {}".format(version),
1706
2770
                        help="show version number and exit")
1707
2771
    parser.add_argument("-i", "--interface", metavar="IF",
1708
2772
                        help="Bind to interface IF")
1714
2778
                        help="Run self-test")
1715
2779
    parser.add_argument("--debug", action="store_true",
1716
2780
                        help="Debug mode; run in foreground and log"
1717
 
                        " to terminal")
 
2781
                        " to terminal", default=None)
1718
2782
    parser.add_argument("--debuglevel", metavar="LEVEL",
1719
2783
                        help="Debug level for stdout output")
1720
2784
    parser.add_argument("--priority", help="GnuTLS"
1727
2791
                        " files")
1728
2792
    parser.add_argument("--no-dbus", action="store_false",
1729
2793
                        dest="use_dbus", help="Do not provide D-Bus"
1730
 
                        " system bus interface")
 
2794
                        " system bus interface", default=None)
1731
2795
    parser.add_argument("--no-ipv6", action="store_false",
1732
 
                        dest="use_ipv6", help="Do not use IPv6")
 
2796
                        dest="use_ipv6", help="Do not use IPv6",
 
2797
                        default=None)
 
2798
    parser.add_argument("--no-restore", action="store_false",
 
2799
                        dest="restore", help="Do not restore stored"
 
2800
                        " state", default=None)
 
2801
    parser.add_argument("--socket", type=int,
 
2802
                        help="Specify a file descriptor to a network"
 
2803
                        " socket to use instead of creating one")
 
2804
    parser.add_argument("--statedir", metavar="DIR",
 
2805
                        help="Directory to save/restore state in")
 
2806
    parser.add_argument("--foreground", action="store_true",
 
2807
                        help="Run in foreground", default=None)
 
2808
    parser.add_argument("--no-zeroconf", action="store_false",
 
2809
                        dest="zeroconf", help="Do not use Zeroconf",
 
2810
                        default=None)
 
2811
    
1733
2812
    options = parser.parse_args()
1734
2813
    
1735
2814
    if options.check:
1736
2815
        import doctest
1737
 
        doctest.testmod()
1738
 
        sys.exit()
 
2816
        fail_count, test_count = doctest.testmod()
 
2817
        sys.exit(os.EX_OK if fail_count == 0 else 1)
1739
2818
    
1740
2819
    # Default values for config file for server-global settings
1741
2820
    server_defaults = { "interface": "",
1743
2822
                        "port": "",
1744
2823
                        "debug": "False",
1745
2824
                        "priority":
1746
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2825
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
 
2826
                        ":+SIGN-DSA-SHA256",
1747
2827
                        "servicename": "Mandos",
1748
2828
                        "use_dbus": "True",
1749
2829
                        "use_ipv6": "True",
1750
2830
                        "debuglevel": "",
1751
 
                        }
 
2831
                        "restore": "True",
 
2832
                        "socket": "",
 
2833
                        "statedir": "/var/lib/mandos",
 
2834
                        "foreground": "False",
 
2835
                        "zeroconf": "True",
 
2836
                    }
1752
2837
    
1753
2838
    # Parse config file for server-global settings
1754
2839
    server_config = configparser.SafeConfigParser(server_defaults)
1755
2840
    del server_defaults
1756
 
    server_config.read(os.path.join(options.configdir,
1757
 
                                    "mandos.conf"))
 
2841
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
1758
2842
    # Convert the SafeConfigParser object to a dict
1759
2843
    server_settings = server_config.defaults()
1760
2844
    # Use the appropriate methods on the non-string config options
1761
 
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2845
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1762
2846
        server_settings[option] = server_config.getboolean("DEFAULT",
1763
2847
                                                           option)
1764
2848
    if server_settings["port"]:
1765
2849
        server_settings["port"] = server_config.getint("DEFAULT",
1766
2850
                                                       "port")
 
2851
    if server_settings["socket"]:
 
2852
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2853
                                                         "socket")
 
2854
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2855
        # over with an opened os.devnull.  But we don't want this to
 
2856
        # happen with a supplied network socket.
 
