/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2016-06-22 04:42:23 UTC
  • Revision ID: teddy@recompile.se-20160622044223-ew442xmt3c3bg76n
Client: Do not install intro(8mandos) manual page

When installing client, do not include the intro(8mandos) manual page
to avoid a conflict with the files from a server install.
  
* Makefile (install-client-nokey): Do not install intro.8mandos.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2013 Teddy Hogeborn
15
 
# Copyright © 2008-2013 Björn Påhlsson
 
14
# Copyright © 2008-2016 Teddy Hogeborn
 
15
# Copyright © 2008-2016 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
37
 
from future_builtins import *
 
37
try:
 
38
    from future_builtins import *
 
39
except ImportError:
 
40
    pass
38
41
 
39
 
import SocketServer as socketserver
 
42
try:
 
43
    import SocketServer as socketserver
 
44
except ImportError:
 
45
    import socketserver
40
46
import socket
41
47
import argparse
42
48
import datetime
43
49
import errno
44
 
import gnutls.crypto
45
 
import gnutls.connection
46
 
import gnutls.errors
47
 
import gnutls.library.functions
48
 
import gnutls.library.constants
49
 
import gnutls.library.types
50
 
import ConfigParser as configparser
 
50
try:
 
51
    import ConfigParser as configparser
 
52
except ImportError:
 
53
    import configparser
51
54
import sys
52
55
import re
53
56
import os
62
65
import struct
63
66
import fcntl
64
67
import functools
65
 
import cPickle as pickle
 
68
try:
 
69
    import cPickle as pickle
 
70
except ImportError:
 
71
    import pickle
66
72
import multiprocessing
67
73
import types
68
74
import binascii
69
75
import tempfile
70
76
import itertools
71
77
import collections
 
78
import codecs
72
79
 
73
80
import dbus
74
81
import dbus.service
75
 
import gobject
76
 
import avahi
 
82
from gi.repository import GLib
77
83
from dbus.mainloop.glib import DBusGMainLoop
78
84
import ctypes
79
85
import ctypes.util
80
86
import xml.dom.minidom
81
87
import inspect
82
88
 
 
89
# Try to find the value of SO_BINDTODEVICE:
83
90
try:
 
91
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
 
92
    # newer, and it is also the most natural place for it:
84
93
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
94
except AttributeError:
86
95
    try:
 
96
        # This is where SO_BINDTODEVICE was up to and including Python
 
97
        # 2.6, and also 3.2:
87
98
        from IN import SO_BINDTODEVICE
88
99
    except ImportError:
89
 
        SO_BINDTODEVICE = None
90
 
 
91
 
version = "1.6.1"
 
100
        # In Python 2.7 it seems to have been removed entirely.
 
101
        # Try running the C preprocessor:
 
102
        try:
 
103
            cc = subprocess.Popen(["cc", "--language=c", "-E",
 
104
                                   "/dev/stdin"],
 
105
                                  stdin=subprocess.PIPE,
 
106
                                  stdout=subprocess.PIPE)
 
107
            stdout = cc.communicate(
 
108
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
 
109
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
 
110
        except (OSError, ValueError, IndexError):
 
111
            # No value found
 
112
            SO_BINDTODEVICE = None
 
113
 
 
114
if sys.version_info.major == 2:
 
115
    str = unicode
 
116
 
 
117
version = "1.7.8"
92
118
stored_state_file = "clients.pickle"
93
119
 
94
120
logger = logging.getLogger()
95
 
syslogger = (logging.handlers.SysLogHandler
96
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
 
              address = str("/dev/log")))
 
121
syslogger = None
98
122
 
99
123
try:
100
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
101
 
                      (ctypes.util.find_library("c"))
102
 
                      .if_nametoindex)
 
124
    if_nametoindex = ctypes.cdll.LoadLibrary(
 
125
        ctypes.util.find_library("c")).if_nametoindex
103
126
except (OSError, AttributeError):
 
127
    
104
128
    def if_nametoindex(interface):
105
129
        "Get an interface index the hard way, i.e. using fcntl()"
106
130
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
107
131
        with contextlib.closing(socket.socket()) as s:
108
132
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
 
                                struct.pack(str("16s16x"),
110
 
                                            interface))
111
 
        interface_index = struct.unpack(str("I"),
112
 
                                        ifreq[16:20])[0]
 
133
                                struct.pack(b"16s16x", interface))
 
134
        interface_index = struct.unpack("I", ifreq[16:20])[0]
113
135
        return interface_index
114
136
 
115
137
 
 
138
def copy_function(func):
 
139
    """Make a copy of a function"""
 
140
    if sys.version_info.major == 2:
 
141
        return types.FunctionType(func.func_code,
 
142
                                  func.func_globals,
 
143
                                  func.func_name,
 
144
                                  func.func_defaults,
 
145
                                  func.func_closure)
 
146
    else:
 
147
        return types.FunctionType(func.__code__,
 
148
                                  func.__globals__,
 
149
                                  func.__name__,
 
150
                                  func.__defaults__,
 
151
                                  func.__closure__)
 
152
 
 
153
 
116
154
def initlogger(debug, level=logging.WARNING):
117
155
    """init logger and add loglevel"""
118
156
    
 
157
    global syslogger
 
158
    syslogger = (logging.handlers.SysLogHandler(
 
159
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
160
        address = "/dev/log"))
119
161
    syslogger.setFormatter(logging.Formatter
120
162
                           ('Mandos [%(process)d]: %(levelname)s:'
121
163
                            ' %(message)s'))
138
180
 
139
181
class PGPEngine(object):
140
182
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
183
    
141
184
    def __init__(self):
142
185
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
186
        self.gpg = "gpg"
 
187
        try:
 
188
            output = subprocess.check_output(["gpgconf"])
 
189
            for line in output.splitlines():
 
190
                name, text, path = line.split(b":")
 
191
                if name == "gpg":
 
192
                    self.gpg = path
 
193
                    break
 
194
        except OSError as e:
 
195
            if e.errno != errno.ENOENT:
 
196
                raise
143
197
        self.gnupgargs = ['--batch',
144
 
                          '--home', self.tempdir,
 
198
                          '--homedir', self.tempdir,
145
199
                          '--force-mdc',
146
 
                          '--quiet',
147
 
                          '--no-use-agent']
 
200
                          '--quiet']
 
201
        # Only GPG version 1 has the --no-use-agent option.
 
202
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
 
203
            self.gnupgargs.append("--no-use-agent")
148
204
    
149
205
    def __enter__(self):
150
206
        return self
182
238
    
183
239
    def encrypt(self, data, password):
184
240
        passphrase = self.password_encode(password)
185
 
        with tempfile.NamedTemporaryFile(dir=self.tempdir
186
 
                                         ) as passfile:
 
241
        with tempfile.NamedTemporaryFile(
 
242
                dir=self.tempdir) as passfile:
187
243
            passfile.write(passphrase)
188
244
            passfile.flush()
189
 
            proc = subprocess.Popen(['gpg', '--symmetric',
 
245
            proc = subprocess.Popen([self.gpg, '--symmetric',
190
246
                                     '--passphrase-file',
191
247
                                     passfile.name]
192
248
                                    + self.gnupgargs,
200
256
    
201
257
    def decrypt(self, data, password):
202
258
        passphrase = self.password_encode(password)
203
 
        with tempfile.NamedTemporaryFile(dir = self.tempdir
204
 
                                         ) as passfile:
 
259
        with tempfile.NamedTemporaryFile(
 
260
                dir = self.tempdir) as passfile:
205
261
            passfile.write(passphrase)
206
262
            passfile.flush()
207
 
            proc = subprocess.Popen(['gpg', '--decrypt',
 
263
            proc = subprocess.Popen([self.gpg, '--decrypt',
208
264
                                     '--passphrase-file',
209
265
                                     passfile.name]
210
266
                                    + self.gnupgargs,
211
267
                                    stdin = subprocess.PIPE,
212
268
                                    stdout = subprocess.PIPE,
213
269
                                    stderr = subprocess.PIPE)
214
 
            decrypted_plaintext, err = proc.communicate(input
215
 
                                                        = data)
 
270
            decrypted_plaintext, err = proc.communicate(input = data)
216
271
        if proc.returncode != 0:
217
272
            raise PGPError(err)
218
273
        return decrypted_plaintext
219
274
 
 
275
# Pretend that we have an Avahi module
 
276
class Avahi(object):
 
277
    """This isn't so much a class as it is a module-like namespace.
 
278
    It is instantiated once, and simulates having an Avahi module."""
 
279
    IF_UNSPEC = -1              # avahi-common/address.h
 
280
    PROTO_UNSPEC = -1           # avahi-common/address.h
 
281
    PROTO_INET = 0              # avahi-common/address.h
 
282
    PROTO_INET6 = 1             # avahi-common/address.h
 
283
    DBUS_NAME = "org.freedesktop.Avahi"
 
284
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
 
285
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
 
286
    DBUS_PATH_SERVER = "/"
 
287
    def string_array_to_txt_array(self, t):
 
288
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
 
289
                           for s in t), signature="ay")
 
290
    ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
 
291
    ENTRY_GROUP_COLLISION = 3   # avahi-common/defs.h
 
292
    ENTRY_GROUP_FAILURE = 4     # avahi-common/defs.h
 
293
    SERVER_INVALID = 0          # avahi-common/defs.h
 
294
    SERVER_REGISTERING = 1      # avahi-common/defs.h
 
295
    SERVER_RUNNING = 2          # avahi-common/defs.h
 
296
    SERVER_COLLISION = 3        # avahi-common/defs.h
 
297
    SERVER_FAILURE = 4          # avahi-common/defs.h
 
298
avahi = Avahi()
220
299
 
221
300
class AvahiError(Exception):
222
301
    def __init__(self, value, *args, **kwargs):
223
302
        self.value = value
224
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
225
 
    def __unicode__(self):
226
 
        return unicode(repr(self.value))
 
303
        return super(AvahiError, self).__init__(value, *args,
 
304
                                                **kwargs)
 
305
 
227
306
 
228
307
class AvahiServiceError(AvahiError):
229
308
    pass
230
309
 
 
310
 
231
311
class AvahiGroupError(AvahiError):
232
312
    pass
233
313
 
253
333
    bus: dbus.SystemBus()
254
334
    """
255
335
    
256
 
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
257
 
                 servicetype = None, port = None, TXT = None,
258
 
                 domain = "", host = "", max_renames = 32768,
259
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
336
    def __init__(self,
 
337
                 interface = avahi.IF_UNSPEC,
 
338
                 name = None,
 
339
                 servicetype = None,
 
340
                 port = None,
 
341
                 TXT = None,
 
342
                 domain = "",
 
343
                 host = "",
 
344
                 max_renames = 32768,
 
345
                 protocol = avahi.PROTO_UNSPEC,
 
346
                 bus = None):
260
347
        self.interface = interface
261
348
        self.name = name
262
349
        self.type = servicetype
272
359
        self.bus = bus
273
360
        self.entry_group_state_changed_match = None
274
361
    
275
 
    def rename(self):
 
362
    def rename(self, remove=True):
276
363
        """Derived from the Avahi example code"""
277
364
        if self.rename_count >= self.max_renames:
278
365
            logger.critical("No suitable Zeroconf service name found"
279
366
                            " after %i retries, exiting.",
280
367
                            self.rename_count)
281
368
            raise AvahiServiceError("Too many renames")
282
 
        self.name = unicode(self.server
283
 
                            .GetAlternativeServiceName(self.name))
 
369
        self.name = str(
 
370
            self.server.GetAlternativeServiceName(self.name))
 
371
        self.rename_count += 1
284
372
        logger.info("Changing Zeroconf service name to %r ...",
285
373
                    self.name)
286
 
        self.remove()
 
374
        if remove:
 
375
            self.remove()
287
376
        try:
288
377
            self.add()
289
378
        except dbus.exceptions.DBusException as error:
290
 
            logger.critical("D-Bus Exception", exc_info=error)
291
 
            self.cleanup()
292
 
            os._exit(1)
293
 
        self.rename_count += 1
 
379
            if (error.get_dbus_name()
 
380
                == "org.freedesktop.Avahi.CollisionError"):
 
381
                logger.info("Local Zeroconf service name collision.")
 
382
                return self.rename(remove=False)
 
383
            else:
 
384
                logger.critical("D-Bus Exception", exc_info=error)
 
385
                self.cleanup()
 
386
                os._exit(1)
294
387
    
295
388
    def remove(self):
296
389
        """Derived from the Avahi example code"""
334
427
            self.rename()
335
428
        elif state == avahi.ENTRY_GROUP_FAILURE:
336
429
            logger.critical("Avahi: Error in group state changed %s",
337
 
                            unicode(error))
338
 
            raise AvahiGroupError("State changed: {0!s}"
339
 
                                  .format(error))
 
430
                            str(error))
 
431
            raise AvahiGroupError("State changed: {!s}".format(error))
340
432
    
341
433
    def cleanup(self):
342
434
        """Derived from the Avahi example code"""
352
444
    def server_state_changed(self, state, error=None):
353
445
        """Derived from the Avahi example code"""
354
446
        logger.debug("Avahi server state change: %i", state)
355
 
        bad_states = { avahi.SERVER_INVALID:
356
 
                           "Zeroconf server invalid",
357
 
                       avahi.SERVER_REGISTERING: None,
358
 
                       avahi.SERVER_COLLISION:
359
 
                           "Zeroconf server name collision",
360
 
                       avahi.SERVER_FAILURE:
361
 
                           "Zeroconf server failure" }
 
447
        bad_states = {
 
448
            avahi.SERVER_INVALID: "Zeroconf server invalid",
 
449
            avahi.SERVER_REGISTERING: None,
 
450
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
 
451
            avahi.SERVER_FAILURE: "Zeroconf server failure",
 
452
        }
362
453
        if state in bad_states:
363
454
            if bad_states[state] is not None:
364
455
                if error is None:
367
458
                    logger.error(bad_states[state] + ": %r", error)
368
459
            self.cleanup()
369
460
        elif state == avahi.SERVER_RUNNING:
370
 
            self.add()
 
461
            try:
 
462
                self.add()
 
463
            except dbus.exceptions.DBusException as error:
 
464
                if (error.get_dbus_name()
 
465
                    == "org.freedesktop.Avahi.CollisionError"):
 
466
                    logger.info("Local Zeroconf service name"
 
467
                                " collision.")
 
468
                    return self.rename(remove=False)
 
469
                else:
 
470
                    logger.critical("D-Bus Exception", exc_info=error)
 
471
                    self.cleanup()
 
472
                    os._exit(1)
371
473
        else:
372
474
            if error is None:
373
475
                logger.debug("Unknown state: %r", state)
383
485
                                    follow_name_owner_changes=True),
384
486
                avahi.DBUS_INTERFACE_SERVER)
385
487
        self.server.connect_to_signal("StateChanged",
386
 
                                 self.server_state_changed)
 
488
                                      self.server_state_changed)
387
489
        self.server_state_changed(self.server.GetState())
388
490
 
389
491
 
390
492
class AvahiServiceToSyslog(AvahiService):
391
 
    def rename(self):
 
493
    def rename(self, *args, **kwargs):
392
494
        """Add the new name to the syslog messages"""
393
 
        ret = AvahiService.rename(self)
394
 
        syslogger.setFormatter(logging.Formatter
395
 
                               ('Mandos ({0}) [%(process)d]:'
396
 
                                ' %(levelname)s: %(message)s'
397
 
                                .format(self.name)))
 
495
        ret = AvahiService.rename(self, *args, **kwargs)
 
496
        syslogger.setFormatter(logging.Formatter(
 
497
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
498
            .format(self.name)))
398
499
        return ret
399
500
 
400
 
 
401
 
def timedelta_to_milliseconds(td):
402
 
    "Convert a datetime.timedelta() to milliseconds"
403
 
    return ((td.days * 24 * 60 * 60 * 1000)
404
 
            + (td.seconds * 1000)
405
 
            + (td.microseconds // 1000))
406
 
 
 
501
# Pretend that we have a GnuTLS module
 
502
class GnuTLS(object):
 
503
    """This isn't so much a class as it is a module-like namespace.
 
504
    It is instantiated once, and simulates having a GnuTLS module."""
 
505
    
 
506
    _library = ctypes.cdll.LoadLibrary(
 
507
        ctypes.util.find_library("gnutls"))
 
508
    _need_version = b"3.3.0"
 
509
    def __init__(self):
 
510
        # Need to use class name "GnuTLS" here, since this method is
 
511
        # called before the assignment to the "gnutls" global variable
 
512
        # happens.
 
513
        if GnuTLS.check_version(self._need_version) is None:
 
514
            raise GnuTLS.Error("Needs GnuTLS {} or later"
 
515
                               .format(self._need_version))
 
516
    
 
517
    # Unless otherwise indicated, the constants and types below are
 
518
    # all from the gnutls/gnutls.h C header file.
 
519
    
 
520
    # Constants
 
521
    E_SUCCESS = 0
 
522
    E_INTERRUPTED = -52
 
523
    E_AGAIN = -28
 
524
    CRT_OPENPGP = 2
 
525
    CLIENT = 2
 
526
    SHUT_RDWR = 0
 
527
    CRD_CERTIFICATE = 1
 
528
    E_NO_CERTIFICATE_FOUND = -49
 
529
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
 
530
    
 
531
    # Types
 
532
    class session_int(ctypes.Structure):
 
533
        _fields_ = []
 
534
    session_t = ctypes.POINTER(session_int)
 
535
    class certificate_credentials_st(ctypes.Structure):
 
536
        _fields_ = []
 
537
    certificate_credentials_t = ctypes.POINTER(
 
538
        certificate_credentials_st)
 
539
    certificate_type_t = ctypes.c_int
 
540
    class datum_t(ctypes.Structure):
 
541
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
 
542
                    ('size', ctypes.c_uint)]
 
543
    class openpgp_crt_int(ctypes.Structure):
 
544
        _fields_ = []
 
545
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
546
    openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
 
547
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
 
548
    credentials_type_t = ctypes.c_int
 
549
    transport_ptr_t = ctypes.c_void_p
 
550
    close_request_t = ctypes.c_int
 
551
    
 
552
    # Exceptions
 
553
    class Error(Exception):
 
554
        # We need to use the class name "GnuTLS" here, since this
 
555
        # exception might be raised from within GnuTLS.__init__,
 
556
        # which is called before the assignment to the "gnutls"
 
557
        # global variable has happened.
 
