/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2016-06-28 18:52:00 UTC
  • Revision ID: teddy@recompile.se-20160628185200-vv6fikpt18r977x3
mandos-ctl: Include "Expires" and "LastCheckerStatus" properties

* mandos-ctl (tablewords): Add "Expires" and "LastCheckerStatus".
  (main/keywords): - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
 
14
# Copyright © 2008-2016 Teddy Hogeborn
 
15
# Copyright © 2008-2016 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
37
 
from future_builtins import *
 
37
try:
 
38
    from future_builtins import *
 
39
except ImportError:
 
40
    pass
38
41
 
39
 
import SocketServer as socketserver
 
42
try:
 
43
    import SocketServer as socketserver
 
44
except ImportError:
 
45
    import socketserver
40
46
import socket
41
47
import argparse
42
48
import datetime
43
49
import errno
44
 
import gnutls.crypto
45
 
import gnutls.connection
46
 
import gnutls.errors
47
 
import gnutls.library.functions
48
 
import gnutls.library.constants
49
 
import gnutls.library.types
50
 
import ConfigParser as configparser
 
50
try:
 
51
    import ConfigParser as configparser
 
52
except ImportError:
 
53
    import configparser
51
54
import sys
52
55
import re
53
56
import os
62
65
import struct
63
66
import fcntl
64
67
import functools
65
 
import cPickle as pickle
 
68
try:
 
69
    import cPickle as pickle
 
70
except ImportError:
 
71
    import pickle
66
72
import multiprocessing
67
73
import types
68
74
import binascii
69
75
import tempfile
70
76
import itertools
 
77
import collections
 
78
import codecs
71
79
 
72
80
import dbus
73
81
import dbus.service
74
 
import gobject
75
 
import avahi
 
82
from gi.repository import GLib
76
83
from dbus.mainloop.glib import DBusGMainLoop
77
84
import ctypes
78
85
import ctypes.util
79
86
import xml.dom.minidom
80
87
import inspect
81
 
import GnuPGInterface
82
88
 
 
89
# Try to find the value of SO_BINDTODEVICE:
83
90
try:
 
91
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
 
92
    # newer, and it is also the most natural place for it:
84
93
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
94
except AttributeError:
86
95
    try:
 
96
        # This is where SO_BINDTODEVICE was up to and including Python
 
97
        # 2.6, and also 3.2:
87
98
        from IN import SO_BINDTODEVICE
88
99
    except ImportError:
89
 
        SO_BINDTODEVICE = None
90
 
 
91
 
version = "1.6.0"
 
100
        # In Python 2.7 it seems to have been removed entirely.
 
101
        # Try running the C preprocessor:
 
102
        try:
 
103
            cc = subprocess.Popen(["cc", "--language=c", "-E",
 
104
                                   "/dev/stdin"],
 
105
                                  stdin=subprocess.PIPE,
 
106
                                  stdout=subprocess.PIPE)
 
107
            stdout = cc.communicate(
 
108
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
 
109
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
 
110
        except (OSError, ValueError, IndexError):
 
111
            # No value found
 
112
            SO_BINDTODEVICE = None
 
113
 
 
114
if sys.version_info.major == 2:
 
115
    str = unicode
 
116
 
 
117
version = "1.7.10"
92
118
stored_state_file = "clients.pickle"
93
119
 
94
120
logger = logging.getLogger()
95
 
syslogger = (logging.handlers.SysLogHandler
96
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
 
              address = str("/dev/log")))
 
121
syslogger = None
98
122
 
99
123
try:
100
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
101
 
                      (ctypes.util.find_library("c"))
102
 
                      .if_nametoindex)
 
124
    if_nametoindex = ctypes.cdll.LoadLibrary(
 
125
        ctypes.util.find_library("c")).if_nametoindex
103
126
except (OSError, AttributeError):
 
127
    
104
128
    def if_nametoindex(interface):
105
129
        "Get an interface index the hard way, i.e. using fcntl()"
106
130
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
107
131
        with contextlib.closing(socket.socket()) as s:
108
132
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
 
                                struct.pack(str("16s16x"),
110
 
                                            interface))
111
 
        interface_index = struct.unpack(str("I"),
112
 
                                        ifreq[16:20])[0]
 
133
                                struct.pack(b"16s16x", interface))
 
134
        interface_index = struct.unpack("I", ifreq[16:20])[0]
113
135
        return interface_index
114
136
 
115
137
 
 
138
def copy_function(func):
 
139
    """Make a copy of a function"""
 
140
    if sys.version_info.major == 2:
 
141
        return types.FunctionType(func.func_code,
 
142
                                  func.func_globals,
 
143
                                  func.func_name,
 
144
                                  func.func_defaults,
 
145
                                  func.func_closure)
 
146
    else:
 
147
        return types.FunctionType(func.__code__,
 
148
                                  func.__globals__,
 
149
                                  func.__name__,
 
150
                                  func.__defaults__,
 
151
                                  func.__closure__)
 
152
 
 
153
 
116
154
def initlogger(debug, level=logging.WARNING):
117
155
    """init logger and add loglevel"""
118
156
    