2857
        if 0 <= server_settings["socket"] <= 2:
 
2858
            server_settings["socket"] = os.dup(server_settings
 
2859
                                               ["socket"])
1767
2860
    del server_config
1768
2861
    
1769
2862
    # Override the settings from the config file with command line
1770
2863
    # options, if set.
1771
2864
    for option in ("interface", "address", "port", "debug",
1772
 
                   "priority", "servicename", "configdir",
1773
 
                   "use_dbus", "use_ipv6", "debuglevel"):
 
2865
                   "priority", "servicename", "configdir", "use_dbus",
 
2866
                   "use_ipv6", "debuglevel", "restore", "statedir",
 
2867
                   "socket", "foreground", "zeroconf"):
1774
2868
        value = getattr(options, option)
1775
2869
        if value is not None:
1776
2870
            server_settings[option] = value
1777
2871
    del options
1778
2872
    # Force all strings to be unicode
1779
2873
    for option in server_settings.keys():
1780
 
        if type(server_settings[option]) is str:
1781
 
            server_settings[option] = unicode(server_settings[option])
 
2874
        if isinstance(server_settings[option], bytes):
 
2875
            server_settings[option] = (server_settings[option]
 
2876
                                       .decode("utf-8"))
 
2877
    # Force all boolean options to be boolean
 
2878
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2879
                   "foreground", "zeroconf"):
 
2880
        server_settings[option] = bool(server_settings[option])
 
2881
    # Debug implies foreground
 
2882
    if server_settings["debug"]:
 
2883
        server_settings["foreground"] = True
1782
2884
    # Now we have our good server settings in "server_settings"
1783
2885
    
1784
2886
    ##################################################################
1785
2887
    
 
2888
    if (not server_settings["zeroconf"]
 
2889
        and not (server_settings["port"]
 
2890
                 or server_settings["socket"] != "")):
 
2891
        parser.error("Needs port or socket to work without Zeroconf")
 
2892
    
1786
2893
    # For convenience
1787
2894
    debug = server_settings["debug"]
1788
2895
    debuglevel = server_settings["debuglevel"]
1789
2896
    use_dbus = server_settings["use_dbus"]
1790
2897
    use_ipv6 = server_settings["use_ipv6"]
1791
 
 
 
2898
    stored_state_path = os.path.join(server_settings["statedir"],
 
2899
                                     stored_state_file)
 
2900
    foreground = server_settings["foreground"]
 
2901
    zeroconf = server_settings["zeroconf"]
 
2902
    
 
2903
    if debug:
 
2904
        initlogger(debug, logging.DEBUG)
 
2905
    else:
 
2906
        if not debuglevel:
 
2907
            initlogger(debug)
 
2908
        else:
 
2909
            level = getattr(logging, debuglevel.upper())
 
2910
            initlogger(debug, level)
 
2911
    
1792
2912
    if server_settings["servicename"] != "Mandos":
1793
 
        syslogger.setFormatter(logging.Formatter
1794
 
                               ('Mandos (%s) [%%(process)d]:'
1795
 
                                ' %%(levelname)s: %%(message)s'
1796
 
                                % server_settings["servicename"]))
 
2913
        syslogger.setFormatter(
 
2914
            logging.Formatter('Mandos ({}) [%(process)d]:'
 
2915
                              ' %(levelname)s: %(message)s'.format(
 
2916
                                  server_settings["servicename"])))
1797
2917
    
1798
2918
    # Parse config file with clients
1799
 
    client_defaults = { "timeout": "1h",
1800
 
                        "interval": "5m",
1801
 
                        "checker": "fping -q -- %%(host)s",
1802
 
                        "host": "",
1803
 
                        "approval_delay": "0s",
1804
 
                        "approval_duration": "1s",
1805
 
                        }
1806
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2919
    client_config = configparser.SafeConfigParser(Client
 
2920
                                                  .client_defaults)
1807
2921
    client_config.read(os.path.join(server_settings["configdir"],
1808
2922
                                    "clients.conf"))
1809
2923
    
1810
2924
    global mandos_dbus_service
1811
2925
    mandos_dbus_service = None
1812
2926
    
1813
 
    tcp_server = MandosServer((server_settings["address"],
1814
 
                               server_settings["port"]),
1815
 
                              ClientHandler,
1816
 
                              interface=(server_settings["interface"]
1817
 
                                         or None),
1818
 
                              use_ipv6=use_ipv6,
1819
 
                              gnutls_priority=
1820
 
                              server_settings["priority"],
1821
 
                              use_dbus=use_dbus)
1822
 
    if not debug:
1823
 
        pidfilename = "/var/run/mandos.pid"
 
2927
    socketfd = None
 
2928
    if server_settings["socket"] != "":
 
2929
        socketfd = server_settings["socket"]
 