558
        def __init__(self, message = None, code = None, args=()):
 
559
            # Default usage is by a message string, but if a return
 
560
            # code is passed, convert it to a string with
 
561
            # gnutls.strerror()
 
562
            self.code = code
 
563
            if message is None and code is not None:
 
564
                message = GnuTLS.strerror(code)
 
565
            return super(GnuTLS.Error, self).__init__(
 
566
                message, *args)
 
567
    
 
568
    class CertificateSecurityError(Error):
 
569
        pass
 
570
    
 
571
    # Classes
 
572
    class Credentials(object):
 
573
        def __init__(self):
 
574
            self._c_object = gnutls.certificate_credentials_t()
 
575
            gnutls.certificate_allocate_credentials(
 
576
                ctypes.byref(self._c_object))
 
577
            self.type = gnutls.CRD_CERTIFICATE
 
578
        
 
579
        def __del__(self):
 
580
            gnutls.certificate_free_credentials(self._c_object)
 
581
    
 
582
    class ClientSession(object):
 
583
        def __init__(self, socket, credentials = None):
 
584
            self._c_object = gnutls.session_t()
 
585
            gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
 
586
            gnutls.set_default_priority(self._c_object)
 
587
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
 
588
            gnutls.handshake_set_private_extensions(self._c_object,
 
589
                                                    True)
 
590
            self.socket = socket
 
591
            if credentials is None:
 
592
                credentials = gnutls.Credentials()
 
593
            gnutls.credentials_set(self._c_object, credentials.type,
 
594
                                   ctypes.cast(credentials._c_object,
 
595
                                               ctypes.c_void_p))
 
596
            self.credentials = credentials
 
597
        
 
598
        def __del__(self):
 
599
            gnutls.deinit(self._c_object)
 
600
        
 
601
        def handshake(self):
 
602
            return gnutls.handshake(self._c_object)
 
603
        
 
604
        def send(self, data):
 
605
            data = bytes(data)
 
606
            data_len = len(data)
 
607
            while data_len > 0:
 
608
                data_len -= gnutls.record_send(self._c_object,
 
609
                                               data[-data_len:],
 
610
                                               data_len)
 
611
        
 
612
        def bye(self):
 
613
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
614
    
 
615
    # Error handling functions
 
616
    def _error_code(result):
 
617
        """A function to raise exceptions on errors, suitable
 
618
        for the 'restype' attribute on ctypes functions"""
 
619
        if result >= 0:
 
620
            return result
 
621
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
 
622
            raise gnutls.CertificateSecurityError(code = result)
 
623
        raise gnutls.Error(code = result)
 
624
    
 
625
    def _retry_on_error(result, func, arguments):
 
626
        """A function to retry on some errors, suitable
 
627
        for the 'errcheck' attribute on ctypes functions"""
 
628
        while result < 0:
 
629
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
 
630
                return _error_code(result)
 
631
            result = func(*arguments)
 
632
        return result
 
633
    
 
634
    # Unless otherwise indicated, the function declarations below are
 
635
    # all from the gnutls/gnutls.h C header file.
 
636
    
 
637
    # Functions
 
638
    priority_set_direct = _library.gnutls_priority_set_direct
 
639
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
640
                                    ctypes.POINTER(ctypes.c_char_p)]
 
641
    priority_set_direct.restype = _error_code
 
642
    
 
643
    init = _library.gnutls_init
 
644
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
645
    init.restype = _error_code
 
646
    
 
647
    set_default_priority = _library.gnutls_set_default_priority
 
648
    set_default_priority.argtypes = [session_t]
 
649
    set_default_priority.restype = _error_code
 
650
    
 
651
    record_send = _library.gnutls_record_send
 
652
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
653
                            ctypes.c_size_t]
 
654
    record_send.restype = ctypes.c_ssize_t
 
655
    record_send.errcheck = _retry_on_error
 
656
    
 
657
    certificate_allocate_credentials = (
 
658
        _library.gnutls_certificate_allocate_credentials)
 
659
    certificate_allocate_credentials.argtypes = [
 
660
        ctypes.POINTER(certificate_credentials_t)]
 
661
    certificate_allocate_credentials.restype = _error_code
 
662
    
 
663
    certificate_free_credentials = (
 
664
        _library.gnutls_certificate_free_credentials)
 
665
    certificate_free_credentials.argtypes = [certificate_credentials_t]
 
666
    certificate_free_credentials.restype = None
 
667
    
 
668
    handshake_set_private_extensions = (
 
669
        _library.gnutls_handshake_set_private_extensions)
 
670
    handshake_set_private_extensions.argtypes = [session_t,
 
671
                                                 ctypes.c_int]
 
672
    handshake_set_private_extensions.restype = None
 
673
    
 
674
    credentials_set = _library.gnutls_credentials_set
 
675
    credentials_set.argtypes = [session_t, credentials_type_t,
 
676
                                ctypes.c_void_p]
 
677
    credentials_set.restype = _error_code
 
678
    
 
679
    strerror = _library.gnutls_strerror
 
680
    strerror.argtypes = [ctypes.c_int]
 
681
    strerror.restype = ctypes.c_char_p
 
682
    
 
683
    certificate_type_get = _library.gnutls_certificate_type_get
 
684
    certificate_type_get.argtypes = [session_t]
 
685
    certificate_type_get.restype = _error_code
 
686
    
 
687
    certificate_get_peers = _library.gnutls_certificate_get_peers
 
688
    certificate_get_peers.argtypes = [session_t,
 
689
                                      ctypes.POINTER(ctypes.c_uint)]
 
690
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
 
691
    
 
692
    global_set_log_level = _library.gnutls_global_set_log_level
 
693
    global_set_log_level.argtypes = [ctypes.c_int]
 
694
    global_set_log_level.restype = None
 
695
    
 
696
    global_set_log_function = _library.gnutls_global_set_log_function
 
697
    global_set_log_function.argtypes = [log_func]
 
698
    global_set_log_function.restype = None
 
699
    
 
700
    deinit = _library.gnutls_deinit
 
701
    deinit.argtypes = [session_t]
 
702
    deinit.restype = None
 
703
    
 
704
    handshake = _library.gnutls_handshake
 
705
    handshake.argtypes = [session_t]
 
706
    handshake.restype = _error_code
 
707
    handshake.errcheck = _retry_on_error
 
708
    
 
709
    transport_set_ptr = _library.gnutls_transport_set_ptr
 
710
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
711
    transport_set_ptr.restype = None
 
712
    
 
713
    bye = _library.gnutls_bye
 
714
    bye.argtypes = [session_t, close_request_t]
 
715
    bye.restype = _error_code
 
716
    bye.errcheck = _retry_on_error
 
717
    
 
718
    check_version = _library.gnutls_check_version
 
719
    check_version.argtypes = [ctypes.c_char_p]
 
720
    check_version.restype = ctypes.c_char_p
 
721
    
 
722
    # All the function declarations below are from gnutls/openpgp.h
 
723
    
 
724
    openpgp_crt_init = _library.gnutls_openpgp_crt_init
 
725
    openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
 
726
    openpgp_crt_init.restype = _error_code
 
727
    
 
728
    openpgp_crt_import = _library.gnutls_openpgp_crt_import
 
729
    openpgp_crt_import.argtypes = [openpgp_crt_t,
 
730
                                   ctypes.POINTER(datum_t),
 
731
                                   openpgp_crt_fmt_t]
 
732
    openpgp_crt_import.restype = _error_code
 
733
    
 
734
    openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
 
735
    openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
 
736
                                        ctypes.POINTER(ctypes.c_uint)]
 
737
    openpgp_crt_verify_self.restype = _error_code
 
738
    
 
739
    openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
 
740
    openpgp_crt_deinit.argtypes = [openpgp_crt_t]
 
741
    openpgp_crt_deinit.restype = None
 
742
    
 
743
    openpgp_crt_get_fingerprint = (
 
744
        _library.gnutls_openpgp_crt_get_fingerprint)
 
745
    openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
 
746
                                            ctypes.c_void_p,
 
747
                                            ctypes.POINTER(
 
748
                                                ctypes.c_size_t)]
 
749
    openpgp_crt_get_fingerprint.restype = _error_code
 
750
    
 
751
    # Remove non-public functions
 
752
    del _error_code, _retry_on_error
 
753
# Create the global "gnutls" object, simulating a module
 
754
gnutls = GnuTLS()
 
755
 
 
756
def call_pipe(connection,       # : multiprocessing.Connection
 
757
              func, *args, **kwargs):
 
758
    """This function is meant to be called by multiprocessing.Process
 
759
    
 
760
    This function runs func(*args, **kwargs), and writes the resulting
 
761
    return value on the provided multiprocessing.Connection.
 
762
    """
 
763
    connection.send(func(*args, **kwargs))
 
764
    connection.close()
407
765
 
408
766
class Client(object):
409
767
    """A representation of a client host served by this server.
415
773
    checker:    subprocess.Popen(); a running checker process used
416
774
                                    to see if the client lives.
417
775
                                    'None' if no process is running.
418
 
    checker_callback_tag: a gobject event source tag, or None
 
776
    checker_callback_tag: a GLib event source tag, or None
419
777
    checker_command: string; External command which is run to check
420
778
                     if client lives.  %() expansions are done at
421
779
                     runtime with vars(self) as dict, so that for
422
780
                     instance %(name)s can be used in the command.
423
 
    checker_initiator_tag: a gobject event source tag, or None
 
781
    checker_initiator_tag: a GLib event source tag, or None
424
782
    created:    datetime.datetime(); (UTC) object creation
425
783
    client_structure: Object describing what attributes a client has
426
784
                      and is used for storing the client at exit
427
785
    current_checker_command: string; current running checker_command
428
 
    disable_initiator_tag: a gobject event source tag, or None
 
786
    disable_initiator_tag: a GLib event source tag, or None
429
787
    enabled:    bool()
430
788
    fingerprint: string (40 or 32 hexadecimal digits); used to
431
789
                 uniquely identify the client
436
794
    last_checker_status: integer between 0 and 255 reflecting exit
437
795
                         status of last checker. -1 reflects crashed
438
796
                         checker, -2 means no checker completed yet.
 
797
    last_checker_signal: The signal which killed the last checker, if
 
798
                         last_checker_status is -1
439
799
    last_enabled: datetime.datetime(); (UTC) or None
440
800
    name:       string; from the config file, used in log messages and
441
801
                        D-Bus identifiers
454
814
                          "fingerprint", "host", "interval",
455
815
                          "last_approval_request", "last_checked_ok",
456
816
                          "last_enabled", "name", "timeout")
457
 
    client_defaults = { "timeout": "PT5M",
458
 
                        "extended_timeout": "PT15M",
459
 
                        "interval": "PT2M",
460
 
                        "checker": "fping -q -- %%(host)s",
461
 
                        "host": "",
462
 
                        "approval_delay": "PT0S",
463
 
                        "approval_duration": "PT1S",
464
 
                        "approved_by_default": "True",
465
 
                        "enabled": "True",
466
 
                        }
467
 
    
468
 
    def timeout_milliseconds(self):
469
 
        "Return the 'timeout' attribute in milliseconds"
470
 
        return timedelta_to_milliseconds(self.timeout)
471
 
    
472
 
    def extended_timeout_milliseconds(self):
473
 
        "Return the 'extended_timeout' attribute in milliseconds"
474
 
        return timedelta_to_milliseconds(self.extended_timeout)
475
 
    
476
 
    def interval_milliseconds(self):
477
 
        "Return the 'interval' attribute in milliseconds"
478
 
        return timedelta_to_milliseconds(self.interval)
479
 
    
480
 
    def approval_delay_milliseconds(self):
481
 
        return timedelta_to_milliseconds(self.approval_delay)
 
817
    client_defaults = {
 
818
        "timeout": "PT5M",
 
819
        "extended_timeout": "PT15M",
 
820
        "interval": "PT2M",
 
821
        "checker": "fping -q -- %%(host)s",
 
822
        "host": "",
 
823
        "approval_delay": "PT0S",
 
824
        "approval_duration": "PT1S",
 
825
        "approved_by_default": "True",
 
826
        "enabled": "True",
 
827
    }
482
828
    
483
829
    @staticmethod
484
830
    def config_parser(config):
500
846
            client["enabled"] = config.getboolean(client_name,
501
847
                                                  "enabled")
502
848
            
 
849
            # Uppercase and remove spaces from fingerprint for later
 
850
            # comparison purposes with return value from the
 
851
            # fingerprint() function
503
852
            client["fingerprint"] = (section["fingerprint"].upper()
504
853
                                     .replace(" ", ""))
505
854
            if "secret" in section:
506
 
                client["secret"] = section["secret"].decode("base64")
 
855
                client["secret"] = codecs.decode(section["secret"]
 
856
                                                 .encode("utf-8"),
 
857
                                                 "base64")
507
858
            elif "secfile" in section:
508
859
                with open(os.path.expanduser(os.path.expandvars
509
860
                                             (section["secfile"])),
510
861
                          "rb") as secfile:
511
862
                    client["secret"] = secfile.read()
512
863
            else:
513
 
                raise TypeError("No secret or secfile for section {0}"
 
864
                raise TypeError("No secret or secfile for section {}"
514
865
                                .format(section))
515
866
            client["timeout"] = string_to_delta(section["timeout"])
516
867
            client["extended_timeout"] = string_to_delta(
533
884
            server_settings = {}
534
885
        self.server_settings = server_settings
535
886
        # adding all client settings
536
 
        for setting, value in settings.iteritems():
 
887
        for setting, value in settings.items():
537
888
            setattr(self, setting, value)
538
889
        
539
890
        if self.enabled:
547
898
            self.expires = None
548
899
        
549
900
        logger.debug("Creating client %r", self.name)
550
 
        # Uppercase and remove spaces from fingerprint for later
551
 
        # comparison purposes with return value from the fingerprint()
552
 
        # function
553
901
        logger.debug("  Fingerprint: %s", self.fingerprint)
554
902
        self.created = settings.get("created",
555
903
                                    datetime.datetime.utcnow())
562
910
        self.current_checker_command = None
563
911
        self.approved = None
564
912
        self.approvals_pending = 0
565
 
        self.changedstate = (multiprocessing_manager
566
 
                             .Condition(multiprocessing_manager
567
 
                                        .Lock()))
568
 
        self.client_structure = [attr for attr in
569
 
                                 self.__dict__.iterkeys()
 
913
        self.changedstate = multiprocessing_manager.Condition(
 
914
            multiprocessing_manager.Lock())
 
915
        self.client_structure = [attr
 
916
                                 for attr in self.__dict__.keys()
570
917
                                 if not attr.startswith("_")]
571
918
        self.client_structure.append("client_structure")
572
919
        
573
 
        for name, t in inspect.getmembers(type(self),
574
 
                                          lambda obj:
575
 
                                              isinstance(obj,
576
 
                                                         property)):
 
920
        for name, t in inspect.getmembers(
 
921
                type(self), lambda obj: isinstance(obj, property)):
577
922
            if not name.startswith("_"):
578
923
                self.client_structure.append(name)
579
924
    
600
945
        if not quiet:
601
946
            logger.info("Disabling client %s", self.name)
602
947
        if getattr(self, "disable_initiator_tag", None) is not None:
603
 
            gobject.source_remove(self.disable_initiator_tag)
 
948
            GLib.source_remove(self.disable_initiator_tag)
604
949
            self.disable_initiator_tag = None
605
950
        self.expires = None
606
951
        if getattr(self, "checker_initiator_tag", None) is not None:
607
 
            gobject.source_remove(self.checker_initiator_tag)
 
952
            GLib.source_remove(self.checker_initiator_tag)
608
953
            self.checker_initiator_tag = None
609
954
        self.stop_checker()
610
955
        self.enabled = False
611
956
        if not quiet:
612
957
            self.send_changedstate()
613
 
        # Do not run this again if called by a gobject.timeout_add
 
958
        # Do not run this again if called by a GLib.timeout_add
614
959
        return False
615
960
    
616
961
    def __del__(self):
620
965
        # Schedule a new checker to be started an 'interval' from now,
621
966
        # and every interval from then on.
622
967
        if self.checker_initiator_tag is not None:
623
 
            gobject.source_remove(self.checker_initiator_tag)
624
 
        self.checker_initiator_tag = (gobject.timeout_add
625
 
                                      (self.interval_milliseconds(),
626
 
                                       self.start_checker))
 
968
            GLib.source_remove(self.checker_initiator_tag)
 
969
        self.checker_initiator_tag = GLib.timeout_add(
 
970
            int(self.interval.total_seconds() * 1000),
 
971
            self.start_checker)
627
972
        # Schedule a disable() when 'timeout' has passed
628
973
        if self.disable_initiator_tag is not None:
629
 
            gobject.source_remove(self.disable_initiator_tag)
630
 
        self.disable_initiator_tag = (gobject.timeout_add
631
 
                                   (self.timeout_milliseconds(),
632
 
                                    self.disable))
 