 
157
    global syslogger
 
158
    syslogger = (logging.handlers.SysLogHandler(
 
159
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
160
        address = "/dev/log"))
119
161
    syslogger.setFormatter(logging.Formatter
120
162
                           ('Mandos [%(process)d]: %(levelname)s:'
121
163
                            ' %(message)s'))
138
180
 
139
181
class PGPEngine(object):
140
182
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
183
    
141
184
    def __init__(self):
142
 
        self.gnupg = GnuPGInterface.GnuPG()
143
185
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
 
        self.gnupg = GnuPGInterface.GnuPG()
145
 
        self.gnupg.options.meta_interactive = False
146
 
        self.gnupg.options.homedir = self.tempdir
147
 
        self.gnupg.options.extra_args.extend(['--force-mdc',
148
 
                                              '--quiet',
149
 
                                              '--no-use-agent'])
 
186
        self.gpg = "gpg"
 
187
        try:
 
188
            output = subprocess.check_output(["gpgconf"])
 
189
            for line in output.splitlines():
 
190
                name, text, path = line.split(b":")
 
191
                if name == "gpg":
 
192
                    self.gpg = path
 
193
                    break
 
194
        except OSError as e:
 
195
            if e.errno != errno.ENOENT:
 
196
                raise
 
197
        self.gnupgargs = ['--batch',
 
198
                          '--homedir', self.tempdir,
 
199
                          '--force-mdc',
 
200
                          '--quiet']
 
201
        # Only GPG version 1 has the --no-use-agent option.
 
202
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
 
203
            self.gnupgargs.append("--no-use-agent")
150
204
    
151
205
    def __enter__(self):
152
206
        return self
174
228
    def password_encode(self, password):
175
229
        # Passphrase can not be empty and can not contain newlines or
176
230
        # NUL bytes.  So we prefix it and hex encode it.
177
 
        return b"mandos" + binascii.hexlify(password)
 
231
        encoded = b"mandos" + binascii.hexlify(password)
 
232
        if len(encoded) > 2048:
 
233
            # GnuPG can't handle long passwords, so encode differently
 
234
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
235
                       .replace(b"\n", b"\\n")
 
236
                       .replace(b"\0", b"\\x00"))
 
237
        return encoded
178
238
    
179
239
    def encrypt(self, data, password):
180
 
        self.gnupg.passphrase = self.password_encode(password)
181
 
        with open(os.devnull, "w") as devnull:
182
 
            try:
183
 
                proc = self.gnupg.run(['--symmetric'],
184
 
                                      create_fhs=['stdin', 'stdout'],
185
 
                                      attach_fhs={'stderr': devnull})
186
 
                with contextlib.closing(proc.handles['stdin']) as f:
187
 
                    f.write(data)
188
 
                with contextlib.closing(proc.handles['stdout']) as f:
189
 
                    ciphertext = f.read()
190
 
                proc.wait()
191
 
            except IOError as e:
192
 
                raise PGPError(e)
193
 
        self.gnupg.passphrase = None
 
240
        passphrase = self.password_encode(password)
 
241
        with tempfile.NamedTemporaryFile(
 
242
                dir=self.tempdir) as passfile:
 
243
            passfile.write(passphrase)
 
244
            passfile.flush()
 
245
            proc = subprocess.Popen([self.gpg, '--symmetric',
 
246
                                     '--passphrase-file',
 
247
                                     passfile.name]
 
248
                                    + self.gnupgargs,
 
249
                                    stdin = subprocess.PIPE,
 
250
                                    stdout = subprocess.PIPE,
 
251
                                    stderr = subprocess.PIPE)
 
252
            ciphertext, err = proc.communicate(input = data)
 
253
        if proc.returncode != 0:
 
254
            raise PGPError(err)
194
255
        return ciphertext
195
256
    
196
257
    def decrypt(self, data, password):
197
 
        self.gnupg.passphrase = self.password_encode(password)
198
 
        with open(os.devnull, "w") as devnull:
199
 
            try:
200
 
                proc = self.gnupg.run(['--decrypt'],
201
 
                                      create_fhs=['stdin', 'stdout'],
202
 
                                      attach_fhs={'stderr': devnull})
203
 
                with contextlib.closing(proc.handles['stdin']) as f:
204
 
                    f.write(data)
205
 
                with contextlib.closing(proc.handles['stdout']) as f:
206
 
                    decrypted_plaintext = f.read()
207
 
                proc.wait()
208
 
            except IOError as e:
209
 
                raise PGPError(e)
210
 
        self.gnupg.passphrase = None
 
258
        passphrase = self.password_encode(password)
 
259
        with tempfile.NamedTemporaryFile(
 
260
                dir = self.tempdir) as passfile:
 
261
            passfile.write(passphrase)
 
262
            passfile.flush()
 
263
            proc = subprocess.Popen([self.gpg, '--decrypt',
 
264
                                     '--passphrase-file',
 
265
                                     passfile.name]
 
266
                                    + self.gnupgargs,
 
267
                                    stdin = subprocess.PIPE,
 
268
                                    stdout = subprocess.PIPE,
 
269
                                    stderr = subprocess.PIPE)
 
270
            decrypted_plaintext, err = proc.communicate(input = data)
 
271
        if proc.returncode != 0:
 
272
            raise PGPError(err)
211
273
        return decrypted_plaintext
212
274
 
 
275
# Pretend that we have an Avahi module
 
276
class Avahi(object):
 
277
    """This isn't so much a class as it is a module-like namespace.
 