2930
    tcp_server = MandosServer(
 
2931
        (server_settings["address"], server_settings["port"]),
 
2932
        ClientHandler,
 
2933
        interface=(server_settings["interface"] or None),
 
2934
        use_ipv6=use_ipv6,
 
2935
        gnutls_priority=server_settings["priority"],
 
2936
        use_dbus=use_dbus,
 
2937
        socketfd=socketfd)
 
2938
    if not foreground:
 
2939
        pidfilename = "/run/mandos.pid"
 
2940
        if not os.path.isdir("/run/."):
 
2941
            pidfilename = "/var/run/mandos.pid"
 
2942
        pidfile = None
1824
2943
        try:
1825
 
            pidfile = open(pidfilename, "w")
1826
 
        except IOError:
1827
 
            logger.error("Could not open file %r", pidfilename)
 
2944
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
 
2945
        except IOError as e:
 
2946
            logger.error("Could not open file %r", pidfilename,
 
2947
                         exc_info=e)
1828
2948
    
1829
 
    try:
1830
 
        uid = pwd.getpwnam("_mandos").pw_uid
1831
 
        gid = pwd.getpwnam("_mandos").pw_gid
1832
 
    except KeyError:
 
2949
    for name, group in (("_mandos", "_mandos"),
 
2950
                        ("mandos", "mandos"),
 
2951
                        ("nobody", "nogroup")):
1833
2952
        try:
1834
 
            uid = pwd.getpwnam("mandos").pw_uid
1835
 
            gid = pwd.getpwnam("mandos").pw_gid
 
2953
            uid = pwd.getpwnam(name).pw_uid
 
2954
            gid = pwd.getpwnam(group).pw_gid
 
2955
            break
1836
2956
        except KeyError:
1837
 
            try:
1838
 
                uid = pwd.getpwnam("nobody").pw_uid
1839
 
                gid = pwd.getpwnam("nobody").pw_gid
1840
 
            except KeyError:
1841
 
                uid = 65534
1842
 
                gid = 65534
 
2957
            continue
 
2958
    else:
 
2959
        uid = 65534
 
2960
        gid = 65534
1843
2961
    try:
1844
2962
        os.setgid(gid)
1845
2963
        os.setuid(uid)
 
2964
        if debug:
 
2965
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
 
2966
                                                             gid))
1846
2967
    except OSError as error:
1847
 
        if error[0] != errno.EPERM:
1848
 
            raise error
 
2968
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
 
2969
                       .format(uid, gid, os.strerror(error.errno)))
 
2970
        if error.errno != errno.EPERM:
 
2971
            raise
1849
2972
    
1850
 
    if not debug and not debuglevel:
1851
 
        syslogger.setLevel(logging.WARNING)
1852
 
        console.setLevel(logging.WARNING)
1853
 
    if debuglevel:
1854
 
        level = getattr(logging, debuglevel.upper())
1855
 
        syslogger.setLevel(level)
1856
 
        console.setLevel(level)
1857
 
 
1858
2973
    if debug:
1859
2974
        # Enable all possible GnuTLS debugging
1860
2975
        
1861
2976
        # "Use a log level over 10 to enable all debugging options."
1862
2977
        # - GnuTLS manual
1863
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
2978
        gnutls.global_set_log_level(11)
1864
2979
        
1865
 
        @gnutls.library.types.gnutls_log_func
 
2980
        @gnutls.log_func
1866
2981
        def debug_gnutls(level, string):
1867
2982
            logger.debug("GnuTLS: %s", string[:-1])
1868
2983
        
1869
 
        (gnutls.library.functions
1870
 
         .gnutls_global_set_log_function(debug_gnutls))
 
2984
        gnutls.global_set_log_function(debug_gnutls)
1871
2985
        
1872
2986
        # Redirect stdin so all checkers get /dev/null
1873
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2987
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1874
2988
        os.dup2(null, sys.stdin.fileno())
1875
2989
        if null > 2:
1876
2990
            os.close(null)
1877
 
    else:
1878
 
        # No console logging
1879
 
        logger.removeHandler(console)
1880
2991
    
1881
2992
    # Need to fork before connecting to D-Bus
1882
 
    if not debug:
 
2993
    if not foreground:
1883
2994
        # Close all input and output, do double fork, etc.
1884
2995
        daemon()
1885
2996
    
 
2997
    # multiprocessing will use threads, so before we use GLib we need
 
2998
    # to inform GLib that threads will be used.
 