974
            GLib.source_remove(self.disable_initiator_tag)
 
975
        self.disable_initiator_tag = GLib.timeout_add(
 
976
            int(self.timeout.total_seconds() * 1000), self.disable)
633
977
        # Also start a new checker *right now*.
634
978
        self.start_checker()
635
979
    
636
 
    def checker_callback(self, pid, condition, command):
 
980
    def checker_callback(self, source, condition, connection,
 
981
                         command):
637
982
        """The checker has completed, so take appropriate actions."""
638
983
        self.checker_callback_tag = None
639
984
        self.checker = None
640
 
        if os.WIFEXITED(condition):
641
 
            self.last_checker_status = os.WEXITSTATUS(condition)
 
985
        # Read return code from connection (see call_pipe)
 
986
        returncode = connection.recv()
 
987
        connection.close()
 
988
        
 
989
        if returncode >= 0:
 
990
            self.last_checker_status = returncode
 
991
            self.last_checker_signal = None
642
992
            if self.last_checker_status == 0:
643
993
                logger.info("Checker for %(name)s succeeded",
644
994
                            vars(self))
645
995
                self.checked_ok()
646
996
            else:
647
 
                logger.info("Checker for %(name)s failed",
648
 
                            vars(self))
 
997
                logger.info("Checker for %(name)s failed", vars(self))
649
998
        else:
650
999
            self.last_checker_status = -1
 
1000
            self.last_checker_signal = -returncode
651
1001
            logger.warning("Checker for %(name)s crashed?",
652
1002
                           vars(self))
 
1003
        return False
653
1004
    
654
1005
    def checked_ok(self):
655
1006
        """Assert that the client has been seen, alive and well."""
656
1007
        self.last_checked_ok = datetime.datetime.utcnow()
657
1008
        self.last_checker_status = 0
 
1009
        self.last_checker_signal = None
658
1010
        self.bump_timeout()
659
1011
    
660
1012
    def bump_timeout(self, timeout=None):
662
1014
        if timeout is None:
663
1015
            timeout = self.timeout
664
1016
        if self.disable_initiator_tag is not None:
665
 
            gobject.source_remove(self.disable_initiator_tag)
 
1017
            GLib.source_remove(self.disable_initiator_tag)
666
1018
            self.disable_initiator_tag = None
667
1019
        if getattr(self, "enabled", False):
668
 
            self.disable_initiator_tag = (gobject.timeout_add
669
 
                                          (timedelta_to_milliseconds
670
 
                                           (timeout), self.disable))
 
1020
            self.disable_initiator_tag = GLib.timeout_add(
 
1021
                int(timeout.total_seconds() * 1000), self.disable)
671
1022
            self.expires = datetime.datetime.utcnow() + timeout
672
1023
    
673
1024
    def need_approval(self):
687
1038
        # than 'timeout' for the client to be disabled, which is as it
688
1039
        # should be.
689
1040
        
690
 
        # If a checker exists, make sure it is not a zombie
691
 
        try:
692
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
 
        except (AttributeError, OSError) as error:
694
 
            if (isinstance(error, OSError)
695
 
                and error.errno != errno.ECHILD):
696
 
                raise error
697
 
        else:
698
 
            if pid:
699
 
                logger.warning("Checker was a zombie")
700
 
                gobject.source_remove(self.checker_callback_tag)
701
 
                self.checker_callback(pid, status,
702
 
                                      self.current_checker_command)
 
1041
        if self.checker is not None and not self.checker.is_alive():
 
1042
            logger.warning("Checker was not alive; joining")
 
1043
            self.checker.join()
 
1044
            self.checker = None
703
1045
        # Start a new checker if needed
704
1046
        if self.checker is None:
705
1047
            # Escape attributes for the shell
706
 
            escaped_attrs = dict(
707
 
                (attr, re.escape(unicode(getattr(self, attr))))
708
 
                for attr in
709
 
                self.runtime_expansions)
 
1048
            escaped_attrs = {
 
1049
                attr: re.escape(str(getattr(self, attr)))
 
1050
                for attr in self.runtime_expansions }
710
1051
            try:
711
1052
                command = self.checker_command % escaped_attrs
712
1053
            except TypeError as error:
713
1054
                logger.error('Could not format string "%s"',
714
 
                             self.checker_command, exc_info=error)
715
 
                return True # Try again later
 
1055
                             self.checker_command,
 
1056
                             exc_info=error)
 
1057
                return True     # Try again later
716
1058
            self.current_checker_command = command
717
 
            try:
718
 
                logger.info("Starting checker %r for %s",
719
 
                            command, self.name)
720
 
                # We don't need to redirect stdout and stderr, since
721
 
                # in normal mode, that is already done by daemon(),
722
 
                # and in debug mode we don't want to.  (Stdin is
723
 
                # always replaced by /dev/null.)
724
 
                # The exception is when not debugging but nevertheless
725
 
                # running in the foreground; use the previously
726
 
                # created wnull.
727
 
                popen_args = {}
728
 
                if (not self.server_settings["debug"]
729
 
                    and self.server_settings["foreground"]):
730
 
                    popen_args.update({"stdout": wnull,
731
 
                                       "stderr": wnull })
732
 
                self.checker = subprocess.Popen(command,
733
 
                                                close_fds=True,
734
 
                                                shell=True, cwd="/",
735
 
                                                **popen_args)
736
 
            except OSError as error:
737
 
                logger.error("Failed to start subprocess",
738
 
                             exc_info=error)
739
 
                return True
740
 
            self.checker_callback_tag = (gobject.child_watch_add
741
 
                                         (self.checker.pid,
742
 
                                          self.checker_callback,
743
 
                                          data=command))
744
 
            # The checker may have completed before the gobject
745
 
            # watch was added.  Check for this.
746
 
            try:
747
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
 
            except OSError as error:
749
 
                if error.errno == errno.ECHILD:
750
 
                    # This should never happen
751
 
                    logger.error("Child process vanished",
752
 
                                 exc_info=error)
753
 
                    return True
754
 
                raise
755
 
            if pid:
756
 
                gobject.source_remove(self.checker_callback_tag)
757
 
                self.checker_callback(pid, status, command)
758
 
        # Re-run this periodically if run by gobject.timeout_add
 
1059
            logger.info("Starting checker %r for %s", command,
 
1060
                        self.name)
 
1061
            # We don't need to redirect stdout and stderr, since
 
1062
            # in normal mode, that is already done by daemon(),
 
1063
            # and in debug mode we don't want to.  (Stdin is
 
1064
            # always replaced by /dev/null.)
 
1065
            # The exception is when not debugging but nevertheless
 
1066
            # running in the foreground; use the previously
 
1067
            # created wnull.
 
1068
            popen_args = { "close_fds": True,
 
1069
                           "shell": True,
 
1070
                           "cwd": "/" }
 
1071
            if (not self.server_settings["debug"]
 
1072
                and self.server_settings["foreground"]):
 
1073
                popen_args.update({"stdout": wnull,
 
1074
                                   "stderr": wnull })
 
1075
            pipe = multiprocessing.Pipe(duplex = False)
 
1076
            self.checker = multiprocessing.Process(
 
1077
                target = call_pipe,
 
1078
                args = (pipe[1], subprocess.call, command),
 
1079
                kwargs = popen_args)
 
1080
            self.checker.start()
 
1081
            self.checker_callback_tag = GLib.io_add_watch(
 
1082
                pipe[0].fileno(), GLib.IO_IN,
 
1083
                self.checker_callback, pipe[0], command)
 
1084
        # Re-run this periodically if run by GLib.timeout_add
759
1085
        return True
760
1086
    
761
1087
    def stop_checker(self):
762
1088
        """Force the checker process, if any, to stop."""
763
1089
        if self.checker_callback_tag:
764
 
            gobject.source_remove(self.checker_callback_tag)
 
1090
            GLib.source_remove(self.checker_callback_tag)
765
1091
            self.checker_callback_tag = None
766
1092
        if getattr(self, "checker", None) is None:
767
1093
            return
768
1094
        logger.debug("Stopping checker for %(name)s", vars(self))
769
 
        try:
770
 
            self.checker.terminate()
771
 
            #time.sleep(0.5)
772
 
            #if self.checker.poll() is None:
773
 
            #    self.checker.kill()
774
 
        except OSError as error:
775
 
            if error.errno != errno.ESRCH: # No such process
776
 
                raise
 
1095
        self.checker.terminate()
777
1096
        self.checker = None
778
1097
 
779
1098
 
780
 
def dbus_service_property(dbus_interface, signature="v",
781
 
                          access="readwrite", byte_arrays=False):
 
1099
def dbus_service_property(dbus_interface,
 
1100
                          signature="v",
 
1101
                          access="readwrite",
 
1102
                          byte_arrays=False):
782
1103
    """Decorators for marking methods of a DBusObjectWithProperties to
783
1104
    become properties on the D-Bus.
784
1105
    
793
1114
    # "Set" method, so we fail early here:
794
1115
    if byte_arrays and signature != "ay":
795
1116
        raise ValueError("Byte arrays not supported for non-'ay'"
796
 
                         " signature {0!r}".format(signature))
 
1117
                         " signature {!r}".format(signature))
 
1118
    
797
1119
    def decorator(func):
798
1120
        func._dbus_is_property = True
799
1121
        func._dbus_interface = dbus_interface
804
1126
            func._dbus_name = func._dbus_name[:-14]
805
1127
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
806
1128
        return func
 
1129
    
807
1130
    return decorator
808
1131
 
809
1132
 
818
1141
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
819
1142
                    "false"}
820
1143
    """
 
1144
    
821
1145
    def decorator(func):
822
1146
        func._dbus_is_interface = True
823
1147
        func._dbus_interface = dbus_interface
824
1148
        func._dbus_name = dbus_interface
825
1149
        return func
 
1150
    
826
1151
    return decorator
827
1152
 
828
1153
 
830
1155
    """Decorator to annotate D-Bus methods, signals or properties
831
1156
    Usage:
832
1157
    
 
1158
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
 
1159
                       "org.freedesktop.DBus.Property."
 
1160
                       "EmitsChangedSignal": "false"})
833
1161
    @dbus_service_property("org.example.Interface", signature="b",
834
1162
                           access="r")
835
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
836
 
                        "org.freedesktop.DBus.Property."
837
 
                        "EmitsChangedSignal": "false"})
838
1163
    def Property_dbus_property(self):
839
1164
        return dbus.Boolean(False)
 
1165
    
 
1166
    See also the DBusObjectWithAnnotations class.
840
1167
    """
 
1168
    
841
1169
    def decorator(func):
842
1170
        func._dbus_annotations = annotations
843
1171
        return func
 
1172
    
844
1173
    return decorator
845
1174
 
846
1175
 
847
1176
class DBusPropertyException(dbus.exceptions.DBusException):
848
1177
    """A base class for D-Bus property-related exceptions
849
1178
    """
850
 
    def __unicode__(self):
851
 
        return unicode(str(self))
 
1179
    pass
852
1180
 
853
1181
 
854
1182
class DBusPropertyAccessException(DBusPropertyException):
863
1191
    pass
864
1192
 
865
1193
 
866
 
class DBusObjectWithProperties(dbus.service.Object):
867
 
    """A D-Bus object with properties.
 
1194
class DBusObjectWithAnnotations(dbus.service.Object):
 
1195
    """A D-Bus object with annotations.
868
1196
    
869
 
    Classes inheriting from this can use the dbus_service_property
870
 
    decorator to expose methods as D-Bus properties.  It exposes the
871
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1197
    Classes inheriting from this can use the dbus_annotations
 
1198
    decorator to add annotations to methods or signals.
872
1199
    """
873
1200
    
874
1201
    @staticmethod
878
1205
        If called like _is_dbus_thing("method") it returns a function
879
1206
        suitable for use as predicate to inspect.getmembers().
880
1207
        """
881
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
1208
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
882
1209
                                   False)
883
1210
    
884
1211
    def _get_all_dbus_things(self, thing):
885
1212
        """Returns a generator of (name, attribute) pairs
886
1213
        """
887
 
        return ((getattr(athing.__get__(self), "_dbus_name",
888
 
                         name),
 
1214
        return ((getattr(athing.__get__(self), "_dbus_name", name),
889
1215
                 athing.__get__(self))
890
1216
                for cls in self.__class__.__mro__
891
1217
                for name, athing in
892
 
                inspect.getmembers(cls,
893
 
                                   self._is_dbus_thing(thing)))
 
1218
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
1219
    
 
1220
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1221
                         out_signature = "s",
 
1222
                         path_keyword = 'object_path',
 
1223
                         connection_keyword = 'connection')
 
1224
    def Introspect(self, object_path, connection):
 
1225
        """Overloading of standard D-Bus method.
 
1226
        
 
1227
        Inserts annotation tags on methods and signals.
 
1228
        """
 
1229
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
1230
                                                   connection)
 
1231
        try:
 
1232
            document = xml.dom.minidom.parseString(xmlstring)
 
1233
            
 
1234
            for if_tag in document.getElementsByTagName("interface"):
 
1235
                # Add annotation tags
 
1236
                for typ in ("method", "signal"):
 
1237
                    for tag in if_tag.getElementsByTagName(typ):
 
1238
                        annots = dict()
 
1239
                        for name, prop in (self.
 
1240
                                           _get_all_dbus_things(typ)):
 
1241
                            if (name == tag.getAttribute("name")
 
1242
                                and prop._dbus_interface
 
1243
                                == if_tag.getAttribute("name")):
 
1244
                                annots.update(getattr(
 
1245
                                    prop, "_dbus_annotations", {}))
 
1246
                        for name, value in annots.items():
 
1247
                            ann_tag = document.createElement(
 
1248
                                "annotation")
 
1249
                            ann_tag.setAttribute("name", name)
 
1250
                            ann_tag.setAttribute("value", value)
 
1251
                            tag.appendChild(ann_tag)
 
1252
                # Add interface annotation tags
 
1253
                for annotation, value in dict(
 
1254
                    itertools.chain.from_iterable(
 
1255
                        annotations().items()
 
1256
                        for name, annotations
 
1257
                        in self._get_all_dbus_things("interface")
 
1258
                        if name == if_tag.getAttribute("name")
 
1259
                        )).items():
 
1260
                    ann_tag = document.createElement("annotation")
 
1261
                    ann_tag.setAttribute("name", annotation)
 
1262
                    ann_tag.setAttribute("value", value)
 
1263
                    if_tag.appendChild(ann_tag)
 
1264
                # Fix argument name for the Introspect method itself
 
1265
                if (if_tag.getAttribute("name")
 
1266
                                == dbus.INTROSPECTABLE_IFACE):
 
1267
                    for cn in if_tag.getElementsByTagName("method"):
 
1268
                        if cn.getAttribute("name") == "Introspect":
 
1269
                            for arg in cn.getElementsByTagName("arg"):
 
1270
                                if (arg.getAttribute("direction")
 
1271
                                    == "out"):
 
1272
                                    arg.setAttribute("name",
 
1273
                                                     "xml_data")
 
1274
            xmlstring = document.toxml("utf-8")
 
1275
            document.unlink()
 
1276
        except (AttributeError, xml.dom.DOMException,
 
1277
                xml.parsers.expat.ExpatError) as error:
 
1278
            logger.error("Failed to override Introspection method",
 
1279
                         exc_info=error)
 
1280
        return xmlstring
 
1281
 
 
1282
 
 
1283
class DBusObjectWithProperties(DBusObjectWithAnnotations):
 
1284
    """A D-Bus object with properties.
 
1285
    
 
1286
    Classes inheriting from this can use the dbus_service_property
 
1287
    decorator to expose methods as D-Bus properties.  It exposes the
 
1288
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1289
    """
894
1290
    
895
1291
    def _get_dbus_property(self, interface_name, property_name):
896
1292
        """Returns a bound method if one exists which is a D-Bus
897
1293
        property with the specified name and interface.
898
1294
        """
899
 
        for cls in  self.__class__.__mro__:
900
 
            for name, value in (inspect.getmembers
901
 
                                (cls,
902
 
                                 self._is_dbus_thing("property"))):
 
1295
        for cls in self.__class__.__mro__:
 
1296
            for name, value in inspect.getmembers(
 
1297
                    cls, self._is_dbus_thing("property")):
903
1298
                if (value._dbus_name == property_name
904
1299
                    and value._dbus_interface == interface_name):
905
1300
                    return value.__get__(self)
906
1301
        
907
1302
        # No such property
908
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
909
 
                                   + interface_name + "."
910
 
                                   + property_name)
911
 
    
912
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
1303
        raise DBusPropertyNotFound("{}:{}.{}".format(
 
1304
            self.dbus_object_path, interface_name, property_name))
 
1305
    
 
1306
    @classmethod
 
1307
    def _get_all_interface_names(cls):
 
1308
        """Get a sequence of all interfaces supported by an object"""
 
1309
        return (name for name in set(getattr(getattr(x, attr),
 
1310
                                             "_dbus_interface", None)
 
1311
                                     for x in (inspect.getmro(cls))
 
1312
                                     for attr in dir(x))
 
1313
                if name is not None)
 
1314
    
 
1315
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1316
                         in_signature="ss",
913
1317
                         out_signature="v")
914
1318
    def Get(self, interface_name, property_name):
915
1319
        """Standard D-Bus property Get() method, see D-Bus standard.
933
1337
            # The byte_arrays option is not supported yet on
934
1338
            # signatures other than "ay".
935
1339
            if prop._dbus_signature != "ay":
936
 
                raise ValueError
 
1340
                raise ValueError("Byte arrays not supported for non-"
 
1341
                                 "'ay' signature {!r}"
 
1342
                                 .format(prop._dbus_signature))
937
1343
            value = dbus.ByteArray(b''.join(chr(byte)
938
1344
                                            for byte in value))
939
1345
        prop(value)
940
1346
    
941
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
1347
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1348
                         in_signature="s",
942
1349
                         out_signature="a{sv}")
943
1350
    def GetAll(self, interface_name):
944
1351
        """Standard D-Bus property GetAll() method, see D-Bus
959
1366
            if not hasattr(value, "variant_level"):
960
1367
                properties[name] = value
961
1368
                continue
962
 
            properties[name] = type(value)(value, variant_level=
963
 
                                           value.variant_level+1)
 
1369
            properties[name] = type(value)(
 
1370
                value, variant_level = value.variant_level + 1)
964
1371
        return dbus.Dictionary(properties, signature="sv")
965
1372
    
 
1373
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
 
1374
    def PropertiesChanged(self, interface_name, changed_properties,
 
1375
                          invalidated_properties):
 
1376
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
 
1377
        standard.
 