278
    It is instantiated once, and simulates having an Avahi module."""
 
279
    IF_UNSPEC = -1              # avahi-common/address.h
 
280
    PROTO_UNSPEC = -1           # avahi-common/address.h
 
281
    PROTO_INET = 0              # avahi-common/address.h
 
282
    PROTO_INET6 = 1             # avahi-common/address.h
 
283
    DBUS_NAME = "org.freedesktop.Avahi"
 
284
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
 
285
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
 
286
    DBUS_PATH_SERVER = "/"
 
287
    def string_array_to_txt_array(self, t):
 
288
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
 
289
                           for s in t), signature="ay")
 
290
    ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
 
291
    ENTRY_GROUP_COLLISION = 3   # avahi-common/defs.h
 
292
    ENTRY_GROUP_FAILURE = 4     # avahi-common/defs.h
 
293
    SERVER_INVALID = 0          # avahi-common/defs.h
 
294
    SERVER_REGISTERING = 1      # avahi-common/defs.h
 
295
    SERVER_RUNNING = 2          # avahi-common/defs.h
 
296
    SERVER_COLLISION = 3        # avahi-common/defs.h
 
297
    SERVER_FAILURE = 4          # avahi-common/defs.h
 
298
avahi = Avahi()
213
299
 
214
300
class AvahiError(Exception):
215
301
    def __init__(self, value, *args, **kwargs):
216
302
        self.value = value
217
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
218
 
    def __unicode__(self):
219
 
        return unicode(repr(self.value))
 
303
        return super(AvahiError, self).__init__(value, *args,
 
304
                                                **kwargs)
 
305
 
220
306
 
221
307
class AvahiServiceError(AvahiError):
222
308
    pass
223
309
 
 
310
 
224
311
class AvahiGroupError(AvahiError):
225
312
    pass
226
313
 
233
320
               Used to optionally bind to the specified interface.
234
321
    name: string; Example: 'Mandos'
235
322
    type: string; Example: '_mandos._tcp'.
236
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
323
     See <https://www.iana.org/assignments/service-names-port-numbers>
237
324
    port: integer; what port to announce
238
325
    TXT: list of strings; TXT record for the service
239
326
    domain: string; Domain to publish on, default to .local if empty.
246
333
    bus: dbus.SystemBus()
247
334
    """
248
335
    
249
 
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
250
 
                 servicetype = None, port = None, TXT = None,
251
 
                 domain = "", host = "", max_renames = 32768,
252
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
336
    def __init__(self,
 
337
                 interface = avahi.IF_UNSPEC,
 
338
                 name = None,
 
339
                 servicetype = None,
 
340
                 port = None,
 
341
                 TXT = None,
 
342
                 domain = "",
 
343
                 host = "",
 
344
                 max_renames = 32768,
 
345
                 protocol = avahi.PROTO_UNSPEC,
 
346
                 bus = None):
253
347
        self.interface = interface
254
348
        self.name = name
255
349
        self.type = servicetype
265
359
        self.bus = bus
266
360
        self.entry_group_state_changed_match = None
267
361
    
268
 
    def rename(self):
 
362
    def rename(self, remove=True):
269
363
        """Derived from the Avahi example code"""
270
364
        if self.rename_count >= self.max_renames:
271
365
            logger.critical("No suitable Zeroconf service name found"
272
366
                            " after %i retries, exiting.",
273
367
                            self.rename_count)
274
368
            raise AvahiServiceError("Too many renames")
275
 
        self.name = unicode(self.server
276
 
                            .GetAlternativeServiceName(self.name))
 
369
        self.name = str(
 
370
            self.server.GetAlternativeServiceName(self.name))
 
371
        self.rename_count += 1
277
372
        logger.info("Changing Zeroconf service name to %r ...",
278
373
                    self.name)
279
 
        self.remove()
 
374
        if remove:
 
375
            self.remove()
280
376
        try:
281
377
            self.add()
282
378
        except dbus.exceptions.DBusException as error:
283
 
            logger.critical("D-Bus Exception", exc_info=error)
284
 
            self.cleanup()
285
 
            os._exit(1)
286
 
        self.rename_count += 1
 
379
            if (error.get_dbus_name()
 
380
                == "org.freedesktop.Avahi.CollisionError"):
 
381
                logger.info("Local Zeroconf service name collision.")
 