2999
    GLib.threads_init()
 
3000
    
1886
3001
    global main_loop
1887
3002
    # From the Avahi example code
1888
 
    DBusGMainLoop(set_as_default=True )
1889
 
    main_loop = gobject.MainLoop()
 
3003
    DBusGMainLoop(set_as_default=True)
 
3004
    main_loop = GLib.MainLoop()
1890
3005
    bus = dbus.SystemBus()
1891
3006
    # End of Avahi example code
1892
3007
    if use_dbus:
1893
3008
        try:
1894
 
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1895
 
                                            bus, do_not_queue=True)
1896
 
        except dbus.exceptions.NameExistsException as e:
1897
 
            logger.error(unicode(e) + ", disabling D-Bus")
 
3009
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
3010
                                            bus,
 
3011
                                            do_not_queue=True)
 
3012
            old_bus_name = dbus.service.BusName(
 
3013
                "se.bsnet.fukt.Mandos", bus,
 
3014
                do_not_queue=True)
 
3015
        except dbus.exceptions.DBusException as e:
 
3016
            logger.error("Disabling D-Bus:", exc_info=e)
1898
3017
            use_dbus = False
1899
3018
            server_settings["use_dbus"] = False
1900
3019
            tcp_server.use_dbus = False
1901
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1902
 
    service = AvahiService(name = server_settings["servicename"],
1903
 
                           servicetype = "_mandos._tcp",
1904
 
                           protocol = protocol, bus = bus)
1905
 
    if server_settings["interface"]:
1906
 
        service.interface = (if_nametoindex
1907
 
                             (str(server_settings["interface"])))
 
3020
    if zeroconf:
 
3021
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
3022
        service = AvahiServiceToSyslog(
 
3023
            name = server_settings["servicename"],
 
3024
            servicetype = "_mandos._tcp",
 
3025
            protocol = protocol,
 
3026
            bus = bus)
 
3027
        if server_settings["interface"]:
 
3028
            service.interface = if_nametoindex(
 
3029
                server_settings["interface"].encode("utf-8"))
1908
3030
    
1909
3031
    global multiprocessing_manager
1910
3032
    multiprocessing_manager = multiprocessing.Manager()
1912
3034
    client_class = Client
1913
3035
    if use_dbus:
1914
3036
        client_class = functools.partial(ClientDBus, bus = bus)
1915
 
    def client_config_items(config, section):
1916
 
        special_settings = {
1917
 
            "approved_by_default":
1918
 
                lambda: config.getboolean(section,
1919
 
                                          "approved_by_default"),
1920
 
            }
1921
 
        for name, value in config.items(section):
 
3037
    
 
3038
    client_settings = Client.config_parser(client_config)
 
3039
    old_client_settings = {}
 
3040
    clients_data = {}
 
3041
    
 
3042
    # This is used to redirect stdout and stderr for checker processes
 
3043
    global wnull
 
3044
    wnull = open(os.devnull, "w") # A writable /dev/null
 
3045
    # Only used if server is running in foreground but not in debug
 
3046
    # mode
 
3047
    if debug or not foreground:
 
3048
        wnull.close()
 
3049
    
 
3050
    # Get client data and settings from last running state.
 
3051
    if server_settings["restore"]:
 
3052
        try:
 
3053
            with open(stored_state_path, "rb") as stored_state:
 
3054
                if sys.version_info.major == 2:                
 
3055
                    clients_data, old_client_settings = pickle.load(
 
3056
                        stored_state)
 
3057
                else:
 
3058
                    bytes_clients_data, bytes_old_client_settings = (
 
3059
                        pickle.load(stored_state, encoding = "bytes"))
 
3060
                    ### Fix bytes to strings
 
3061
                    ## clients_data
 
3062
                    # .keys()
 
3063
                    clients_data = { (key.decode("utf-8")
 
3064
                                      if isinstance(key, bytes)
 
3065
                                      else key): value
 
3066
                                     for key, value in
 
3067
                                     bytes_clients_data.items() }
 
3068
                    del bytes_clients_data
 
3069
                    for key in clients_data:
 
3070
                        value = { (k.decode("utf-8")
 
3071
                                   if isinstance(k, bytes) else k): v
 
3072
                                  for k, v in
 
3073
                                  clients_data[key].items() }
 
3074
                        clients_data[key] = value
 
3075
                        # .client_structure
 
3076
                        value["client_structure"] = [
 
3077
                            (s.decode("utf-8")
 
3078
                             if isinstance(s, bytes)
 
3079
                             else s) for s in
 
3080
                            value["client_structure"] ]
 
3081
                        # .name & .host
 
3082
                        for k in ("name", "host"):
 
3083
                            if isinstance(value[k], bytes):
 