1378
        """
 
1379
        pass
 
1380
    
966
1381
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
967
1382
                         out_signature="s",
968
1383
                         path_keyword='object_path',
972
1387
        
973
1388
        Inserts property tags and interface annotation tags.
974
1389
        """
975
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
976
 
                                                   connection)
 
1390
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1391
                                                         object_path,
 
1392
                                                         connection)
977
1393
        try:
978
1394
            document = xml.dom.minidom.parseString(xmlstring)
 
1395
            
979
1396
            def make_tag(document, name, prop):
980
1397
                e = document.createElement("property")
981
1398
                e.setAttribute("name", name)
982
1399
                e.setAttribute("type", prop._dbus_signature)
983
1400
                e.setAttribute("access", prop._dbus_access)
984
1401
                return e
 
1402
            
985
1403
            for if_tag in document.getElementsByTagName("interface"):
986
1404
                # Add property tags
987
1405
                for tag in (make_tag(document, name, prop)
990
1408
                            if prop._dbus_interface
991
1409
                            == if_tag.getAttribute("name")):
992
1410
                    if_tag.appendChild(tag)
993
 
                # Add annotation tags
994
 
                for typ in ("method", "signal", "property"):
995
 
                    for tag in if_tag.getElementsByTagName(typ):
996
 
                        annots = dict()
997
 
                        for name, prop in (self.
998
 
                                           _get_all_dbus_things(typ)):
999
 
                            if (name == tag.getAttribute("name")
1000
 
                                and prop._dbus_interface
1001
 
                                == if_tag.getAttribute("name")):
1002
 
                                annots.update(getattr
1003
 
                                              (prop,
1004
 
                                               "_dbus_annotations",
1005
 
                                               {}))
1006
 
                        for name, value in annots.iteritems():
1007
 
                            ann_tag = document.createElement(
1008
 
                                "annotation")
1009
 
                            ann_tag.setAttribute("name", name)
1010
 
                            ann_tag.setAttribute("value", value)
1011
 
                            tag.appendChild(ann_tag)
1012
 
                # Add interface annotation tags
1013
 
                for annotation, value in dict(
1014
 
                    itertools.chain.from_iterable(
1015
 
                        annotations().iteritems()
1016
 
                        for name, annotations in
1017
 
                        self._get_all_dbus_things("interface")
1018
 
                        if name == if_tag.getAttribute("name")
1019
 
                        )).iteritems():
1020
 
                    ann_tag = document.createElement("annotation")
1021
 
                    ann_tag.setAttribute("name", annotation)
1022
 
                    ann_tag.setAttribute("value", value)
1023
 
                    if_tag.appendChild(ann_tag)
 
1411
                # Add annotation tags for properties
 
1412
                for tag in if_tag.getElementsByTagName("property"):
 
1413
                    annots = dict()
 
1414
                    for name, prop in self._get_all_dbus_things(
 
1415
                            "property"):
 
1416
                        if (name == tag.getAttribute("name")
 
1417
                            and prop._dbus_interface
 
1418
                            == if_tag.getAttribute("name")):
 
1419
                            annots.update(getattr(
 
1420
                                prop, "_dbus_annotations", {}))
 
1421
                    for name, value in annots.items():
 
1422
                        ann_tag = document.createElement(
 
1423
                            "annotation")
 
1424
                        ann_tag.setAttribute("name", name)
 
1425
                        ann_tag.setAttribute("value", value)
 
1426
                        tag.appendChild(ann_tag)
1024
1427
                # Add the names to the return values for the
1025
1428
                # "org.freedesktop.DBus.Properties" methods
1026
1429
                if (if_tag.getAttribute("name")
1044
1447
                         exc_info=error)
1045
1448
        return xmlstring
1046
1449
 
 
1450
try:
 
1451
    dbus.OBJECT_MANAGER_IFACE
 
1452
except AttributeError:
 
1453
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
 
1454
 
 
1455
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
 
1456
    """A D-Bus object with an ObjectManager.
 
1457
    
 
1458
    Classes inheriting from this exposes the standard
 
1459
    GetManagedObjects call and the InterfacesAdded and
 
1460
    InterfacesRemoved signals on the standard
 
1461
    "org.freedesktop.DBus.ObjectManager" interface.
 
1462
    
 
1463
    Note: No signals are sent automatically; they must be sent
 
1464
    manually.
 
1465
    """
 
1466
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
1467
                         out_signature = "a{oa{sa{sv}}}")
 
1468
    def GetManagedObjects(self):
 
1469
        """This function must be overridden"""
 
1470
        raise NotImplementedError()
 
1471
    
 
1472
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
 
1473
                         signature = "oa{sa{sv}}")
 
1474
    def InterfacesAdded(self, object_path, interfaces_and_properties):
 
1475
        pass
 
1476
    
 
1477
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
 
1478
    def InterfacesRemoved(self, object_path, interfaces):
 
1479
        pass
 
1480
    
 
1481
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1482
                         out_signature = "s",
 
1483
                         path_keyword = 'object_path',
 
1484
                         connection_keyword = 'connection')
 
1485
    def Introspect(self, object_path, connection):
 
1486
        """Overloading of standard D-Bus method.
 
1487
        
 
1488
        Override return argument name of GetManagedObjects to be
 
1489
        "objpath_interfaces_and_properties"
 
1490
        """
 
1491
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1492
                                                         object_path,
 
1493
                                                         connection)
 
1494
        try:
 
1495
            document = xml.dom.minidom.parseString(xmlstring)
 
1496
            
 
1497
            for if_tag in document.getElementsByTagName("interface"):
 
1498
                # Fix argument name for the GetManagedObjects method
 
1499
                if (if_tag.getAttribute("name")
 
1500
                                == dbus.OBJECT_MANAGER_IFACE):
 
1501
                    for cn in if_tag.getElementsByTagName("method"):
 
1502
                        if (cn.getAttribute("name")
 
1503
                            == "GetManagedObjects"):
 
1504
                            for arg in cn.getElementsByTagName("arg"):
 
1505
                                if (arg.getAttribute("direction")
 
1506
                                    == "out"):
 
1507
                                    arg.setAttribute(
 
1508
                                        "name",
 
1509
                                        "objpath_interfaces"
 
1510
                                        "_and_properties")
 
1511
            xmlstring = document.toxml("utf-8")
 
1512
            document.unlink()
 
1513
        except (AttributeError, xml.dom.DOMException,
 
1514
                xml.parsers.expat.ExpatError) as error:
 
1515
            logger.error("Failed to override Introspection method",
 
1516
                         exc_info = error)
 
1517
        return xmlstring
1047
1518
 
1048
1519
def datetime_to_dbus(dt, variant_level=0):
1049
1520
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1050
1521
    if dt is None:
1051
1522
        return dbus.String("", variant_level = variant_level)
1052
 
    return dbus.String(dt.isoformat(),
1053
 
                       variant_level=variant_level)
 
1523
    return dbus.String(dt.isoformat(), variant_level=variant_level)
1054
1524
 
1055
1525
 
1056
1526
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1076
1546
    (from DBusObjectWithProperties) and interfaces (from the
1077
1547
    dbus_interface_annotations decorator).
1078
1548
    """
 
1549
    
1079
1550
    def wrapper(cls):
1080
1551
        for orig_interface_name, alt_interface_name in (
1081
 
            alt_interface_names.iteritems()):
 
1552
                alt_interface_names.items()):
1082
1553
            attr = {}
1083
1554
            interface_names = set()
1084
1555
            # Go though all attributes of the class
1086
1557
                # Ignore non-D-Bus attributes, and D-Bus attributes
1087
1558
                # with the wrong interface name
1088
1559
                if (not hasattr(attribute, "_dbus_interface")
1089
 
                    or not attribute._dbus_interface
1090
 
                    .startswith(orig_interface_name)):
 
1560
                    or not attribute._dbus_interface.startswith(
 
1561
                        orig_interface_name)):
1091
1562
                    continue
1092
1563
                # Create an alternate D-Bus interface name based on
1093
1564
                # the current name
1094
 
                alt_interface = (attribute._dbus_interface
1095
 
                                 .replace(orig_interface_name,
1096
 
                                          alt_interface_name))
 
1565
                alt_interface = attribute._dbus_interface.replace(
 
1566
                    orig_interface_name, alt_interface_name)
1097
1567
                interface_names.add(alt_interface)
1098
1568
                # Is this a D-Bus signal?
1099
1569
                if getattr(attribute, "_dbus_is_signal", False):
1100
1570
                    # Extract the original non-method undecorated
1101
1571
                    # function by black magic
1102
 
                    nonmethod_func = (dict(
 
1572
                    if sys.version_info.major == 2:
 
1573
                        nonmethod_func = (dict(
1103
1574
                            zip(attribute.func_code.co_freevars,
1104
 
                                attribute.__closure__))["func"]
1105
 
                                      .cell_contents)
 
1575
                                attribute.__closure__))
 
1576
                                          ["func"].cell_contents)
 
1577
                    else:
 
1578
                        nonmethod_func = (dict(
 
1579
                            zip(attribute.__code__.co_freevars,
 
1580
                                attribute.__closure__))
 
1581
                                          ["func"].cell_contents)
1106
1582
                    # Create a new, but exactly alike, function
1107
1583
                    # object, and decorate it to be a new D-Bus signal
1108
1584
                    # with the alternate D-Bus interface name
1109
 
                    new_function = (dbus.service.signal
1110
 
                                    (alt_interface,
1111
 
                                     attribute._dbus_signature)
1112
 
                                    (types.FunctionType(
1113
 
                                nonmethod_func.func_code,
1114
 
                                nonmethod_func.func_globals,
1115
 
                                nonmethod_func.func_name,
1116
 
                                nonmethod_func.func_defaults,
1117
 
                                nonmethod_func.func_closure)))
 
1585
                    new_function = copy_function(nonmethod_func)
 
1586
                    new_function = (dbus.service.signal(
 
1587
                        alt_interface,
 
1588
                        attribute._dbus_signature)(new_function))
1118
1589
                    # Copy annotations, if any
1119
1590
                    try:
1120
 
                        new_function._dbus_annotations = (
1121
 
                            dict(attribute._dbus_annotations))
 
1591
                        new_function._dbus_annotations = dict(
 
1592
                            attribute._dbus_annotations)
1122
1593
                    except AttributeError:
1123
1594
                        pass
1124
1595
                    # Define a creator of a function to call both the
1129
1600
                        """This function is a scope container to pass
1130
1601
                        func1 and func2 to the "call_both" function
1131
1602
                        outside of its arguments"""
 
1603
                        
 
1604
                        @functools.wraps(func2)
1132
1605
                        def call_both(*args, **kwargs):
1133
1606
                            """This function will emit two D-Bus
1134
1607
                            signals by calling func1 and func2"""
1135
1608
                            func1(*args, **kwargs)
1136
1609
                            func2(*args, **kwargs)
 
1610
                        # Make wrapper function look like a D-Bus signal
 
1611
                        for name, attr in inspect.getmembers(func2):
 
1612
                            if name.startswith("_dbus_"):
 
1613
                                setattr(call_both, name, attr)
 
1614
                        
1137
1615
                        return call_both
1138
1616
                    # Create the "call_both" function and add it to
1139
1617
                    # the class
1144
1622
                    # object.  Decorate it to be a new D-Bus method
1145
1623
                    # with the alternate D-Bus interface name.  Add it
1146
1624
                    # to the class.
1147
 
                    attr[attrname] = (dbus.service.method
1148
 
                                      (alt_interface,
1149
 
                                       attribute._dbus_in_signature,
1150
 
                                       attribute._dbus_out_signature)
1151
 
                                      (types.FunctionType
1152
 
                                       (attribute.func_code,
1153
 
                                        attribute.func_globals,
1154
 
                                        attribute.func_name,
1155
 
                                        attribute.func_defaults,
1156
 
                                        attribute.func_closure)))
 
1625
                    attr[attrname] = (
 
1626
                        dbus.service.method(
 
1627
                            alt_interface,
 
1628
                            attribute._dbus_in_signature,
 
1629
                            attribute._dbus_out_signature)
 
1630
                        (copy_function(attribute)))
1157
1631
                    # Copy annotations, if any
1158
1632
                    try:
1159
 
                        attr[attrname]._dbus_annotations = (
1160
 
                            dict(attribute._dbus_annotations))
 
1633
                        attr[attrname]._dbus_annotations = dict(
 
1634
                            attribute._dbus_annotations)
1161
1635
                    except AttributeError:
1162
1636
                        pass
1163
1637
                # Is this a D-Bus property?
1166
1640
                    # object, and decorate it to be a new D-Bus
1167
1641
                    # property with the alternate D-Bus interface
1168
1642
                    # name.  Add it to the class.
1169
 
                    attr[attrname] = (dbus_service_property
1170
 
                                      (alt_interface,
1171
 
                                       attribute._dbus_signature,
1172
 
                                       attribute._dbus_access,
1173
 
                                       attribute
1174
 
                                       ._dbus_get_args_options
1175
 
                                       ["byte_arrays"])
1176
 
                                      (types.FunctionType
1177
 
                                       (attribute.func_code,
1178
 
                                        attribute.func_globals,
1179
 
                                        attribute.func_name,
1180
 
                                        attribute.func_defaults,
1181
 
                                        attribute.func_closure)))
 
1643
                    attr[attrname] = (dbus_service_property(
 
1644
                        alt_interface, attribute._dbus_signature,
 
1645
                        attribute._dbus_access,
 
1646
                        attribute._dbus_get_args_options
 
1647
                        ["byte_arrays"])
 
1648
                                      (copy_function(attribute)))
1182
1649
                    # Copy annotations, if any
1183
1650
                    try:
1184
 
                        attr[attrname]._dbus_annotations = (
1185
 
                            dict(attribute._dbus_annotations))
 
1651
                        attr[attrname]._dbus_annotations = dict(
 
1652
                            attribute._dbus_annotations)
1186
1653
                    except AttributeError:
1187
1654
                        pass
1188
1655
                # Is this a D-Bus interface?
1191
1658
                    # object.  Decorate it to be a new D-Bus interface
1192
1659
                    # with the alternate D-Bus interface name.  Add it
1193
1660
                    # to the class.
1194
 
                    attr[attrname] = (dbus_interface_annotations
1195
 
                                      (alt_interface)
1196
 
                                      (types.FunctionType
1197
 
                                       (attribute.func_code,
1198
 
                                        attribute.func_globals,
1199
 
                                        attribute.func_name,
1200
 
                                        attribute.func_defaults,
1201
 
                                        attribute.func_closure)))
 
1661
                    attr[attrname] = (
 
1662
                        dbus_interface_annotations(alt_interface)
 
1663
                        (copy_function(attribute)))
1202
1664
            if deprecate:
1203
1665
                # Deprecate all alternate interfaces
1204
 
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1666
                iname="_AlternateDBusNames_interface_annotation{}"
1205
1667
                for interface_name in interface_names:
 
1668
                    
1206
1669
                    @dbus_interface_annotations(interface_name)
1207
1670
                    def func(self):
1208
1671
                        return { "org.freedesktop.DBus.Deprecated":
1209
 
                                     "true" }
 
1672
                                 "true" }
1210
1673
                    # Find an unused name
1211
1674
                    for aname in (iname.format(i)
1212
1675
                                  for i in itertools.count()):
1216
1679
            if interface_names:
1217
1680
                # Replace the class with a new subclass of it with
1218
1681
                # methods, signals, etc. as created above.
1219
 
                cls = type(b"{0}Alternate".format(cls.__name__),
1220
 
                           (cls,), attr)
 
1682
                if sys.version_info.major == 2:
 
1683
                    cls = type(b"{}Alternate".format(cls.__name__),
 
1684
                               (cls, ), attr)
 
1685
                else:
 
1686
                    cls = type("{}Alternate".format(cls.__name__),
 
1687
                               (cls, ), attr)
1221
1688
        return cls
 
1689
    
1222
1690
    return wrapper
1223
1691
 
1224
1692
 
1225
1693
@alternate_dbus_interfaces({"se.recompile.Mandos":
1226
 
                                "se.bsnet.fukt.Mandos"})
 
1694
                            "se.bsnet.fukt.Mandos"})
1227
1695
class ClientDBus(Client, DBusObjectWithProperties):
1228
1696
    """A Client class using D-Bus
1229
1697
    
1233
1701
    """
1234
1702
    
1235
1703
    runtime_expansions = (Client.runtime_expansions
1236
 
                          + ("dbus_object_path",))
 
1704
                          + ("dbus_object_path", ))
 
1705
    
 
1706
    _interface = "se.recompile.Mandos.Client"
1237
1707
    
1238
1708
    # dbus.service.Object doesn't use super(), so we can't either.
1239
1709
    