382
                return self.rename(remove=False)
 
383
            else:
 
384
                logger.critical("D-Bus Exception", exc_info=error)
 
385
                self.cleanup()
 
386
                os._exit(1)
287
387
    
288
388
    def remove(self):
289
389
        """Derived from the Avahi example code"""
327
427
            self.rename()
328
428
        elif state == avahi.ENTRY_GROUP_FAILURE:
329
429
            logger.critical("Avahi: Error in group state changed %s",
330
 
                            unicode(error))
331
 
            raise AvahiGroupError("State changed: {0!s}"
332
 
                                  .format(error))
 
430
                            str(error))
 
431
            raise AvahiGroupError("State changed: {!s}".format(error))
333
432
    
334
433
    def cleanup(self):
335
434
        """Derived from the Avahi example code"""
345
444
    def server_state_changed(self, state, error=None):
346
445
        """Derived from the Avahi example code"""
347
446
        logger.debug("Avahi server state change: %i", state)
348
 
        bad_states = { avahi.SERVER_INVALID:
349
 
                           "Zeroconf server invalid",
350
 
                       avahi.SERVER_REGISTERING: None,
351
 
                       avahi.SERVER_COLLISION:
352
 
                           "Zeroconf server name collision",
353
 
                       avahi.SERVER_FAILURE:
354
 
                           "Zeroconf server failure" }
 
447
        bad_states = {
 
448
            avahi.SERVER_INVALID: "Zeroconf server invalid",
 
449
            avahi.SERVER_REGISTERING: None,
 
450
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
 
451
            avahi.SERVER_FAILURE: "Zeroconf server failure",
 
452
        }
355
453
        if state in bad_states:
356
454
            if bad_states[state] is not None:
357
455
                if error is None:
360
458
                    logger.error(bad_states[state] + ": %r", error)
361
459
            self.cleanup()
362
460
        elif state == avahi.SERVER_RUNNING:
363
 
            self.add()
 
461
            try:
 
462
                self.add()
 
463
            except dbus.exceptions.DBusException as error:
 
464
                if (error.get_dbus_name()
 
465
                    == "org.freedesktop.Avahi.CollisionError"):
 
466
                    logger.info("Local Zeroconf service name"
 
467
                                " collision.")
 
468
                    return self.rename(remove=False)
 
469
                else:
 
470
                    logger.critical("D-Bus Exception", exc_info=error)
 
471
                    self.cleanup()
 
472
                    os._exit(1)
364
473
        else:
365
474
            if error is None:
366
475
                logger.debug("Unknown state: %r", state)
376
485
                                    follow_name_owner_changes=True),
377
486
                avahi.DBUS_INTERFACE_SERVER)
378
487
        self.server.connect_to_signal("StateChanged",
379
 
                                 self.server_state_changed)
 
488
                                      self.server_state_changed)
380
489
        self.server_state_changed(self.server.GetState())
381
490
 
382
491
 
383
492
class AvahiServiceToSyslog(AvahiService):
384
 
    def rename(self):
 
493
    def rename(self, *args, **kwargs):
385
494
        """Add the new name to the syslog messages"""
386
 
        ret = AvahiService.rename(self)
387
 
        syslogger.setFormatter(logging.Formatter
388
 
                               ('Mandos ({0}) [%(process)d]:'
389
 
                                ' %(levelname)s: %(message)s'
390
 
                                .format(self.name)))
 
495
        ret = AvahiService.rename(self, *args, **kwargs)
 
496
        syslogger.setFormatter(logging.Formatter(
 
497
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
498
            .format(self.name)))
391
499
        return ret
392
500
 
393
 
 
394
 
def timedelta_to_milliseconds(td):
395
 
    "Convert a datetime.timedelta() to milliseconds"
396
 
    return ((td.days * 24 * 60 * 60 * 1000)
397
 
            + (td.seconds * 1000)
398
 
            + (td.microseconds // 1000))
399
 
 
 
501
# Pretend that we have a GnuTLS module
 
502
class GnuTLS(object):
 
503
    """This isn't so much a class as it is a module-like namespace.
 
504
    It is instantiated once, and simulates having a GnuTLS module."""
 
505
    
 
506
    _library = ctypes.cdll.LoadLibrary(
 
507
        ctypes.util.find_library("gnutls"))
 
508
    _need_version = b"3.3.0"
 
509
    def __init__(self):
 
510
        # Need to use class name "GnuTLS" here, since this method is
 
511
        # called before the assignment to the "gnutls" global variable
 
512
        # happens.
 
513
        if GnuTLS.check_version(self._need_version) is None:
 
514
            raise GnuTLS.Error("Needs GnuTLS {} or later"
 
515
                               .format(self._need_version))
 
516
    
 
517
    # Unless otherwise indicated, the constants and types below are
 
518
    # all from the gnutls/gnutls.h C header file.
 
519
    
 
520
    # Constants
 
521
    E_SUCCESS = 0
 
522
    E_INTERRUPTED = -52
 
523
    E_AGAIN = -28
 
524
    CRT_OPENPGP = 2
 
525
    CLIENT = 2
 
526
    SHUT_RDWR = 0
 
527
    CRD_CERTIFICATE = 1
 
528
    E_NO_CERTIFICATE_FOUND = -49
 
529
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
 
530
    
 
531
    # Types
 
532
    class session_int(ctypes.Structure):
 
533
        _fields_ = []
 
534
    session_t = ctypes.POINTER(session_int)
 
535
    class certificate_credentials_st(ctypes.Structure):
 
536
        _fields_ = []
 
537
    certificate_credentials_t = ctypes.POINTER(
 
538
        certificate_credentials_st)
 