3084
                                value[k] = value[k].decode("utf-8")
 
3085
                    ## old_client_settings
 
3086
                    # .keys()
 
3087
                    old_client_settings = {
 
3088
                        (key.decode("utf-8")
 
3089
                         if isinstance(key, bytes)
 
3090
                         else key): value
 
3091
                        for key, value in
 
3092
                        bytes_old_client_settings.items() }
 
3093
                    del bytes_old_client_settings
 
3094
                    # .host
 
3095
                    for value in old_client_settings.values():
 
3096
                        if isinstance(value["host"], bytes):
 
3097
                            value["host"] = (value["host"]
 
3098
                                             .decode("utf-8"))
 
3099
            os.remove(stored_state_path)
 
3100
        except IOError as e:
 
3101
            if e.errno == errno.ENOENT:
 
3102
                logger.warning("Could not load persistent state:"
 
3103
                               " {}".format(os.strerror(e.errno)))
 
3104
            else:
 
3105
                logger.critical("Could not load persistent state:",
 
3106
                                exc_info=e)
 
3107
                raise
 
3108
        except EOFError as e:
 
3109
            logger.warning("Could not load persistent state: "
 
3110
                           "EOFError:",
 
3111
                           exc_info=e)
 
3112
    
 
3113
    with PGPEngine() as pgp:
 
3114
        for client_name, client in clients_data.items():
 
3115
            # Skip removed clients
 
3116
            if client_name not in client_settings:
 
3117
                continue
 
3118
            
 
3119
            # Decide which value to use after restoring saved state.
 
3120
            # We have three different values: Old config file,
 
3121
            # new config file, and saved state.
 
3122
            # New config value takes precedence if it differs from old
 
3123
            # config value, otherwise use saved state.
 
3124
            for name, value in client_settings[client_name].items():
 
3125
                try:
 
3126
                    # For each value in new config, check if it
 
3127
                    # differs from the old config value (Except for
 
3128
                    # the "secret" attribute)
 
3129
                    if (name != "secret"
 
3130
                        and (value !=
 
3131
                             old_client_settings[client_name][name])):
 
3132
                        client[name] = value
 
3133
                except KeyError:
 
3134
                    pass
 
3135
            
 
3136
            # Clients who has passed its expire date can still be
 
3137
            # enabled if its last checker was successful.  A Client
 
3138
            # whose checker succeeded before we stored its state is
 
3139
            # assumed to have successfully run all checkers during
 
3140
            # downtime.
 
3141
            if client["enabled"]:
 
3142
                if datetime.datetime.utcnow() >= client["expires"]:
 
3143
                    if not client["last_checked_ok"]:
 
3144
                        logger.warning(
 
3145
                            "disabling client {} - Client never "
 
3146
                            "performed a successful checker".format(
 
3147
                                client_name))
 
3148
                        client["enabled"] = False
 
3149
                    elif client["last_checker_status"] != 0:
 
3150
                        logger.warning(
 
3151
                            "disabling client {} - Client last"
 
3152
                            " checker failed with error code"
 
3153
                            " {}".format(
 
3154
                                client_name,
 
3155
                                client["last_checker_status"]))
 
3156
                        client["enabled"] = False
 
3157
                    else:
 
3158
                        client["expires"] = (
 
3159
                            datetime.datetime.utcnow()
 
3160
                            + client["timeout"])
 
3161
                        logger.debug("Last checker succeeded,"
 
3162
                                     " keeping {} enabled".format(
 
3163
                                         client_name))
1922
3164
            try:
1923
 
                yield (name, special_settings[name]())
1924
 
            except KeyError:
1925
 
                yield (name, value)
1926
 
    
1927
 
    tcp_server.clients.update(set(
1928
 
            client_class(name = section,
1929
 
                         config= dict(client_config_items(
1930
 
                        client_config, section)))
1931
 
            for section in client_config.sections()))
 
3165
                client["secret"] = pgp.decrypt(
 
3166
                    client["encrypted_secret"],
 
3167
                    client_settings[client_name]["secret"])
 
3168
            except PGPError:
 
3169
                # If decryption fails, we use secret from new settings
 
3170
                logger.debug("Failed to decrypt {} old secret".format(
 
3171
                    client_name))
 
3172
                client["secret"] = (client_settings[client_name]
 
3173
                                    ["secret"])
 
3174
    
 
3175
    # Add/remove clients based on new changes made to config
 
3176
    for client_name in (set(old_client_settings)
 
3177
                        - set(client_settings)):
 