1242
1712
        Client.__init__(self, *args, **kwargs)
1243
1713
        # Only now, when this client is initialized, can it show up on
1244
1714
        # the D-Bus
1245
 
        client_object_name = unicode(self.name).translate(
 
1715
        client_object_name = str(self.name).translate(
1246
1716
            {ord("."): ord("_"),
1247
1717
             ord("-"): ord("_")})
1248
 
        self.dbus_object_path = (dbus.ObjectPath
1249
 
                                 ("/clients/" + client_object_name))
 
1718
        self.dbus_object_path = dbus.ObjectPath(
 
1719
            "/clients/" + client_object_name)
1250
1720
        DBusObjectWithProperties.__init__(self, self.bus,
1251
1721
                                          self.dbus_object_path)
1252
1722
    
1253
 
    def notifychangeproperty(transform_func,
1254
 
                             dbus_name, type_func=lambda x: x,
1255
 
                             variant_level=1):
 
1723
    def notifychangeproperty(transform_func, dbus_name,
 
1724
                             type_func=lambda x: x,
 
1725
                             variant_level=1,
 
1726
                             invalidate_only=False,
 
1727
                             _interface=_interface):
1256
1728
        """ Modify a variable so that it's a property which announces
1257
1729
        its changes to DBus.
1258
1730
        
1263
1735
                   to the D-Bus.  Default: no transform
1264
1736
        variant_level: D-Bus variant level.  Default: 1
1265
1737
        """
1266
 
        attrname = "_{0}".format(dbus_name)
 
1738
        attrname = "_{}".format(dbus_name)
 
1739
        
1267
1740
        def setter(self, value):
1268
1741
            if hasattr(self, "dbus_object_path"):
1269
1742
                if (not hasattr(self, attrname) or
1270
1743
                    type_func(getattr(self, attrname, None))
1271
1744
                    != type_func(value)):
1272
 
                    dbus_value = transform_func(type_func(value),
1273
 
                                                variant_level
1274
 
                                                =variant_level)
1275
 
                    self.PropertyChanged(dbus.String(dbus_name),
1276
 
                                         dbus_value)
 
1745
                    if invalidate_only:
 
1746
                        self.PropertiesChanged(
 
1747
                            _interface, dbus.Dictionary(),
 
1748
                            dbus.Array((dbus_name, )))
 
1749
                    else:
 
1750
                        dbus_value = transform_func(
 
1751
                            type_func(value),
 
1752
                            variant_level = variant_level)
 
1753
                        self.PropertyChanged(dbus.String(dbus_name),
 
1754
                                             dbus_value)
 
1755
                        self.PropertiesChanged(
 
1756
                            _interface,
 
1757
                            dbus.Dictionary({ dbus.String(dbus_name):
 
1758
                                              dbus_value }),
 
1759
                            dbus.Array())
1277
1760
            setattr(self, attrname, value)
1278
1761
        
1279
1762
        return property(lambda self: getattr(self, attrname), setter)
1285
1768
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1286
1769
    last_enabled = notifychangeproperty(datetime_to_dbus,
1287
1770
                                        "LastEnabled")
1288
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1289
 
                                   type_func = lambda checker:
1290
 
                                       checker is not None)
 
1771
    checker = notifychangeproperty(
 
1772
        dbus.Boolean, "CheckerRunning",
 
1773
        type_func = lambda checker: checker is not None)
1291
1774
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1292
1775
                                           "LastCheckedOK")
1293
1776
    last_checker_status = notifychangeproperty(dbus.Int16,
1296
1779
        datetime_to_dbus, "LastApprovalRequest")
1297
1780
    approved_by_default = notifychangeproperty(dbus.Boolean,
1298
1781
                                               "ApprovedByDefault")
1299
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1300
 
                                          "ApprovalDelay",
1301
 
                                          type_func =
1302
 
                                          timedelta_to_milliseconds)
 
1782
    approval_delay = notifychangeproperty(
 
1783
        dbus.UInt64, "ApprovalDelay",
 
1784
        type_func = lambda td: td.total_seconds() * 1000)
1303
1785
    approval_duration = notifychangeproperty(
1304
1786
        dbus.UInt64, "ApprovalDuration",
1305
 
        type_func = timedelta_to_milliseconds)
 
1787
        type_func = lambda td: td.total_seconds() * 1000)
1306
1788
    host = notifychangeproperty(dbus.String, "Host")
1307
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1308
 
                                   type_func =
1309
 
                                   timedelta_to_milliseconds)
 
1789
    timeout = notifychangeproperty(
 
1790
        dbus.UInt64, "Timeout",
 
1791
        type_func = lambda td: td.total_seconds() * 1000)
1310
1792
    extended_timeout = notifychangeproperty(
1311
1793
        dbus.UInt64, "ExtendedTimeout",
1312
 
        type_func = timedelta_to_milliseconds)
1313
 
    interval = notifychangeproperty(dbus.UInt64,
1314
 
                                    "Interval",
1315
 
                                    type_func =
1316
 
                                    timedelta_to_milliseconds)
 
1794
        type_func = lambda td: td.total_seconds() * 1000)
 
1795
    interval = notifychangeproperty(
 
1796
        dbus.UInt64, "Interval",
 
1797
        type_func = lambda td: td.total_seconds() * 1000)
1317
1798
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1799
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
 
1800
                                  invalidate_only=True)
1318
1801
    
1319
1802
    del notifychangeproperty
1320
1803
    
1327
1810
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1328
1811
        Client.__del__(self, *args, **kwargs)
1329
1812
    
1330
 
    def checker_callback(self, pid, condition, command,
1331
 
                         *args, **kwargs):
1332
 
        self.checker_callback_tag = None
1333
 
        self.checker = None
1334
 
        if os.WIFEXITED(condition):
1335
 
            exitstatus = os.WEXITSTATUS(condition)
 
1813
    def checker_callback(self, source, condition,
 
1814
                         connection, command, *args, **kwargs):
 
1815
        ret = Client.checker_callback(self, source, condition,
 
1816
                                      connection, command, *args,
 
1817
                                      **kwargs)
 
1818
        exitstatus = self.last_checker_status
 
1819
        if exitstatus >= 0:
1336
1820
            # Emit D-Bus signal
1337
1821
            self.CheckerCompleted(dbus.Int16(exitstatus),
1338
 
                                  dbus.Int64(condition),
 
1822
                                  # This is specific to GNU libC
 
1823
                                  dbus.Int64(exitstatus << 8),
1339
1824
                                  dbus.String(command))
1340
1825
        else:
1341
1826
            # Emit D-Bus signal
1342
1827
            self.CheckerCompleted(dbus.Int16(-1),
1343
 
                                  dbus.Int64(condition),
 
1828
                                  dbus.Int64(
 
1829
                                      # This is specific to GNU libC
 
1830
                                      (exitstatus << 8)
 
1831
                                      | self.last_checker_signal),
1344
1832
                                  dbus.String(command))
1345
 
        
1346
 
        return Client.checker_callback(self, pid, condition, command,
1347
 
                                       *args, **kwargs)
 
1833
        return ret
1348
1834
    
1349
1835
    def start_checker(self, *args, **kwargs):
1350
 
        old_checker = self.checker
1351
 
        if self.checker is not None:
1352
 
            old_checker_pid = self.checker.pid
1353
 
        else:
1354
 
            old_checker_pid = None
 
1836
        old_checker_pid = getattr(self.checker, "pid", None)
1355
1837
        r = Client.start_checker(self, *args, **kwargs)
1356
1838
        # Only if new checker process was started
1357
1839
        if (self.checker is not None
1366
1848
    
1367
1849
    def approve(self, value=True):
1368
1850
        self.approved = value
1369
 
        gobject.timeout_add(timedelta_to_milliseconds
1370
 
                            (self.approval_duration),
1371
 
                            self._reset_approved)
 
1851
        GLib.timeout_add(int(self.approval_duration.total_seconds()
 
1852
                             * 1000), self._reset_approved)
1372
1853
        self.send_changedstate()
1373
1854
    
1374
1855
    ## D-Bus methods, signals & properties
1375
 
    _interface = "se.recompile.Mandos.Client"
1376
1856
    
1377
1857
    ## Interfaces
1378
1858
    
1379
 
    @dbus_interface_annotations(_interface)
1380
 
    def _foo(self):
1381
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1382
 
                     "false"}
1383
 
    
1384
1859
    ## Signals
1385
1860
    
1386
1861
    # CheckerCompleted - signal
1396
1871
        pass
1397
1872
    
1398
1873
    # PropertyChanged - signal
 
1874
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1399
1875
    @dbus.service.signal(_interface, signature="sv")
1400
1876
    def PropertyChanged(self, property, value):
1401
1877
        "D-Bus signal"
1435
1911
        self.checked_ok()
1436
1912
    
1437
1913
    # Enable - method
 
1914
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1438
1915
    @dbus.service.method(_interface)
1439
1916
    def Enable(self):
1440
1917
        "D-Bus method"
1441
1918
        self.enable()
1442
1919
    
1443
1920
    # StartChecker - method
 
1921
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1444
1922
    @dbus.service.method(_interface)
1445
1923
    def StartChecker(self):
1446
1924
        "D-Bus method"
1447
1925
        self.start_checker()
1448
1926
    
1449
1927
    # Disable - method
 
1928
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1450
1929
    @dbus.service.method(_interface)
1451
1930
    def Disable(self):
1452
1931
        "D-Bus method"
1453
1932
        self.disable()
1454
1933
    
1455
1934
    # StopChecker - method
 
1935
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1456
1936
    @dbus.service.method(_interface)
1457
1937
    def StopChecker(self):
1458
1938
        self.stop_checker()
1465
1945
        return dbus.Boolean(bool(self.approvals_pending))
1466
1946
    
1467
1947
    # ApprovedByDefault - property
1468
 
    @dbus_service_property(_interface, signature="b",
 
1948
    @dbus_service_property(_interface,
 
1949
                           signature="b",
1469
1950
                           access="readwrite")
1470
1951
    def ApprovedByDefault_dbus_property(self, value=None):
1471
1952
        if value is None:       # get
1473
1954
        self.approved_by_default = bool(value)
1474
1955
    
1475
1956
    # ApprovalDelay - property
1476
 
    @dbus_service_property(_interface, signature="t",
 
1957
    @dbus_service_property(_interface,
 
1958
                           signature="t",
1477
1959
                           access="readwrite")
1478
1960
    def ApprovalDelay_dbus_property(self, value=None):
1479
1961
        if value is None:       # get
1480
 
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1962
            return dbus.UInt64(self.approval_delay.total_seconds()
 
1963
                               * 1000)
1481
1964
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1482
1965
    
1483
1966
    # ApprovalDuration - property
1484
 
    @dbus_service_property(_interface, signature="t",
 
1967
    @dbus_service_property(_interface,
 
1968
                           signature="t",
1485
1969
                           access="readwrite")
1486
1970
    def ApprovalDuration_dbus_property(self, value=None):
1487
1971
        if value is None:       # get
1488
 
            return dbus.UInt64(timedelta_to_milliseconds(
1489
 
                    self.approval_duration))
 
1972
            return dbus.UInt64(self.approval_duration.total_seconds()
 
1973
                               * 1000)
1490
1974
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1491
1975
    
1492
1976
    # Name - property
 
1977
    @dbus_annotations(
 
1978
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1493
1979
    @dbus_service_property(_interface, signature="s", access="read")
1494
1980
    def Name_dbus_property(self):
1495
1981
        return dbus.String(self.name)
1496
1982
    
1497
1983
    # Fingerprint - property
 
1984
    @dbus_annotations(
 
1985
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1498
1986
    @dbus_service_property(_interface, signature="s", access="read")
1499
1987
    def Fingerprint_dbus_property(self):
1500
1988
        return dbus.String(self.fingerprint)
1501
1989
    
1502
1990
    # Host - property
1503
 
    @dbus_service_property(_interface, signature="s",
 
1991
    @dbus_service_property(_interface,
 
1992
                           signature="s",
1504
1993
                           access="readwrite")
1505
1994
    def Host_dbus_property(self, value=None):
1506
1995
        if value is None:       # get
1507
1996
            return dbus.String(self.host)
1508
 
        self.host = unicode(value)
 
1997
        self.host = str(value)
1509
1998
    
1510
1999
    # Created - property
 
2000
    @dbus_annotations(
 
2001
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1511
2002
    @dbus_service_property(_interface, signature="s", access="read")
1512
2003
    def Created_dbus_property(self):
1513
2004
        return datetime_to_dbus(self.created)
1518
2009
        return datetime_to_dbus(self.last_enabled)
1519
2010
    
1520
2011
    # Enabled - property
1521
 
    @dbus_service_property(_interface, signature="b",
 
2012
    @dbus_service_property(_interface,
 
2013
                           signature="b",
1522
2014
                           access="readwrite")
1523
2015
    def Enabled_dbus_property(self, value=None):
1524
2016
        if value is None:       # get
1529
2021
            self.disable()
1530
2022
    
1531
2023
    # LastCheckedOK - property
1532
 
    @dbus_service_property(_interface, signature="s",
 
2024
    @dbus_service_property(_interface,
 
2025
                           signature="s",
1533
2026
                           access="readwrite")
1534
2027
    def LastCheckedOK_dbus_property(self, value=None):
1535
2028
        if value is not None:
1538
2031
        return datetime_to_dbus(self.last_checked_ok)
1539
2032
    
1540
2033
    # LastCheckerStatus - property
1541
 
    @dbus_service_property(_interface, signature="n",
1542
 
                           access="read")
 
2034
    @dbus_service_property(_interface, signature="n", access="read")
1543
2035
    def LastCheckerStatus_dbus_property(self):
1544
2036
        return dbus.Int16(self.last_checker_status)
1545
2037
    
1554
2046
        return datetime_to_dbus(self.last_approval_request)
1555
2047
    
1556
2048
    # Timeout - property
1557
 
    @dbus_service_property(_interface, signature="t",
 
2049
    @dbus_service_property(_interface,
 
2050
                           signature="t",
1558
2051
                           access="readwrite")
1559
2052
    def Timeout_dbus_property(self, value=None):
1560
2053
        if value is None:       # get
1561
 
            return dbus.UInt64(self.timeout_milliseconds())
 
2054
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
1562
2055
        old_timeout = self.timeout
1563
2056
        self.timeout = datetime.timedelta(0, 0, 0, value)
1564
2057
        # Reschedule disabling
1572
2065
                if (getattr(self, "disable_initiator_tag", None)
1573
2066
                    is None):
1574
2067
                    return
1575
 
                gobject.source_remove(self.disable_initiator_tag)
1576
 
                self.disable_initiator_tag = (
1577
 
                    gobject.timeout_add(
1578
 
                        timedelta_to_milliseconds(self.expires - now),
1579
 
                        self.disable))
 
2068
                GLib.source_remove(self.disable_initiator_tag)
 
2069
                self.disable_initiator_tag = GLib.timeout_add(
 
2070
                    int((self.expires - now).total_seconds() * 1000),
 
2071
                    self.disable)
1580
2072
    
1581
2073
    # ExtendedTimeout - property
1582
 
    @dbus_service_property(_interface, signature="t",
 
2074
    @dbus_service_property(_interface,
 
2075
                           signature="t",
1583
2076
                           access="readwrite")
1584
2077
    def ExtendedTimeout_dbus_property(self, value=None):
1585
2078
        if value is None:       # get
1586
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
2079
            return dbus.UInt64(self.extended_timeout.total_seconds()
 
2080
                               * 1000)
1587
2081
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1588
2082
    
1589
2083
    # Interval - property
1590
 
    @dbus_service_property(_interface, signature="t",
 
2084
    @dbus_service_property(_interface,
 
2085
                           signature="t",
1591
2086
                           access="readwrite")
1592
2087
    def Interval_dbus_property(self, value=None):
1593
2088
        if value is None:       # get
1594
 
            return dbus.UInt64(self.interval_milliseconds())
 
2089
            return dbus.UInt64(self.interval.total_seconds() * 1000)
1595
2090
        self.interval = datetime.timedelta(0, 0, 0, value)
1596
2091
        if getattr(self, "checker_initiator_tag", None) is None:
1597
2092
            return
1598
2093
        if self.enabled:
1599
2094
            # Reschedule checker run
1600
 
            gobject.source_remove(self.checker_initiator_tag)
1601
 
            self.checker_initiator_tag = (gobject.timeout_add
1602
 
                                          (value, self.start_checker))
1603
 
            self.start_checker()    # Start one now, too
 
2095
            GLib.source_remove(self.checker_initiator_tag)
 
2096
            self.checker_initiator_tag = GLib.timeout_add(
 
2097
                value, self.start_checker)
 
2098
            self.start_checker() # Start one now, too
1604
2099
    
1605
2100
    # Checker - property
1606
 
    @dbus_service_property(_interface, signature="s",
 
2101
    @dbus_service_property(_interface,
 
2102
                           signature="s",
1607
2103
                           access="readwrite")
1608
2104
    def Checker_dbus_property(self, value=None):
1609
2105
        if value is None:       # get
1610
2106
            return dbus.String(self.checker_command)
1611
 
        self.checker_command = unicode(value)
 
2107
        self.checker_command = str(value)
1612
2108
    
1613
2109
    # CheckerRunning - property
1614
 
    @dbus_service_property(_interface, signature="b",
 
2110
    @dbus_service_property(_interface,
 
2111
                           signature="b",
1615
2112
                           access="readwrite")
1616
2113
    def CheckerRunning_dbus_property(self, value=None):
1617
2114
        if value is None:       # get
1622
2119
            self.stop_checker()
1623
2120
    
1624
2121
    # ObjectPath - property
 
2122
    @dbus_annotations(
 
2123
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
 
2124
         "org.freedesktop.DBus.Deprecated": "true"})
1625
2125
    @dbus_service_property(_interface, signature="o", access="read")
1626
2126
    def ObjectPath_dbus_property(self):
1627
2127
        return self.dbus_object_path # is already a dbus.ObjectPath
1628
2128
    