539
    certificate_type_t = ctypes.c_int
 
540
    class datum_t(ctypes.Structure):
 
541
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
 
542
                    ('size', ctypes.c_uint)]
 
543
    class openpgp_crt_int(ctypes.Structure):
 
544
        _fields_ = []
 
545
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
546
    openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
 
547
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
 
548
    credentials_type_t = ctypes.c_int
 
549
    transport_ptr_t = ctypes.c_void_p
 
550
    close_request_t = ctypes.c_int
 
551
    
 
552
    # Exceptions
 
553
    class Error(Exception):
 
554
        # We need to use the class name "GnuTLS" here, since this
 
555
        # exception might be raised from within GnuTLS.__init__,
 
556
        # which is called before the assignment to the "gnutls"
 
557
        # global variable has happened.
 
558
        def __init__(self, message = None, code = None, args=()):
 
559
            # Default usage is by a message string, but if a return
 
560
            # code is passed, convert it to a string with
 
561
            # gnutls.strerror()
 
562
            self.code = code
 
563
            if message is None and code is not None:
 
564
                message = GnuTLS.strerror(code)
 
565
            return super(GnuTLS.Error, self).__init__(
 
566
                message, *args)
 
567
    
 
568
    class CertificateSecurityError(Error):
 
569
        pass
 
570
    
 
571
    # Classes
 
572
    class Credentials(object):
 
573
        def __init__(self):
 
574
            self._c_object = gnutls.certificate_credentials_t()
 
575
            gnutls.certificate_allocate_credentials(
 
576
                ctypes.byref(self._c_object))
 
577
            self.type = gnutls.CRD_CERTIFICATE
 
578
        
 
579
        def __del__(self):
 
580
            gnutls.certificate_free_credentials(self._c_object)
 
581
    
 
582
    class ClientSession(object):
 
583
        def __init__(self, socket, credentials = None):
 
584
            self._c_object = gnutls.session_t()
 
585
            gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
 
586
            gnutls.set_default_priority(self._c_object)
 
587
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
 
588
            gnutls.handshake_set_private_extensions(self._c_object,
 
589
                                                    True)
 
590
            self.socket = socket
 
591
            if credentials is None:
 
592
                credentials = gnutls.Credentials()
 
593
            gnutls.credentials_set(self._c_object, credentials.type,
 
594
                                   ctypes.cast(credentials._c_object,
 
595
                                               ctypes.c_void_p))
 
596
            self.credentials = credentials
 
597
        
 
598
        def __del__(self):
 
599
            gnutls.deinit(self._c_object)
 
600
        
 
601
        def handshake(self):
 
602
            return gnutls.handshake(self._c_object)
 
603
        
 
604
        def send(self, data):
 
605
            data = bytes(data)
 
606
            data_len = len(data)
 
607
            while data_len > 0:
 
608
                data_len -= gnutls.record_send(self._c_object,
 
609
                                               data[-data_len:],
 
610
                                               data_len)
 
611
        
 
612
        def bye(self):
 
613
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
614
    
 
615
    # Error handling functions
 
616
    def _error_code(result):
 
617
        """A function to raise exceptions on errors, suitable
 
618
        for the 'restype' attribute on ctypes functions"""
 
619
        if result >= 0:
 
620
            return result
 
621
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
 
622
            raise gnutls.CertificateSecurityError(code = result)
 
623
        raise gnutls.Error(code = result)
 
624
    
 
625
    def _retry_on_error(result, func, arguments):
 
626
        """A function to retry on some errors, suitable
 
627
        for the 'errcheck' attribute on ctypes functions"""
 
628
        while result < 0:
 
629
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
 
630
                return _error_code(result)
 
631
            result = func(*arguments)
 
632
        return result
 
633
    
 
634
    # Unless otherwise indicated, the function declarations below are
 
635
    # all from the gnutls/gnutls.h C header file.
 
636
    
 
637
    # Functions
 
638
    priority_set_direct = _library.gnutls_priority_set_direct
 
639
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
640
                                    ctypes.POINTER(ctypes.c_char_p)]
 
641
    priority_set_direct.restype = _error_code
 
642
    
 
643
    init = _library.gnutls_init
 
644
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
645
    init.restype = _error_code
 
646
    
 
647
    set_default_priority = _library.gnutls_set_default_priority
 
648
    set_default_priority.argtypes = [session_t]
 
649
    set_default_priority.restype = _error_code
 
650
    
 
651
    record_send = _library.gnutls_record_send
 
652
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
653
                            ctypes.c_size_t]
 
654
    record_send.restype = ctypes.c_ssize_t
 
655
    record_send.errcheck = _retry_on_error
 
656
    
 
657
    certificate_allocate_credentials = (
 
658
        _library.gnutls_certificate_allocate_credentials)
 
659
    certificate_allocate_credentials.argtypes = [
 
660
        ctypes.POINTER(certificate_credentials_t)]
 
661
    certificate_allocate_credentials.restype = _error_code
 
662
    
 
663
    certificate_free_credentials = (
 
664
        _library.gnutls_certificate_free_credentials)
 
665
    certificate_free_credentials.argtypes = [certificate_credentials_t]
 