3178
        del clients_data[client_name]
 
3179
    for client_name in (set(client_settings)
 
3180
                        - set(old_client_settings)):
 
3181
        clients_data[client_name] = client_settings[client_name]
 
3182
    
 
3183
    # Create all client objects
 
3184
    for client_name, client in clients_data.items():
 
3185
        tcp_server.clients[client_name] = client_class(
 
3186
            name = client_name,
 
3187
            settings = client,
 
3188
            server_settings = server_settings)
 
3189
    
1932
3190
    if not tcp_server.clients:
1933
3191
        logger.warning("No clients defined")
1934
 
        
1935
 
    if not debug:
1936
 
        try:
1937
 
            with pidfile:
1938
 
                pid = os.getpid()
1939
 
                pidfile.write(str(pid) + "\n".encode("utf-8"))
1940
 
            del pidfile
1941
 
        except IOError:
1942
 
            logger.error("Could not write to file %r with PID %d",
1943
 
                         pidfilename, pid)
1944
 
        except NameError:
1945
 
            # "pidfile" was never created
1946
 
            pass
 
3192
    
 
3193
    if not foreground:
 
3194
        if pidfile is not None:
 
3195
            pid = os.getpid()
 
3196
            try:
 
3197
                with pidfile:
 
3198
                    print(pid, file=pidfile)
 
3199
            except IOError:
 
3200
                logger.error("Could not write to file %r with PID %d",
 
3201
                             pidfilename, pid)
 
3202
        del pidfile
1947
3203
        del pidfilename
 
3204
    
 
3205
    for termsig in (signal.SIGHUP, signal.SIGTERM):
 
3206
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
 
3207
                             lambda: main_loop.quit() and False)
 
3208
    
 
3209
    if use_dbus:
1948
3210
        
1949
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1950
 
 
1951
 
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1952
 
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1953
 
    
1954
 
    if use_dbus:
1955
 
        class MandosDBusService(dbus.service.Object):
 
3211
        @alternate_dbus_interfaces(
 
3212
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
 
3213
        class MandosDBusService(DBusObjectWithObjectManager):
1956
3214
            """A D-Bus proxy object"""
 
3215
            
1957
3216
            def __init__(self):
1958
3217
                dbus.service.Object.__init__(self, bus, "/")
1959
 
            _interface = "se.bsnet.fukt.Mandos"
 
3218
            
 
3219
            _interface = "se.recompile.Mandos"
1960
3220
            
1961
3221
            @dbus.service.signal(_interface, signature="o")
1962
3222
            def ClientAdded(self, objpath):
1968
3228
                "D-Bus signal"
1969
3229
                pass
1970
3230
            
 
3231
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3232
                               "true"})
1971
3233
            @dbus.service.signal(_interface, signature="os")
1972
3234
            def ClientRemoved(self, objpath, name):
1973
3235
                "D-Bus signal"
1974
3236
                pass
1975
3237
            
 
3238
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3239
                               "true"})
1976
3240
            @dbus.service.method(_interface, out_signature="ao")
1977
3241
            def GetAllClients(self):
1978
3242
                "D-Bus method"
1979
 
                return dbus.Array(c.dbus_object_path
1980
 
                                  for c in tcp_server.clients)
 
3243
                return dbus.Array(c.dbus_object_path for c in
 
3244
                                  tcp_server.clients.values())
1981
3245
            
 
3246
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3247
                               "true"})
1982
3248
            @dbus.service.method(_interface,
1983
3249
                                 out_signature="a{oa{sv}}")
1984
3250
            def GetAllClientsWithProperties(self):
1985
3251
                "D-Bus method"
1986
3252
                return dbus.Dictionary(
1987
 
                    ((c.dbus_object_path, c.GetAll(""))
1988
 
                     for c in tcp_server.clients),
 
3253
                    { c.dbus_object_path: c.GetAll(
 
3254
                        "se.recompile.Mandos.Client")
 
3255
                      for c in tcp_server.clients.values() },
1989
3256
                    signature="oa{sv}")
1990
3257
            
1991
3258
            @dbus.service.method(_interface, in_signature="o")
1992
3259
            def RemoveClient(self, object_path):
1993
3260
                "D-Bus method"
1994
 
                for c in tcp_server.clients:
 
3261
                for c in tcp_server.clients.values():
1995
3262
                    if c.dbus_object_path == object_path:
1996
 
                        tcp_server.clients.remove(c)
 
3263
                        del tcp_server.clients[c.name]
1997
3264
                        c.remove_from_connection()
1998
 