1629
2129
    # Secret = property
1630
 
    @dbus_service_property(_interface, signature="ay",
1631
 
                           access="write", byte_arrays=True)
 
2130
    @dbus_annotations(
 
2131
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
 
2132
         "invalidates"})
 
2133
    @dbus_service_property(_interface,
 
2134
                           signature="ay",
 
2135
                           access="write",
 
2136
                           byte_arrays=True)
1632
2137
    def Secret_dbus_property(self, value):
1633
 
        self.secret = str(value)
 
2138
        self.secret = bytes(value)
1634
2139
    
1635
2140
    del _interface
1636
2141
 
1640
2145
        self._pipe = child_pipe
1641
2146
        self._pipe.send(('init', fpr, address))
1642
2147
        if not self._pipe.recv():
1643
 
            raise KeyError()
 
2148
            raise KeyError(fpr)
1644
2149
    
1645
2150
    def __getattribute__(self, name):
1646
2151
        if name == '_pipe':
1650
2155
        if data[0] == 'data':
1651
2156
            return data[1]
1652
2157
        if data[0] == 'function':
 
2158
            
1653
2159
            def func(*args, **kwargs):
1654
2160
                self._pipe.send(('funcall', name, args, kwargs))
1655
2161
                return self._pipe.recv()[1]
 
2162
            
1656
2163
            return func
1657
2164
    
1658
2165
    def __setattr__(self, name, value):
1670
2177
    def handle(self):
1671
2178
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1672
2179
            logger.info("TCP connection from: %s",
1673
 
                        unicode(self.client_address))
 
2180
                        str(self.client_address))
1674
2181
            logger.debug("Pipe FD: %d",
1675
2182
                         self.server.child_pipe.fileno())
1676
2183
            
1677
 
            session = (gnutls.connection
1678
 
                       .ClientSession(self.request,
1679
 
                                      gnutls.connection
1680
 
                                      .X509Credentials()))
1681
 
            
1682
 
            # Note: gnutls.connection.X509Credentials is really a
1683
 
            # generic GnuTLS certificate credentials object so long as
1684
 
            # no X.509 keys are added to it.  Therefore, we can use it
1685
 
            # here despite using OpenPGP certificates.
 
2184
            session = gnutls.ClientSession(self.request)
1686
2185
            
1687
2186
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1688
2187
            #                      "+AES-256-CBC", "+SHA1",
1692
2191
            priority = self.server.gnutls_priority
1693
2192
            if priority is None:
1694
2193
                priority = "NORMAL"
1695
 
            (gnutls.library.functions
1696
 
             .gnutls_priority_set_direct(session._c_object,
1697
 
                                         priority, None))
 
2194
            gnutls.priority_set_direct(session._c_object,
 
2195
                                       priority.encode("utf-8"),
 
2196
                                       None)
1698
2197
            
1699
2198
            # Start communication using the Mandos protocol
1700
2199
            # Get protocol number
1702
2201
            logger.debug("Protocol version: %r", line)
1703
2202
            try:
1704
2203
                if int(line.strip().split()[0]) > 1:
1705
 
                    raise RuntimeError
 
2204
                    raise RuntimeError(line)
1706
2205
            except (ValueError, IndexError, RuntimeError) as error:
1707
2206
                logger.error("Unknown protocol version: %s", error)
1708
2207
                return
1710
2209
            # Start GnuTLS connection
1711
2210
            try:
1712
2211
                session.handshake()
1713
 
            except gnutls.errors.GNUTLSError as error:
 
2212
            except gnutls.Error as error:
1714
2213
                logger.warning("Handshake failed: %s", error)
1715
2214
                # Do not run session.bye() here: the session is not
1716
2215
                # established.  Just abandon the request.
1720
2219
            approval_required = False
1721
2220
            try:
1722
2221
                try:
1723
 
                    fpr = self.fingerprint(self.peer_certificate
1724
 
                                           (session))
1725
 
                except (TypeError,
1726
 
                        gnutls.errors.GNUTLSError) as error:
 
2222
                    fpr = self.fingerprint(
 
2223
                        self.peer_certificate(session))
 
2224
                except (TypeError, gnutls.Error) as error:
1727
2225
                    logger.warning("Bad certificate: %s", error)
1728
2226
                    return
1729
2227
                logger.debug("Fingerprint: %s", fpr)
1742
2240
                while True:
1743
2241
                    if not client.enabled:
1744
2242
                        logger.info("Client %s is disabled",
1745
 
                                       client.name)
 
2243
                                    client.name)
1746
2244
                        if self.server.use_dbus:
1747
2245
                            # Emit D-Bus signal
1748
2246
                            client.Rejected("Disabled")
1757
2255
                        if self.server.use_dbus:
1758
2256
                            # Emit D-Bus signal
1759
2257
                            client.NeedApproval(
1760
 
                                client.approval_delay_milliseconds(),
1761
 
                                client.approved_by_default)
 
2258
                                client.approval_delay.total_seconds()
 
2259
                                * 1000, client.approved_by_default)
1762
2260
                    else:
1763
2261
                        logger.warning("Client %s was not approved",
1764
2262
                                       client.name)
1770
2268
                    #wait until timeout or approved
1771
2269
                    time = datetime.datetime.now()
1772
2270
                    client.changedstate.acquire()
1773
 
                    client.changedstate.wait(
1774
 
                        float(timedelta_to_milliseconds(delay)
1775
 
                              / 1000))
 
2271
                    client.changedstate.wait(delay.total_seconds())
1776
2272
                    client.changedstate.release()
1777
2273
                    time2 = datetime.datetime.now()
1778
2274
                    if (time2 - time) >= delay:
1789
2285
                    else:
1790
2286
                        delay -= time2 - time
1791
2287
                
1792
 
                sent_size = 0
1793
 
                while sent_size < len(client.secret):
1794
 
                    try:
1795
 
                        sent = session.send(client.secret[sent_size:])
1796
 
                    except gnutls.errors.GNUTLSError as error:
1797
 
                        logger.warning("gnutls send failed",
1798
 
                                       exc_info=error)
1799
 
                        return
1800
 
                    logger.debug("Sent: %d, remaining: %d",
1801
 
                                 sent, len(client.secret)
1802
 
                                 - (sent_size + sent))
1803
 
                    sent_size += sent
 
2288
                try:
 
2289
                    session.send(client.secret)
 
2290
                except gnutls.Error as error:
 
2291
                    logger.warning("gnutls send failed",
 
2292
                                   exc_info = error)
 
2293
                    return
1804
2294
                
1805
2295
                logger.info("Sending secret to %s", client.name)
1806
2296
                # bump the timeout using extended_timeout
1814
2304
                    client.approvals_pending -= 1
1815
2305
                try:
1816
2306
                    session.bye()
1817
 
                except gnutls.errors.GNUTLSError as error:
 
2307
                except gnutls.Error as error:
1818
2308
                    logger.warning("GnuTLS bye failed",
1819
2309
                                   exc_info=error)
1820
2310
    
1822
2312
    def peer_certificate(session):
1823
2313
        "Return the peer's OpenPGP certificate as a bytestring"
1824
2314
        # If not an OpenPGP certificate...
1825
 
        if (gnutls.library.functions
1826
 
            .gnutls_certificate_type_get(session._c_object)
1827
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1828
 
            # ...do the normal thing
1829
 
            return session.peer_certificate
 
2315
        if (gnutls.certificate_type_get(session._c_object)
 
2316
            != gnutls.CRT_OPENPGP):
 
2317
            # ...return invalid data
 
2318
            return b""
1830
2319
        list_size = ctypes.c_uint(1)
1831
 
        cert_list = (gnutls.library.functions
1832
 
                     .gnutls_certificate_get_peers
 
2320
        cert_list = (gnutls.certificate_get_peers
1833
2321
                     (session._c_object, ctypes.byref(list_size)))
1834
2322
        if not bool(cert_list) and list_size.value != 0:
1835
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1836
 
                                            " certificate")
 
2323
            raise gnutls.Error("error getting peer certificate")
1837
2324
        if list_size.value == 0:
1838
2325
            return None
1839
2326
        cert = cert_list[0]
1843
2330
    def fingerprint(openpgp):
1844
2331
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1845
2332
        # New GnuTLS "datum" with the OpenPGP public key
1846
 
        datum = (gnutls.library.types
1847
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1848
 
                                             ctypes.POINTER
1849
 
                                             (ctypes.c_ubyte)),
1850
 
                                 ctypes.c_uint(len(openpgp))))
 
2333
        datum = gnutls.datum_t(
 
2334
            ctypes.cast(ctypes.c_char_p(openpgp),
 
2335
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2336
            ctypes.c_uint(len(openpgp)))
1851
2337
        # New empty GnuTLS certificate
1852
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1853
 
        (gnutls.library.functions
1854
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
2338
        crt = gnutls.openpgp_crt_t()
 
2339
        gnutls.openpgp_crt_init(ctypes.byref(crt))
1855
2340
        # Import the OpenPGP public key into the certificate
1856
 
        (gnutls.library.functions
1857
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1858
 
                                    gnutls.library.constants
1859
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
2341
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
 
2342
                                  gnutls.OPENPGP_FMT_RAW)
1860
2343
        # Verify the self signature in the key
1861
2344
        crtverify = ctypes.c_uint()
1862
 
        (gnutls.library.functions
1863
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1864
 
                                         ctypes.byref(crtverify)))
 
2345
        gnutls.openpgp_crt_verify_self(crt, 0,
 
2346
                                       ctypes.byref(crtverify))
1865
2347
        if crtverify.value != 0:
1866
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1867
 
            raise (gnutls.errors.CertificateSecurityError
1868
 
                   ("Verify failed"))
 
2348
            gnutls.openpgp_crt_deinit(crt)
 
2349
            raise gnutls.CertificateSecurityError("Verify failed")
1869
2350
        # New buffer for the fingerprint
1870
2351
        buf = ctypes.create_string_buffer(20)
1871
2352
        buf_len = ctypes.c_size_t()
1872
2353
        # Get the fingerprint from the certificate into the buffer
1873
 
        (gnutls.library.functions
1874
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1875
 
                                             ctypes.byref(buf_len)))
 
2354
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
2355
                                           ctypes.byref(buf_len))
1876
2356
        # Deinit the certificate
1877
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
2357
        gnutls.openpgp_crt_deinit(crt)
1878
2358
        # Convert the buffer to a Python bytestring
1879
2359
        fpr = ctypes.string_at(buf, buf_len.value)
1880
2360
        # Convert the bytestring to hexadecimal notation
1884
2364
 
1885
2365
class MultiprocessingMixIn(object):
1886
2366
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
2367
    
1887
2368
    def sub_process_main(self, request, address):
1888
2369
        try:
1889
2370
            self.finish_request(request, address)
1901
2382
 
1902
2383
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1903
2384
    """ adds a pipe to the MixIn """
 
2385
    
1904
2386
    def process_request(self, request, client_address):
1905
2387
        """Overrides and wraps the original process_request().
1906
2388
        
1915
2397
    
1916
2398
    def add_pipe(self, parent_pipe, proc):
1917
2399
        """Dummy function; override as necessary"""
1918
 
        raise NotImplementedError
 
2400
        raise NotImplementedError()
1919
2401
 
1920
2402
 
1921
2403
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1927
2409
        interface:      None or a network interface name (string)
1928
2410
        use_ipv6:       Boolean; to use IPv6 or not
1929
2411
    """
 
2412
    
1930
2413
    def __init__(self, server_address, RequestHandlerClass,
1931
 
                 interface=None, use_ipv6=True, socketfd=None):
 
2414
                 interface=None,
 
2415
                 use_ipv6=True,
 
2416
                 socketfd=None):
1932
2417
        """If socketfd is set, use that file descriptor instead of
1933
2418
        creating a new one with socket.socket().
1934
2419
        """
1970
2455
        bind to an address or port if they were not specified."""
1971
2456
        if self.interface is not None:
1972
2457
            if SO_BINDTODEVICE is None:
1973
 
                logger.error("SO_BINDTODEVICE does not exist;"
1974
 
                             " cannot bind to interface %s",
1975
 
                             self.interface)
1976
 
            else:
1977
 
                try:
1978
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1979
 
                                           SO_BINDTODEVICE,
1980
 
                                           str(self.interface + '\0'))
1981
 
                except socket.error as error:
1982
 
                    if error.errno == errno.EPERM:
1983
 
                        logger.error("No permission to bind to"
1984
 
                                     " interface %s", self.interface)
1985
 
                    elif error.errno == errno.ENOPROTOOPT:
1986
 
                        logger.error("SO_BINDTODEVICE not available;"
1987
 
                                     " cannot bind to interface %s",
1988
 
                                     self.interface)
1989
 
                    elif error.errno == errno.ENODEV:
1990
 
                        logger.error("Interface %s does not exist,"
1991
 
                                     " cannot bind", self.interface)
1992
 
                    else:
1993
 
                        raise
 
2458
                # Fall back to a hard-coded value which seems to be
 
2459
                # common enough.
 
2460
                logger.warning("SO_BINDTODEVICE not found, trying 25")
 
2461
                SO_BINDTODEVICE = 25
 
2462
            try:
 
2463
                self.socket.setsockopt(
 
2464
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
 
2465
                    (self.interface + "\0").encode("utf-8"))
 
2466
            except socket.error as error:
 
2467
                if error.errno == errno.EPERM:
 
2468
                    logger.error("No permission to bind to"
 
2469
                                 " interface %s", self.interface)
 
2470
                elif error.errno == errno.ENOPROTOOPT:
 
2471
                    logger.error("SO_BINDTODEVICE not available;"
 
2472
                                 " cannot bind to interface %s",
 
2473
                                 self.interface)
 
2474
                elif error.errno == errno.ENODEV:
 
2475
                    logger.error("Interface %s does not exist,"
 
2476
                                 " cannot bind", self.interface)
 
2477
                else:
 
2478
                    raise
1994
2479
        # Only bind(2) the socket if we really need to.
1995
2480
        if self.server_address[0] or self.server_address[1]:
1996
2481
            if not self.server_address[0]:
2001
2486
                self.server_address = (any_address,
2002
2487
                                       self.server_address[1])
2003
2488
            elif not self.server_address[1]:
2004
 
                self.server_address = (self.server_address[0],
2005
 
                                       0)
 
2489
                self.server_address = (self.server_address[0], 0)
2006
2490
#                 if self.interface:
2007
2491
#                     self.server_address = (self.server_address[0],
2008
2492
#                                            0, # port
2020
2504
        gnutls_priority GnuTLS priority string
2021
2505
        use_dbus:       Boolean; to emit D-Bus signals or not
2022
2506
    
2023
 
    Assumes a gobject.MainLoop event loop.
 
2507
    Assumes a GLib.MainLoop event loop.
2024
2508
    """
 
2509
    
2025
2510
    def __init__(self, server_address, RequestHandlerClass,
2026
 
                 interface=None, use_ipv6=True, clients=None,
2027
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
2511
                 interface=None,
 
2512
                 use_ipv6=True,
 
2513
                 clients=None,
 
2514
                 gnutls_priority=None,
 
2515
                 use_dbus=True,
 
2516
                 socketfd=None):
2028
2517
        self.enabled = False
2029
2518
        self.clients = clients
2030
2519
        if self.clients is None:
2036
2525
                                interface = interface,
2037
2526
                                use_ipv6 = use_ipv6,
2038
2527
                                socketfd = socketfd)
 
2528
    
2039
2529
    def server_activate(self):
2040
2530
        if self.enabled:
2041
2531
            return socketserver.TCPServer.server_activate(self)
2045
2535
    
2046
2536
    def add_pipe(self, parent_pipe, proc):
2047
2537
        # Call "handle_ipc" for both data and EOF events
2048
 
        gobject.io_add_watch(parent_pipe.fileno(),
2049
 
                             gobject.IO_IN | gobject.IO_HUP,
2050
 
                             functools.partial(self.handle_ipc,
2051
 
                                               parent_pipe =
2052
 
                                               parent_pipe,
2053
 
                                               proc = proc))
 
2538
        GLib.io_add_watch(
 
2539
            parent_pipe.fileno(),
 
2540
            GLib.IO_IN | GLib.IO_HUP,
 
2541
            functools.partial(self.handle_ipc,
 
2542
                              parent_pipe = parent_pipe,
 
2543
                              proc = proc))
2054
2544
    
2055
 
    def handle_ipc(self, source, condition, parent_pipe=None,
2056
 
                   proc = None, client_object=None):
 
2545
    def handle_ipc(self, source, condition,
 
2546
                   parent_pipe=None,
 
2547
                   proc = None,
 
2548
                   client_object=None):
2057
2549
        # error, or the other end of multiprocessing.Pipe has closed
2058
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2550
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
2059
2551
            # Wait for other process to exit
2060
2552
            proc.join()
2061
2553
            return False
2068
2560
            fpr = request[1]
2069
2561
            address = request[2]
2070
2562
            
2071
 
            for c in self.clients.itervalues():
 
2563
            for c in self.clients.values():
2072
2564
                if c.fingerprint == fpr:
2073
2565
                    client = c
2074
2566
                    break
2082
2574
                parent_pipe.send(False)
2083
2575
                return False
2084
2576
            
2085
 
            gobject.io_add_watch(parent_pipe.fileno(),
2086
 
                                 gobject.IO_IN | gobject.IO_HUP,
2087
 
                                 functools.partial(self.handle_ipc,
2088
 
                                                   parent_pipe =
2089
 
                                                   parent_pipe,
2090
 
                                                   proc = proc,
2091
 
                                                   client_object =
2092
 
                                                   client))
 