666
    certificate_free_credentials.restype = None
 
667
    
 
668
    handshake_set_private_extensions = (
 
669
        _library.gnutls_handshake_set_private_extensions)
 
670
    handshake_set_private_extensions.argtypes = [session_t,
 
671
                                                 ctypes.c_int]
 
672
    handshake_set_private_extensions.restype = None
 
673
    
 
674
    credentials_set = _library.gnutls_credentials_set
 
675
    credentials_set.argtypes = [session_t, credentials_type_t,
 
676
                                ctypes.c_void_p]
 
677
    credentials_set.restype = _error_code
 
678
    
 
679
    strerror = _library.gnutls_strerror
 
680
    strerror.argtypes = [ctypes.c_int]
 
681
    strerror.restype = ctypes.c_char_p
 
682
    
 
683
    certificate_type_get = _library.gnutls_certificate_type_get
 
684
    certificate_type_get.argtypes = [session_t]
 
685
    certificate_type_get.restype = _error_code
 
686
    
 
687
    certificate_get_peers = _library.gnutls_certificate_get_peers
 
688
    certificate_get_peers.argtypes = [session_t,
 
689
                                      ctypes.POINTER(ctypes.c_uint)]
 
690
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
 
691
    
 
692
    global_set_log_level = _library.gnutls_global_set_log_level
 
693
    global_set_log_level.argtypes = [ctypes.c_int]
 
694
    global_set_log_level.restype = None
 
695
    
 
696
    global_set_log_function = _library.gnutls_global_set_log_function
 
697
    global_set_log_function.argtypes = [log_func]
 
698
    global_set_log_function.restype = None
 
699
    
 
700
    deinit = _library.gnutls_deinit
 
701
    deinit.argtypes = [session_t]
 
702
    deinit.restype = None
 
703
    
 
704
    handshake = _library.gnutls_handshake
 
705
    handshake.argtypes = [session_t]
 
706
    handshake.restype = _error_code
 
707
    handshake.errcheck = _retry_on_error
 
708
    
 
709
    transport_set_ptr = _library.gnutls_transport_set_ptr
 
710
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
711
    transport_set_ptr.restype = None
 
712
    
 
713
    bye = _library.gnutls_bye
 
714
    bye.argtypes = [session_t, close_request_t]
 
715
    bye.restype = _error_code
 
716
    bye.errcheck = _retry_on_error
 
717
    
 
718
    check_version = _library.gnutls_check_version
 
719
    check_version.argtypes = [ctypes.c_char_p]
 
720
    check_version.restype = ctypes.c_char_p
 
721
    
 
722
    # All the function declarations below are from gnutls/openpgp.h
 
723
    
 
724
    openpgp_crt_init = _library.gnutls_openpgp_crt_init
 
725
    openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
 
726
    openpgp_crt_init.restype = _error_code
 
727
    
 
728
    openpgp_crt_import = _library.gnutls_openpgp_crt_import
 
729
    openpgp_crt_import.argtypes = [openpgp_crt_t,
 
730
                                   ctypes.POINTER(datum_t),
 
731
                                   openpgp_crt_fmt_t]
 
732
    openpgp_crt_import.restype = _error_code
 
733
    
 
734
    openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
 
735
    openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
 
736
                                        ctypes.POINTER(ctypes.c_uint)]
 
737
    openpgp_crt_verify_self.restype = _error_code
 
738
    
 
739
    openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
 
740
    openpgp_crt_deinit.argtypes = [openpgp_crt_t]
 
741
    openpgp_crt_deinit.restype = None
 
742
    
 
743
    openpgp_crt_get_fingerprint = (
 
744
        _library.gnutls_openpgp_crt_get_fingerprint)
 
745
    openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
 
746
                                            ctypes.c_void_p,
 
747
                                            ctypes.POINTER(
 
748
                                                ctypes.c_size_t)]
 
749
    openpgp_crt_get_fingerprint.restype = _error_code
 
750
    
 
751
    # Remove non-public functions
 
752
    del _error_code, _retry_on_error
 
753
# Create the global "gnutls" object, simulating a module
 
754
gnutls = GnuTLS()
 
755
 
 
756
def call_pipe(connection,       # : multiprocessing.Connection
 
757
              func, *args, **kwargs):
 
758
    """This function is meant to be called by multiprocessing.Process
 
759
    
 
760
    This function runs func(*args, **kwargs), and writes the resulting
 
761
    return value on the provided multiprocessing.Connection.
 