                        # Don't signal anything except ClientRemoved
 
3265
                        # Don't signal the disabling
1999
3266
                        c.disable(quiet=True)
2000
 
                        # Emit D-Bus signal
2001
 
                        self.ClientRemoved(object_path, c.name)
 
3267
                        # Emit D-Bus signal for removal
 
3268
                        self.client_removed_signal(c)
2002
3269
                        return
2003
3270
                raise KeyError(object_path)
2004
3271
            
2005
3272
            del _interface
 
3273
            
 
3274
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
3275
                                 out_signature = "a{oa{sa{sv}}}")
 
3276
            def GetManagedObjects(self):
 
3277
                """D-Bus method"""
 
3278
                return dbus.Dictionary(
 
3279
                    { client.dbus_object_path:
 
3280
                      dbus.Dictionary(
 
3281
                          { interface: client.GetAll(interface)
 
3282
                            for interface in
 
3283
                                 client._get_all_interface_names()})
 
3284
                      for client in tcp_server.clients.values()})
 
3285
            
 
3286
            def client_added_signal(self, client):
 
3287
                """Send the new standard signal and the old signal"""
 
3288
                if use_dbus:
 
3289
                    # New standard signal
 
3290
                    self.InterfacesAdded(
 
3291
                        client.dbus_object_path,
 
3292
                        dbus.Dictionary(
 
3293
                            { interface: client.GetAll(interface)
 
3294
                              for interface in
 
3295
                              client._get_all_interface_names()}))
 
3296
                    # Old signal
 
3297
                    self.ClientAdded(client.dbus_object_path)
 
3298
            
 
3299
            def client_removed_signal(self, client):
 
3300
                """Send the new standard signal and the old signal"""
 
3301
                if use_dbus:
 
3302
                    # New standard signal
 
3303
                    self.InterfacesRemoved(
 
3304
                        client.dbus_object_path,
 
3305
                        client._get_all_interface_names())
 
3306
                    # Old signal
 
3307
                    self.ClientRemoved(client.dbus_object_path,
 
3308
                                       client.name)
2006
3309
        
2007
3310
        mandos_dbus_service = MandosDBusService()
2008
3311
    
2009
3312
    def cleanup():
2010
3313
        "Cleanup function; run on exit"
2011
 
        service.cleanup()
2012
 
        
 
3314
        if zeroconf:
 
3315
            service.cleanup()
 
3316
        
 
3317
        multiprocessing.active_children()
 
3318
        wnull.close()
 
3319
        if not (tcp_server.clients or client_settings):
 
3320
            return
 
3321
        
 
3322
        # Store client before exiting. Secrets are encrypted with key
 
3323
        # based on what config file has. If config file is
 
3324
        # removed/edited, old secret will thus be unrecovable.
 
3325
        clients = {}
 
3326
        with PGPEngine() as pgp:
 
3327
            for client in tcp_server.clients.values():
 
3328
                key = client_settings[client.name]["secret"]
 
3329
                client.encrypted_secret = pgp.encrypt(client.secret,
 
3330
                                                      key)
 
3331
                client_dict = {}
 
3332
                
 
3333
                # A list of attributes that can not be pickled
 
3334
                # + secret.
 
3335
                exclude = { "bus", "changedstate", "secret",
 
3336
                            "checker", "server_settings" }
 
3337
                for name, typ in inspect.getmembers(dbus.service
 
3338
                                                    .Object):
 
3339
                    exclude.add(name)
 
3340
                
 
3341
                client_dict["encrypted_secret"] = (client
 
3342
                                                   .encrypted_secret)
 
3343
                for attr in client.client_structure:
 
3344
                    if attr not in exclude:
 
3345
                        client_dict[attr] = getattr(client, attr)
 
3346
                
 
3347
                clients[client.name] = client_dict
 
3348
                del client_settings[client.name]["secret"]
 
3349
        
 
3350
        try:
 
3351
            with tempfile.NamedTemporaryFile(
 
3352
                    mode='wb',
 
3353
                    suffix=".pickle",
 
3354
                    prefix='clients-',
 
3355
                    dir=os.path.dirname(stored_state_path),
 
3356
                    delete=False) as stored_state:
 
3357
                pickle.dump((clients, client_settings), stored_state,
 
3358
                            protocol = 2)
 
3359
                tempname = stored_state.name
 
3360
            os.rename(tempname, stored_state_path)
 
3361
        except (IOError, OSError) as e:
 
3362
            if not debug:
 