2577
            GLib.io_add_watch(
 
2578
                parent_pipe.fileno(),
 
2579
                GLib.IO_IN | GLib.IO_HUP,
 
2580
                functools.partial(self.handle_ipc,
 
2581
                                  parent_pipe = parent_pipe,
 
2582
                                  proc = proc,
 
2583
                                  client_object = client))
2093
2584
            parent_pipe.send(True)
2094
2585
            # remove the old hook in favor of the new above hook on
2095
2586
            # same fileno
2101
2592
            
2102
2593
            parent_pipe.send(('data', getattr(client_object,
2103
2594
                                              funcname)(*args,
2104
 
                                                         **kwargs)))
 
2595
                                                        **kwargs)))
2105
2596
        
2106
2597
        if command == 'getattr':
2107
2598
            attrname = request[1]
2108
 
            if callable(client_object.__getattribute__(attrname)):
2109
 
                parent_pipe.send(('function',))
 
2599
            if isinstance(client_object.__getattribute__(attrname),
 
2600
                          collections.Callable):
 
2601
                parent_pipe.send(('function', ))
2110
2602
            else:
2111
 
                parent_pipe.send(('data', client_object
2112
 
                                  .__getattribute__(attrname)))
 
2603
                parent_pipe.send((
 
2604
                    'data', client_object.__getattribute__(attrname)))
2113
2605
        
2114
2606
        if command == 'setattr':
2115
2607
            attrname = request[1]
2146
2638
    # avoid excessive use of external libraries.
2147
2639
    
2148
2640
    # New type for defining tokens, syntax, and semantics all-in-one
2149
 
    Token = collections.namedtuple("Token",
2150
 
                                   ("regexp", # To match token; if
2151
 
                                              # "value" is not None,
2152
 
                                              # must have a "group"
2153
 
                                              # containing digits
2154
 
                                    "value",  # datetime.timedelta or
2155
 
                                              # None
2156
 
                                    "followers")) # Tokens valid after
2157
 
                                                  # this token
 
2641
    Token = collections.namedtuple("Token", (
 
2642
        "regexp",  # To match token; if "value" is not None, must have
 
2643
                   # a "group" containing digits
 
2644
        "value",   # datetime.timedelta or None
 
2645
        "followers"))           # Tokens valid after this token
2158
2646
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2159
2647
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2160
2648
    token_end = Token(re.compile(r"$"), None, frozenset())
2161
2649
    token_second = Token(re.compile(r"(\d+)S"),
2162
2650
                         datetime.timedelta(seconds=1),
2163
 
                         frozenset((token_end,)))
 
2651
                         frozenset((token_end, )))
2164
2652
    token_minute = Token(re.compile(r"(\d+)M"),
2165
2653
                         datetime.timedelta(minutes=1),
2166
2654
                         frozenset((token_second, token_end)))
2182
2670
                       frozenset((token_month, token_end)))
2183
2671
    token_week = Token(re.compile(r"(\d+)W"),
2184
2672
                       datetime.timedelta(weeks=1),
2185
 
                       frozenset((token_end,)))
 
2673
                       frozenset((token_end, )))
2186
2674
    token_duration = Token(re.compile(r"P"), None,
2187
2675
                           frozenset((token_year, token_month,
2188
2676
                                      token_day, token_time,
2189
 
                                      token_week))),
 
2677
                                      token_week)))
2190
2678
    # Define starting values
2191
2679
    value = datetime.timedelta() # Value so far
2192
2680
    found_token = None
2193
 
    followers = frozenset(token_duration,) # Following valid tokens
 
2681
    followers = frozenset((token_duration, )) # Following valid tokens
2194
2682
    s = duration                # String left to parse
2195
2683
    # Loop until end token is found
2196
2684
    while found_token is not token_end:
2213
2701
                break
2214
2702
        else:
2215
2703
            # No currently valid tokens were found
2216
 
            raise ValueError("Invalid RFC 3339 duration")
 
2704
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
2705
                             .format(duration))
2217
2706
    # End token found
2218
2707
    return value
2219
2708
 
2243
2732
    timevalue = datetime.timedelta(0)
2244
2733
    for s in interval.split():
2245
2734
        try:
2246
 
            suffix = unicode(s[-1])
 
2735
            suffix = s[-1]
2247
2736
            value = int(s[:-1])
2248
2737
            if suffix == "d":
2249
2738
                delta = datetime.timedelta(value)
2256
2745
            elif suffix == "w":
2257
2746
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2258
2747
            else:
2259
 
                raise ValueError("Unknown suffix {0!r}"
2260
 
                                 .format(suffix))
2261
 
        except (ValueError, IndexError) as e:
 
2748
                raise ValueError("Unknown suffix {!r}".format(suffix))
 
2749
        except IndexError as e:
2262
2750
            raise ValueError(*(e.args))
2263
2751
        timevalue += delta
2264
2752
    return timevalue
2280
2768
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2281
2769
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2282
2770
            raise OSError(errno.ENODEV,
2283
 
                          "{0} not a character device"
 
2771
                          "{} not a character device"
2284
2772
                          .format(os.devnull))
2285
2773
        os.dup2(null, sys.stdin.fileno())
2286
2774
        os.dup2(null, sys.stdout.fileno())
2296
2784
    
2297
2785
    parser = argparse.ArgumentParser()
2298
2786
    parser.add_argument("-v", "--version", action="version",
2299
 
                        version = "%(prog)s {0}".format(version),
 
2787
                        version = "%(prog)s {}".format(version),
2300
2788
                        help="show version number and exit")
2301
2789
    parser.add_argument("-i", "--interface", metavar="IF",
2302
2790
                        help="Bind to interface IF")
2335
2823
                        help="Directory to save/restore state in")
2336
2824
    parser.add_argument("--foreground", action="store_true",
2337
2825
                        help="Run in foreground", default=None)
 
2826
    parser.add_argument("--no-zeroconf", action="store_false",
 
2827
                        dest="zeroconf", help="Do not use Zeroconf",
 
2828
                        default=None)
2338
2829
    
2339
2830
    options = parser.parse_args()
2340
2831
    
2341
2832
    if options.check:
2342
2833
        import doctest
2343
 
        doctest.testmod()
2344
 
        sys.exit()
 
2834
        fail_count, test_count = doctest.testmod()
 
2835
        sys.exit(os.EX_OK if fail_count == 0 else 1)
2345
2836
    
2346
2837
    # Default values for config file for server-global settings
2347
2838
    server_defaults = { "interface": "",
2349
2840
                        "port": "",
2350
2841
                        "debug": "False",
2351
2842
                        "priority":
2352
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2843
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
 
2844
                        ":+SIGN-DSA-SHA256",
2353
2845
                        "servicename": "Mandos",
2354
2846
                        "use_dbus": "True",
2355
2847
                        "use_ipv6": "True",
2358
2850
                        "socket": "",
2359
2851
                        "statedir": "/var/lib/mandos",
2360
2852
                        "foreground": "False",
2361
 
                        }
 
2853
                        "zeroconf": "True",
 
2854
                    }
2362
2855
    
2363
2856
    # Parse config file for server-global settings
2364
2857
    server_config = configparser.SafeConfigParser(server_defaults)
2365
2858
    del server_defaults
2366
 
    server_config.read(os.path.join(options.configdir,
2367
 
                                    "mandos.conf"))
 
2859
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
2368
2860
    # Convert the SafeConfigParser object to a dict
2369
2861
    server_settings = server_config.defaults()
2370
2862
    # Use the appropriate methods on the non-string config options
2388
2880
    # Override the settings from the config file with command line
2389
2881
    # options, if set.
2390
2882
    for option in ("interface", "address", "port", "debug",
2391
 
                   "priority", "servicename", "configdir",
2392
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2393
 
                   "statedir", "socket", "foreground"):
 
2883
                   "priority", "servicename", "configdir", "use_dbus",
 
2884
                   "use_ipv6", "debuglevel", "restore", "statedir",
 
2885
                   "socket", "foreground", "zeroconf"):
2394
2886
        value = getattr(options, option)
2395
2887
        if value is not None:
2396
2888
            server_settings[option] = value
2397
2889
    del options
2398
2890
    # Force all strings to be unicode
2399
2891
    for option in server_settings.keys():
2400
 
        if type(server_settings[option]) is str:
2401
 
            server_settings[option] = unicode(server_settings[option])
 
2892
        if isinstance(server_settings[option], bytes):
 
2893
            server_settings[option] = (server_settings[option]
 
2894
                                       .decode("utf-8"))
2402
2895
    # Force all boolean options to be boolean
2403
2896
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2404
 
                   "foreground"):
 
2897
                   "foreground", "zeroconf"):
2405
2898
        server_settings[option] = bool(server_settings[option])
2406
2899
    # Debug implies foreground
2407
2900
    if server_settings["debug"]:
2410
2903
    
2411
2904
    ##################################################################
2412
2905
    
 
2906
    if (not server_settings["zeroconf"]
 
2907
        and not (server_settings["port"]
 
2908
                 or server_settings["socket"] != "")):
 
2909
        parser.error("Needs port or socket to work without Zeroconf")
 
2910
    
2413
2911
    # For convenience
2414
2912
    debug = server_settings["debug"]
2415
2913
    debuglevel = server_settings["debuglevel"]
2418
2916
    stored_state_path = os.path.join(server_settings["statedir"],
2419
2917
                                     stored_state_file)
2420
2918
    foreground = server_settings["foreground"]
 
2919
    zeroconf = server_settings["zeroconf"]
2421
2920
    
2422
2921
    if debug:
2423
2922
        initlogger(debug, logging.DEBUG)
2429
2928
            initlogger(debug, level)
2430
2929
    
2431
2930
    if server_settings["servicename"] != "Mandos":
2432
 
        syslogger.setFormatter(logging.Formatter
2433
 
                               ('Mandos ({0}) [%(process)d]:'
2434
 
                                ' %(levelname)s: %(message)s'
2435
 
                                .format(server_settings
2436
 
                                        ["servicename"])))
 
2931
        syslogger.setFormatter(
 
2932
            logging.Formatter('Mandos ({}) [%(process)d]:'
 
2933
                              ' %(levelname)s: %(message)s'.format(
 
2934
                                  server_settings["servicename"])))
2437
2935
    
2438
2936
    # Parse config file with clients
2439
2937
    client_config = configparser.SafeConfigParser(Client
2444
2942
    global mandos_dbus_service
2445
2943
    mandos_dbus_service = None
2446
2944
    
2447
 
    tcp_server = MandosServer((server_settings["address"],
2448
 
                               server_settings["port"]),
2449
 
                              ClientHandler,
2450
 
                              interface=(server_settings["interface"]
2451
 
                                         or None),
2452
 
                              use_ipv6=use_ipv6,
2453
 
                              gnutls_priority=
2454
 
                              server_settings["priority"],
2455
 
                              use_dbus=use_dbus,
2456
 
                              socketfd=(server_settings["socket"]
2457
 
                                        or None))
 
2945
    socketfd = None
 
2946
    if server_settings["socket"] != "":
 
2947
        socketfd = server_settings["socket"]
 
2948
    tcp_server = MandosServer(
 
2949
        (server_settings["address"], server_settings["port"]),
 
2950
        ClientHandler,
 
2951
        interface=(server_settings["interface"] or None),
 
2952
        use_ipv6=use_ipv6,
 
2953
        gnutls_priority=server_settings["priority"],
 
2954
        use_dbus=use_dbus,
 
2955
        socketfd=socketfd)
2458
2956
    if not foreground:
2459
2957
        pidfilename = "/run/mandos.pid"
 
2958
        if not os.path.isdir("/run/."):
 
2959
            pidfilename = "/var/run/mandos.pid"
2460
2960
        pidfile = None
2461
2961
        try:
2462
 
            pidfile = open(pidfilename, "w")
 
2962
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2463
2963
        except IOError as e:
2464
2964
            logger.error("Could not open file %r", pidfilename,
2465
2965
                         exc_info=e)
2466
2966
    
2467
 
    for name in ("_mandos", "mandos", "nobody"):
 
2967
    for name, group in (("_mandos", "_mandos"),
 
2968
                        ("mandos", "mandos"),
 
2969
                        ("nobody", "nogroup")):
2468
2970
        try:
2469
2971
            uid = pwd.getpwnam(name).pw_uid
2470
 
            gid = pwd.getpwnam(name).pw_gid
 
2972
            gid = pwd.getpwnam(group).pw_gid
2471
2973
            break
2472
2974
        except KeyError:
2473
2975
            continue
2477
2979
    try:
2478
2980
        os.setgid(gid)
2479
2981
        os.setuid(uid)
 
2982
        if debug:
 
2983
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
 
2984
                                                             gid))
2480
2985
    except OSError as error:
 
2986
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
 
2987
                       .format(uid, gid, os.strerror(error.errno)))
2481
2988
        if error.errno != errno.EPERM:
2482
 
            raise error
 
2989
            raise
2483
2990
    
2484
2991
    if debug:
2485
2992
        # Enable all possible GnuTLS debugging
2486
2993
        
2487
2994
        # "Use a log level over 10 to enable all debugging options."
2488
2995
        # - GnuTLS manual
2489
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
2996
        gnutls.global_set_log_level(11)
2490
2997
        
2491
 
        @gnutls.library.types.gnutls_log_func
 
2998
        @gnutls.log_func
2492
2999
        def debug_gnutls(level, string):
2493
3000
            logger.debug("GnuTLS: %s", string[:-1])
2494
3001
        
2495
 
        (gnutls.library.functions
2496
 
         .gnutls_global_set_log_function(debug_gnutls))
 
3002
        gnutls.global_set_log_function(debug_gnutls)
2497
3003
        
2498
3004
        # Redirect stdin so all checkers get /dev/null
2499
3005
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2506
3012
        # Close all input and output, do double fork, etc.
2507
3013
        daemon()
2508
3014
    
2509
 
    # multiprocessing will use threads, so before we use gobject we
2510
 
    # need to inform gobject that threads will be used.
2511
 
    gobject.threads_init()
 
3015
    # multiprocessing will use threads, so before we use GLib we need
 
3016
    # to inform GLib that threads will be used.
 
3017
    GLib.threads_init()
2512
3018
    
2513
3019
    global main_loop
2514
3020
    # From the Avahi example code
2515
3021
    DBusGMainLoop(set_as_default=True)
2516
 
    main_loop = gobject.MainLoop()
 
3022
    main_loop = GLib.MainLoop()
2517
3023
    bus = dbus.SystemBus()
2518
3024
    # End of Avahi example code
2519
3025
    if use_dbus:
2520
3026
        try:
2521
3027
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2522
 
                                            bus, do_not_queue=True)
2523
 
            old_bus_name = (dbus.service.BusName
2524
 
                            ("se.bsnet.fukt.Mandos", bus,
2525
 
                             do_not_queue=True))
2526
 
        except dbus.exceptions.NameExistsException as e:
 
3028
                                            bus,
 
3029
                                            do_not_queue=True)
 
3030
            old_bus_name = dbus.service.BusName(
 
3031
                "se.bsnet.fukt.Mandos", bus,
 
3032
                do_not_queue=True)
 
3033
        except dbus.exceptions.DBusException as e:
2527
3034
            logger.error("Disabling D-Bus:", exc_info=e)
2528
3035
            use_dbus = False
2529
3036
            server_settings["use_dbus"] = False
2530
3037
            tcp_server.use_dbus = False
2531
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2532
 
    service = AvahiServiceToSyslog(name =
2533
 
                                   server_settings["servicename"],
2534
 
                                   servicetype = "_mandos._tcp",
2535
 
                                   protocol = protocol, bus = bus)
2536
 
    if server_settings["interface"]:
2537
 
        service.interface = (if_nametoindex
2538
 
                             (str(server_settings["interface"])))
 
3038
    if zeroconf:
 
3039
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
3040
        service = AvahiServiceToSyslog(
 
3041
            name = server_settings["servicename"],
 
3042
            servicetype = "_mandos._tcp",
 
3043
            protocol = protocol,
 
3044
            bus = bus)
 
3045
        if server_settings["interface"]:
 
3046
            service.interface = if_nametoindex(
 
3047
                server_settings["interface"].encode("utf-8"))
2539
3048
    
2540
3049
    global multiprocessing_manager
2541
3050
    multiprocessing_manager = multiprocessing.Manager()
2560
3069
    if server_settings["restore"]:
2561
3070
        try:
2562
3071
            with open(stored_state_path, "rb") as stored_state:
2563
 
                clients_data, old_client_settings = (pickle.load
2564
 
                                                     (stored_state))
 
3072
                if sys.version_info.major == 2:                
 
3073
                    clients_data, old_client_settings = pickle.load(
 
3074
                        stored_state)
 
3075
                else:
 
3076
                    bytes_clients_data, bytes_old_client_settings = (
 
3077
                        pickle.load(stored_state, encoding = "bytes"))
 
3078
                    ### Fix bytes to strings
 
3079
                    ## clients_data
 
3080
                    # .keys()
 
3081
                    clients_data = { (key.decode("utf-8")
 
3082
                                      if isinstance(key, bytes)
 
3083
                                      else key): value
 
3084
                                     for key, value in
 
3085
                                     bytes_clients_data.items() }
 
3086
                    del bytes_clients_data
 
3087
                    for key in clients_data:
 
3088
                        value = { (k.decode("utf-8")
 
3089
                                   if isinstance(k, bytes) else k): v
 
3090
                                  for k, v in
 
3091
                                  clients_data[key].items() }
 
3092
                        clients_data[key] = value
 
3093
                        # .client_structure
 
3094
                        value["client_structure"] = [
 
3095
                            (s.decode("utf-8")
 
3096
                             if isinstance(s, bytes)
 
3097
                             else s) for s in
 
3098
                            value["client_structure"] ]
 
3099
                        # .name & .host
 
3100
                        for k in ("name", "host"):
 