762
    """
 
763
    connection.send(func(*args, **kwargs))
 
764
    connection.close()
400
765
 
401
766
class Client(object):
402
767
    """A representation of a client host served by this server.
408
773
    checker:    subprocess.Popen(); a running checker process used
409
774
                                    to see if the client lives.
410
775
                                    'None' if no process is running.
411
 
    checker_callback_tag: a gobject event source tag, or None
 
776
    checker_callback_tag: a GLib event source tag, or None
412
777
    checker_command: string; External command which is run to check
413
778
                     if client lives.  %() expansions are done at
414
779
                     runtime with vars(self) as dict, so that for
415
780
                     instance %(name)s can be used in the command.
416
 
    checker_initiator_tag: a gobject event source tag, or None
 
781
    checker_initiator_tag: a GLib event source tag, or None
417
782
    created:    datetime.datetime(); (UTC) object creation
418
783
    client_structure: Object describing what attributes a client has
419
784
                      and is used for storing the client at exit
420
785
    current_checker_command: string; current running checker_command
421
 
    disable_initiator_tag: a gobject event source tag, or None
 
786
    disable_initiator_tag: a GLib event source tag, or None
422
787
    enabled:    bool()
423
788
    fingerprint: string (40 or 32 hexadecimal digits); used to
424
789
                 uniquely identify the client
429
794
    last_checker_status: integer between 0 and 255 reflecting exit
430
795
                         status of last checker. -1 reflects crashed
431
796
                         checker, -2 means no checker completed yet.
 
797
    last_checker_signal: The signal which killed the last checker, if
 
798
                         last_checker_status is -1
432
799
    last_enabled: datetime.datetime(); (UTC) or None
433
800
    name:       string; from the config file, used in log messages and
434
801
                        D-Bus identifiers
439
806
    runtime_expansions: Allowed attributes for runtime expansion.
440
807
    expires:    datetime.datetime(); time (UTC) when a client will be
441
808
                disabled, or None
 
809
    server_settings: The server_settings dict from main()
442
810
    """
443
811
    
444
812
    runtime_expansions = ("approval_delay", "approval_duration",
446
814
                          "fingerprint", "host", "interval",
447
815
                          "last_approval_request", "last_checked_ok",
448
816
                          "last_enabled", "name", "timeout")
449
 
    client_defaults = { "timeout": "5m",
450
 
                        "extended_timeout": "15m",
451
 
                        "interval": "2m",
452
 
                        "checker": "fping -q -- %%(host)s",
453
 
                        "host": "",
454
 
                        "approval_delay": "0s",
455
 
                        "approval_duration": "1s",
456
 
                        "approved_by_default": "True",
457
 
                        "enabled": "True",
458
 
                        }
459
 
    
460
 
    def timeout_milliseconds(self):
461
 
        "Return the 'timeout' attribute in milliseconds"
462
 
        return timedelta_to_milliseconds(self.timeout)
463
 
    
464
 
    def extended_timeout_milliseconds(self):
465
 
        "Return the 'extended_timeout' attribute in milliseconds"
466
 
        return timedelta_to_milliseconds(self.extended_timeout)
467
 
    
468
 
    def interval_milliseconds(self):
469
 
        "Return the 'interval' attribute in milliseconds"
470
 
        return timedelta_to_milliseconds(self.interval)
471
 
    
472
 
    def approval_delay_milliseconds(self):
473
 
        return timedelta_to_milliseconds(self.approval_delay)
 
817
    client_defaults = {
 
818
        "timeout": "PT5M",
 
819
        "extended_timeout": "PT15M",
 
820
        "interval": "PT2M",
 
821
        "checker": "fping -q -- %%(host)s",
 
822
        "host": "",
 
823
        "approval_delay": "PT0S",
 
824
        "approval_duration": "PT1S",
 
825
        "approved_by_default": "True",
 
826
        "enabled": "True",
 
827
    }
474
828
    
475
829
    @staticmethod
476
830
    def config_parser(config):
492
846
            client["enabled"] = config.getboolean(client_name,
493
847
                                                  "enabled")
494
848
            
 
849
            # Uppercase and remove spaces from fingerprint for later
 
850
            # comparison purposes with return value from the
 
851
            # fingerprint() function
495
852
            client["fingerprint"] = (section["fingerprint"].upper()
496
853
                                     .replace(" ", ""))
497
854
            if "secret" in section:
498
 
                client["secret"] = section["secret"].decode("base64")
 
855
                client["secret"] = codecs.decode(section["secret"]
 
856
                                                 .encode("utf-8"),
 
857
                                                 "base64")
499
858
            elif "secfile" in section:
500
859
                with open(os.path.expanduser(os.path.expandvars
501
860
                                             (section["secfile"])),
502
861
                          "rb") as secfile:
503
862
                    client["secret"] = secfile.read()
504
863
            else:
505
 
                raise TypeError("No secret or secfile for section {0}"
 
864
                raise TypeError("No secret or secfile for section {}"
506
865
                                .format(section))
507
866
            client["timeout"] = string_to_delta(section["timeout"])
508
867
            client["extended_timeout"] = string_to_delta(
519
878
        
520
879
        return settings
521
880
    
522
 
    def __init__(self, settings, name = None):
 
881
    def __init__(self, settings, name = None, server_settings=None):
523
882
        self.name = name
 
883
        if server_settings is None:
 
884
            server_settings = {}
 
885
        self.server_settings = server_settings
524
886
        # adding all client settings
525
 
        for setting, value in settings.iteritems():
 
887
        for setting, value in settings.items():
526
888
            setattr(self, setting, value)
527
889
        