3363
                try:
 
3364
                    os.remove(tempname)
 
3365
                except NameError:
 
3366
                    pass
 
3367
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
3368
                logger.warning("Could not save persistent state: {}"
 
3369
                               .format(os.strerror(e.errno)))
 
3370
            else:
 
3371
                logger.warning("Could not save persistent state:",
 
3372
                               exc_info=e)
 
3373
                raise
 
3374
        
 
3375
        # Delete all clients, and settings from config
2013
3376
        while tcp_server.clients:
2014
 
            client = tcp_server.clients.pop()
 
3377
            name, client = tcp_server.clients.popitem()
2015
3378
            if use_dbus:
2016
3379
                client.remove_from_connection()
2017
 
            client.disable_hook = None
2018
 
            # Don't signal anything except ClientRemoved
 
3380
            # Don't signal the disabling
2019
3381
            client.disable(quiet=True)
 
3382
            # Emit D-Bus signal for removal
2020
3383
            if use_dbus:
2021
 
                # Emit D-Bus signal
2022
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2023
 
                                                  client.name)
 
3384
                mandos_dbus_service.client_removed_signal(client)
 
3385
        client_settings.clear()
2024
3386
    
2025
3387
    atexit.register(cleanup)
2026
3388
    
2027
 
    for client in tcp_server.clients:
 
3389
    for client in tcp_server.clients.values():
2028
3390
        if use_dbus:
2029
 
            # Emit D-Bus signal
2030
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2031
 
        client.enable()
 
3391
            # Emit D-Bus signal for adding
 
3392
            mandos_dbus_service.client_added_signal(client)
 
3393
        # Need to initiate checking of clients
 
3394
        if client.enabled:
 
3395
            client.init_checker()
2032
3396
    
2033
3397
    tcp_server.enable()
2034
3398
    tcp_server.server_activate()
2035
3399
    
2036
3400
    # Find out what port we got
2037
 
    service.port = tcp_server.socket.getsockname()[1]
 
3401
    if zeroconf:
 
3402
        service.port = tcp_server.socket.getsockname()[1]
2038
3403
    if use_ipv6:
2039
3404
        logger.info("Now listening on address %r, port %d,"
2040
 
                    " flowinfo %d, scope_id %d"
2041
 
                    % tcp_server.socket.getsockname())
 
3405
                    " flowinfo %d, scope_id %d",
 
3406
                    *tcp_server.socket.getsockname())
2042
3407
    else:                       # IPv4
2043
 
        logger.info("Now listening on address %r, port %d"
2044
 
                    % tcp_server.socket.getsockname())
 
3408
        logger.info("Now listening on address %r, port %d",
 
3409
                    *tcp_server.socket.getsockname())
2045
3410
    
2046
3411
    #service.interface = tcp_server.socket.getsockname()[3]
2047
3412
    
2048
3413
    try:
2049
 
        # From the Avahi example code
2050
 
        try:
2051
 
            service.activate()
2052
 
        except dbus.exceptions.DBusException as error:
2053
 
            logger.critical("DBusException: %s", error)
2054
 
            cleanup()
2055
 
            sys.exit(1)
2056
 
        # End of Avahi example code
 
3414
        if zeroconf:
 
3415
            # From the Avahi example code
 
3416
            try:
 
3417
                service.activate()
 
3418
            except dbus.exceptions.DBusException as error:
 
3419
                logger.critical("D-Bus Exception", exc_info=error)
 
3420
                cleanup()
 
3421
                sys.exit(1)
 
3422
            # End of Avahi example code
2057
3423
        
2058
 
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2059
 
                             lambda *args, **kwargs:
2060
 
                             (tcp_server.handle_request
2061
 
                              (*args[2:], **kwargs) or True))
 
3424
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
 
3425
                          lambda *args, **kwargs:
 
3426
                          (tcp_server.handle_request
 
3427
                           (*args[2:], **kwargs) or True))
2062
3428
        
2063
3429
        logger.debug("Starting main loop")
2064
3430
        main_loop.run()
2065
3431
    except AvahiError as error:
2066
 
        logger.critical("AvahiError: %s", error)
 
3432
        logger.critical("Avahi Error", exc_info=error)
2067
3433
        cleanup()
2068
3434
        sys.exit(1)
2069
3435
    except KeyboardInterrupt:
2074
3440
    # Must run before the D-Bus bus name gets deregistered
2075
3441
    cleanup()
2076
3442
 
 
3443
 
2077
3444
if __name__ == '__main__':
2078
3445
    main()