3101
                            if isinstance(value[k], bytes):
 
3102
                                value[k] = value[k].decode("utf-8")
 
3103
                    ## old_client_settings
 
3104
                    # .keys()
 
3105
                    old_client_settings = {
 
3106
                        (key.decode("utf-8")
 
3107
                         if isinstance(key, bytes)
 
3108
                         else key): value
 
3109
                        for key, value in
 
3110
                        bytes_old_client_settings.items() }
 
3111
                    del bytes_old_client_settings
 
3112
                    # .host
 
3113
                    for value in old_client_settings.values():
 
3114
                        if isinstance(value["host"], bytes):
 
3115
                            value["host"] = (value["host"]
 
3116
                                             .decode("utf-8"))
2565
3117
            os.remove(stored_state_path)
2566
3118
        except IOError as e:
2567
3119
            if e.errno == errno.ENOENT:
2568
 
                logger.warning("Could not load persistent state: {0}"
2569
 
                                .format(os.strerror(e.errno)))
 
3120
                logger.warning("Could not load persistent state:"
 
3121
                               " {}".format(os.strerror(e.errno)))
2570
3122
            else:
2571
3123
                logger.critical("Could not load persistent state:",
2572
3124
                                exc_info=e)
2573
3125
                raise
2574
3126
        except EOFError as e:
2575
3127
            logger.warning("Could not load persistent state: "
2576
 
                           "EOFError:", exc_info=e)
 
3128
                           "EOFError:",
 
3129
                           exc_info=e)
2577
3130
    
2578
3131
    with PGPEngine() as pgp:
2579
 
        for client_name, client in clients_data.iteritems():
 
3132
        for client_name, client in clients_data.items():
2580
3133
            # Skip removed clients
2581
3134
            if client_name not in client_settings:
2582
3135
                continue
2591
3144
                    # For each value in new config, check if it
2592
3145
                    # differs from the old config value (Except for
2593
3146
                    # the "secret" attribute)
2594
 
                    if (name != "secret" and
2595
 
                        value != old_client_settings[client_name]
2596
 
                        [name]):
 
3147
                    if (name != "secret"
 
3148
                        and (value !=
 
3149
                             old_client_settings[client_name][name])):
2597
3150
                        client[name] = value
2598
3151
                except KeyError:
2599
3152
                    pass
2600
3153
            
2601
3154
            # Clients who has passed its expire date can still be
2602
 
            # enabled if its last checker was successful.  Clients
 
3155
            # enabled if its last checker was successful.  A Client
2603
3156
            # whose checker succeeded before we stored its state is
2604
3157
            # assumed to have successfully run all checkers during
2605
3158
            # downtime.
2607
3160
                if datetime.datetime.utcnow() >= client["expires"]:
2608
3161
                    if not client["last_checked_ok"]:
2609
3162
                        logger.warning(
2610
 
                            "disabling client {0} - Client never "
2611
 
                            "performed a successful checker"
2612
 
                            .format(client_name))
 
3163
                            "disabling client {} - Client never "
 
3164
                            "performed a successful checker".format(
 
3165
                                client_name))
2613
3166
                        client["enabled"] = False
2614
3167
                    elif client["last_checker_status"] != 0:
2615
3168
                        logger.warning(
2616
 
                            "disabling client {0} - Client "
2617
 
                            "last checker failed with error code {1}"
2618
 
                            .format(client_name,
2619
 
                                    client["last_checker_status"]))
 
3169
                            "disabling client {} - Client last"
 
3170
                            " checker failed with error code"
 
3171
                            " {}".format(
 
3172
                                client_name,
 
3173
                                client["last_checker_status"]))
2620
3174
                        client["enabled"] = False
2621
3175
                    else:
2622
 
                        client["expires"] = (datetime.datetime
2623
 
                                             .utcnow()
2624
 
                                             + client["timeout"])
 
3176
                        client["expires"] = (
 
3177
                            datetime.datetime.utcnow()
 
3178
                            + client["timeout"])
2625
3179
                        logger.debug("Last checker succeeded,"
2626
 
                                     " keeping {0} enabled"
2627
 
                                     .format(client_name))
 
3180
                                     " keeping {} enabled".format(
 
3181
                                         client_name))
2628
3182
            try:
2629
 
                client["secret"] = (
2630
 
                    pgp.decrypt(client["encrypted_secret"],
2631
 
                                client_settings[client_name]
2632
 
                                ["secret"]))
 
3183
                client["secret"] = pgp.decrypt(
 
3184
                    client["encrypted_secret"],
 
3185
                    client_settings[client_name]["secret"])
2633
3186
            except PGPError:
2634
3187
                # If decryption fails, we use secret from new settings
2635
 
                logger.debug("Failed to decrypt {0} old secret"
2636
 
                             .format(client_name))
2637
 
                client["secret"] = (
2638
 
                    client_settings[client_name]["secret"])
 
3188
                logger.debug("Failed to decrypt {} old secret".format(
 
3189
                    client_name))
 
3190
                client["secret"] = (client_settings[client_name]
 
3191
                                    ["secret"])
2639
3192
    
2640
3193
    # Add/remove clients based on new changes made to config
2641
3194
    for client_name in (set(old_client_settings)
2646
3199
        clients_data[client_name] = client_settings[client_name]
2647
3200
    
2648
3201
    # Create all client objects
2649
 
    for client_name, client in clients_data.iteritems():
 
3202
    for client_name, client in clients_data.items():
2650
3203
        tcp_server.clients[client_name] = client_class(
2651
 
            name = client_name, settings = client,
 
3204
            name = client_name,
 
3205
            settings = client,
2652
3206
            server_settings = server_settings)
2653
3207
    
2654
3208
    if not tcp_server.clients:
2656
3210
    
2657
3211
    if not foreground:
2658
3212
        if pidfile is not None:
 
3213
            pid = os.getpid()
2659
3214
            try:
2660
3215
                with pidfile:
2661
 
                    pid = os.getpid()
2662
 
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
3216
                    print(pid, file=pidfile)
2663
3217
            except IOError:
2664
3218
                logger.error("Could not write to file %r with PID %d",
2665
3219
                             pidfilename, pid)
2666
3220
        del pidfile
2667
3221
        del pidfilename
2668
3222
    
2669
 
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2670
 
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
 
3223
    for termsig in (signal.SIGHUP, signal.SIGTERM):
 
3224
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
 
3225
                             lambda: main_loop.quit() and False)
2671
3226
    
2672
3227
    if use_dbus:
2673
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2674
 
                                        "se.bsnet.fukt.Mandos"})
2675
 
        class MandosDBusService(DBusObjectWithProperties):
 
3228
        
 
3229
        @alternate_dbus_interfaces(
 
3230
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
 
3231
        class MandosDBusService(DBusObjectWithObjectManager):
2676
3232
            """A D-Bus proxy object"""
 
3233
            
2677
3234
            def __init__(self):
2678
3235
                dbus.service.Object.__init__(self, bus, "/")
 
3236
            
2679
3237
            _interface = "se.recompile.Mandos"
2680
3238
            
2681
 
            @dbus_interface_annotations(_interface)
2682
 
            def _foo(self):
2683
 
                return { "org.freedesktop.DBus.Property"
2684
 
                         ".EmitsChangedSignal":
2685
 
                             "false"}
2686
 
            
2687
3239
            @dbus.service.signal(_interface, signature="o")
2688
3240
            def ClientAdded(self, objpath):
2689
3241
                "D-Bus signal"
2694
3246
                "D-Bus signal"
2695
3247
                pass
2696
3248
            
 
3249
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3250
                               "true"})
2697
3251
            @dbus.service.signal(_interface, signature="os")
2698
3252
            def ClientRemoved(self, objpath, name):
2699
3253
                "D-Bus signal"
2700
3254
                pass
2701
3255
            
 
3256
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3257
                               "true"})
2702
3258
            @dbus.service.method(_interface, out_signature="ao")
2703
3259
            def GetAllClients(self):
2704
3260
                "D-Bus method"
2705
 
                return dbus.Array(c.dbus_object_path
2706
 
                                  for c in
2707
 
                                  tcp_server.clients.itervalues())
 
3261
                return dbus.Array(c.dbus_object_path for c in
 
3262
                                  tcp_server.clients.values())
2708
3263
            
 
3264
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3265
                               "true"})
2709
3266
            @dbus.service.method(_interface,
2710
3267
                                 out_signature="a{oa{sv}}")
2711
3268
            def GetAllClientsWithProperties(self):
2712
3269
                "D-Bus method"
2713
3270
                return dbus.Dictionary(
2714
 
                    ((c.dbus_object_path, c.GetAll(""))
2715
 
                     for c in tcp_server.clients.itervalues()),
 
3271
                    { c.dbus_object_path: c.GetAll(
 
3272
                        "se.recompile.Mandos.Client")
 
3273
                      for c in tcp_server.clients.values() },
2716
3274
                    signature="oa{sv}")
2717
3275
            
2718
3276
            @dbus.service.method(_interface, in_signature="o")
2719
3277
            def RemoveClient(self, object_path):
2720
3278
                "D-Bus method"
2721
 
                for c in tcp_server.clients.itervalues():
 
3279
                for c in tcp_server.clients.values():
2722
3280
                    if c.dbus_object_path == object_path:
2723
3281
                        del tcp_server.clients[c.name]
2724
3282
                        c.remove_from_connection()
2725
 
                        # Don't signal anything except ClientRemoved
 
3283
                        # Don't signal the disabling
2726
3284
                        c.disable(quiet=True)
2727
 
                        # Emit D-Bus signal
2728
 
                        self.ClientRemoved(object_path, c.name)
 
3285
                        # Emit D-Bus signal for removal
 
3286
                        self.client_removed_signal(c)
2729
3287
                        return
2730
3288
                raise KeyError(object_path)
2731
3289
            
2732
3290
            del _interface
 
3291
            
 
3292
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
3293
                                 out_signature = "a{oa{sa{sv}}}")
 
3294
            def GetManagedObjects(self):
 
3295
                """D-Bus method"""
 
3296
                return dbus.Dictionary(
 
3297
                    { client.dbus_object_path:
 
3298
                      dbus.Dictionary(
 
3299
                          { interface: client.GetAll(interface)
 
3300
                            for interface in
 
3301
                                 client._get_all_interface_names()})
 
3302
                      for client in tcp_server.clients.values()})
 
3303
            
 
3304
            def client_added_signal(self, client):
 
3305
                """Send the new standard signal and the old signal"""
 
3306
                if use_dbus:
 
3307
                    # New standard signal
 
3308
                    self.InterfacesAdded(
 
3309
                        client.dbus_object_path,
 
3310
                        dbus.Dictionary(
 
3311
                            { interface: client.GetAll(interface)
 
3312
                              for interface in
 
3313
                              client._get_all_interface_names()}))
 
3314
                    # Old signal
 
3315
                    self.ClientAdded(client.dbus_object_path)
 
3316
            
 
3317
            def client_removed_signal(self, client):
 
3318
                """Send the new standard signal and the old signal"""
 
3319
                if use_dbus:
 
3320
                    # New standard signal
 
3321
                    self.InterfacesRemoved(
 
3322
                        client.dbus_object_path,
 
3323
                        client._get_all_interface_names())
 
3324
                    # Old signal
 
3325
                    self.ClientRemoved(client.dbus_object_path,
 
3326
                                       client.name)
2733
3327
        
2734
3328
        mandos_dbus_service = MandosDBusService()
2735
3329
    
 
3330
    # Save modules to variables to exempt the modules from being
 
3331
    # unloaded before the function registered with atexit() is run.
 
3332
    mp = multiprocessing
 
3333
    wn = wnull
2736
3334
    def cleanup():
2737
3335
        "Cleanup function; run on exit"
2738
 
        service.cleanup()
 
3336
        if zeroconf:
 
3337
            service.cleanup()
2739
3338
        
2740
 
        multiprocessing.active_children()
2741
 
        wnull.close()
 
3339
        mp.active_children()
 
3340
        wn.close()
2742
3341
        if not (tcp_server.clients or client_settings):
2743
3342
            return
2744
3343
        
2747
3346
        # removed/edited, old secret will thus be unrecovable.
2748
3347
        clients = {}
2749
3348
        with PGPEngine() as pgp:
2750
 
            for client in tcp_server.clients.itervalues():
 
3349
            for client in tcp_server.clients.values():
2751
3350
                key = client_settings[client.name]["secret"]
2752
3351
                client.encrypted_secret = pgp.encrypt(client.secret,
2753
3352
                                                      key)
2755
3354
                
2756
3355
                # A list of attributes that can not be pickled
2757
3356
                # + secret.
2758
 
                exclude = set(("bus", "changedstate", "secret",
2759
 
                               "checker", "server_settings"))
2760
 
                for name, typ in (inspect.getmembers
2761
 
                                  (dbus.service.Object)):
 
3357
                exclude = { "bus", "changedstate", "secret",
 
3358
                            "checker", "server_settings" }
 
3359
                for name, typ in inspect.getmembers(dbus.service
 
3360
                                                    .Object):
2762
3361
                    exclude.add(name)
2763
3362
                
2764
3363
                client_dict["encrypted_secret"] = (client
2771
3370
                del client_settings[client.name]["secret"]
2772
3371
        
2773
3372
        try:
2774
 
            with (tempfile.NamedTemporaryFile
2775
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2776
 
                   dir=os.path.dirname(stored_state_path),
2777
 
                   delete=False)) as stored_state:
2778
 
                pickle.dump((clients, client_settings), stored_state)
2779
 
                tempname=stored_state.name
 
3373
            with tempfile.NamedTemporaryFile(
 
3374
                    mode='wb',
 
3375
                    suffix=".pickle",
 
3376
                    prefix='clients-',
 
3377
                    dir=os.path.dirname(stored_state_path),
 
3378
                    delete=False) as stored_state:
 
3379
                pickle.dump((clients, client_settings), stored_state,
 
3380
                            protocol = 2)
 
3381
                tempname = stored_state.name
2780
3382
            os.rename(tempname, stored_state_path)
2781
3383
        except (IOError, OSError) as e:
2782
3384
            if not debug:
2785
3387
                except NameError:
2786
3388
                    pass
2787
3389
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2788
 
                logger.warning("Could not save persistent state: {0}"
 
3390
                logger.warning("Could not save persistent state: {}"
2789
3391
                               .format(os.strerror(e.errno)))
2790
3392
            else:
2791
3393
                logger.warning("Could not save persistent state:",
2792
3394
                               exc_info=e)
2793
 
                raise e
 
3395
                raise
2794
3396
        
2795
3397
        # Delete all clients, and settings from config
2796
3398
        while tcp_server.clients:
2797
3399
            name, client = tcp_server.clients.popitem()
2798
3400
            if use_dbus:
2799
3401
                client.remove_from_connection()
2800
 
            # Don't signal anything except ClientRemoved
 
3402
            # Don't signal the disabling
2801
3403
            client.disable(quiet=True)
 
3404
            # Emit D-Bus signal for removal
2802
3405
            if use_dbus:
2803
 
                # Emit D-Bus signal
2804
 
                mandos_dbus_service.ClientRemoved(client
2805
 
                                                  .dbus_object_path,
2806
 
                                                  client.name)
 
3406
                mandos_dbus_service.client_removed_signal(client)
2807
3407
        client_settings.clear()
2808
3408
    
2809
3409
    atexit.register(cleanup)
2810
3410
    
2811
 
    for client in tcp_server.clients.itervalues():
 
3411
    for client in tcp_server.clients.values():
2812
3412
        if use_dbus:
2813
 
            # Emit D-Bus signal
2814
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
3413
            # Emit D-Bus signal for adding
 
3414
            mandos_dbus_service.client_added_signal(client)
2815
3415
        # Need to initiate checking of clients
2816
3416
        if client.enabled:
2817
3417
            client.init_checker()
2820
3420
    tcp_server.server_activate()
2821
3421
    
2822
3422
    # Find out what port we got
2823
 
    service.port = tcp_server.socket.getsockname()[1]
 
3423
    if zeroconf:
 
3424
        service.port = tcp_server.socket.getsockname()[1]
2824
3425
    if use_ipv6:
2825
3426
        logger.info("Now listening on address %r, port %d,"
2826
3427
                    " flowinfo %d, scope_id %d",
2832
3433
    #service.interface = tcp_server.socket.getsockname()[3]
2833
3434
    
2834
3435
    try:
2835
 
        # From the Avahi example code
2836
 
        try:
2837
 
            service.activate()
2838
 
        except dbus.exceptions.DBusException as error:
2839
 
            logger.critical("D-Bus Exception", exc_info=error)
2840
 
            cleanup()
2841
 
            sys.exit(1)
2842
 
        # End of Avahi example code
 
3436
        if zeroconf:
 
3437
            # From the Avahi example code
 
3438
            try:
 
3439
                service.activate()
 
3440
            except dbus.exceptions.DBusException as error:
 
3441
                logger.critical("D-Bus Exception", exc_info=error)
 
3442
                cleanup()
 
3443
                sys.exit(1)
 
3444
            # End of Avahi example code
2843
3445
        
2844
 
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2845
 
                             lambda *args, **kwargs:
2846
 
                             (tcp_server.handle_request
2847
 
                              (*args[2:], **kwargs) or True))
 
3446
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
 
3447
                          lambda *args, **kwargs:
 
3448
                          (tcp_server.handle_request
 
3449
                           (*args[2:], **kwargs) or True))
2848
3450
        
2849
3451
        logger.debug("Starting main loop")
2850
3452
        main_loop.run()
2860
3462
    # Must run before the D-Bus bus name gets deregistered
2861
3463
    cleanup()
2862
3464
 
 
3465
 
2863
3466
if __name__ == '__main__':
2864
3467
    main()