528
890
        if self.enabled:
536
898
            self.expires = None
537
899
        
538
900
        logger.debug("Creating client %r", self.name)
539
 
        # Uppercase and remove spaces from fingerprint for later
540
 
        # comparison purposes with return value from the fingerprint()
541
 
        # function
542
901
        logger.debug("  Fingerprint: %s", self.fingerprint)
543
902
        self.created = settings.get("created",
544
903
                                    datetime.datetime.utcnow())
551
910
        self.current_checker_command = None
552
911
        self.approved = None
553
912
        self.approvals_pending = 0
554
 
        self.changedstate = (multiprocessing_manager
555
 
                             .Condition(multiprocessing_manager
556
 
                                        .Lock()))
557
 
        self.client_structure = [attr for attr in
558
 
                                 self.__dict__.iterkeys()
 
913
        self.changedstate = multiprocessing_manager.Condition(
 
914
            multiprocessing_manager.Lock())
 
915
        self.client_structure = [attr
 
916
                                 for attr in self.__dict__.keys()
559
917
                                 if not attr.startswith("_")]
560
918
        self.client_structure.append("client_structure")
561
919
        
562
 
        for name, t in inspect.getmembers(type(self),
563
 
                                          lambda obj:
564
 
                                              isinstance(obj,
565
 
                                                         property)):
 
920
        for name, t in inspect.getmembers(
 
921
                type(self), lambda obj: isinstance(obj, property)):
566
922
            if not name.startswith("_"):
567
923
                self.client_structure.append(name)
568
924
    
589
945
        if not quiet:
590
946
            logger.info("Disabling client %s", self.name)
591
947
        if getattr(self, "disable_initiator_tag", None) is not None:
592
 
            gobject.source_remove(self.disable_initiator_tag)
 
948
            GLib.source_remove(self.disable_initiator_tag)
593
949
            self.disable_initiator_tag = None
594
950
        self.expires = None
595
951
        if getattr(self, "checker_initiator_tag", None) is not None:
596
 
            gobject.source_remove(self.checker_initiator_tag)
 
952
            GLib.source_remove(self.checker_initiator_tag)
597
953
            self.checker_initiator_tag = None
598
954
        self.stop_checker()
599
955
        self.enabled = False
600
956
        if not quiet:
601
957
            self.send_changedstate()
602
 
        # Do not run this again if called by a gobject.timeout_add
 
958
        # Do not run this again if called by a GLib.timeout_add
603
959
        return False
604
960
    
605
961
    def __del__(self):
609
965
        # Schedule a new checker to be started an 'interval' from now,
610
966
        # and every interval from then on.
611
967
        if self.checker_initiator_tag is not None:
612
 
            gobject.source_remove(self.checker_initiator_tag)
613
 
        self.checker_initiator_tag = (gobject.timeout_add
614
 
                                      (self.interval_milliseconds(),
615
 
                                       self.start_checker))
 
968
            GLib.source_remove(self.checker_initiator_tag)
 
969
        self.checker_initiator_tag = GLib.timeout_add(
 
970
            int(self.interval.total_seconds() * 1000),
 
971
            self.start_checker)
616
972
        # Schedule a disable() when 'timeout' has passed
617
973
        if self.disable_initiator_tag is not None:
618
 
            gobject.source_remove(self.disable_initiator_tag)
619
 
        self.disable_initiator_tag = (gobject.timeout_add
620
 
                                   (self.timeout_milliseconds(),
621
 
                                    self.disable))
 
974
            GLib.source_remove(self.disable_initiator_tag)
 
975
        self.disable_initiator_tag = GLib.timeout_add(
 
976
            int(self.timeout.total_seconds() * 1000), self.disable)
622
977
        # Also start a new checker *right now*.
623
978
        self.start_checker()
624
979
    
625
 
    def checker_callback(self, pid, condition, command):
 
980
    def checker_callback(self, source, condition, connection,
 
981
                         command):
626
982
        """The checker has completed, so take appropriate actions."""
627
983
        self.checker_callback_tag = None
628
984
        self.checker = None
629
 
        if os.WIFEXITED(condition):
630
 
            self.last_checker_status = os.WEXITSTATUS(condition)
 
985
        # Read return code from connection (see call_pipe)
 
986
        returncode = connection.recv()
 
987
        connection.close()
 
988
        
 
989
        if returncode >= 0:
 
990
            self.last_checker_status = returncode
 
991
            self.last_checker_signal = None
631
992
            if self.last_checker_status == 0:
632
993
                logger.info("Checker for %(name)s succeeded",
633
994
                            vars(self))
634
995
                self.checked_ok()
635
996
            else:
636
 
                logger.info("Checker for %(name)s failed",
637
 
                            vars(self))
 
997
                logger.info("Checker for %(name)s failed", vars(self))
638
998
        else:
639
999
            self.last_checker_status = -1
 
1000
            self.last_checker_signal = -returncode
640
1001
            logger.warning("Checker for %(name)s crashed?",
641
1002
                           vars(self))
 
1003
        return False
642
1004
    
643
1005
    def checked_ok(self):
644
1006
        """Assert that the client has been seen, alive and well."""
645
1007
        self.last_checked_ok = datetime.datetime.utcnow()
646
1008
        self.last_checker_status = 0
 
1009
        self.last_checker_signal = None
647
1010
        self.bump_timeout()
648
1011
    
649
1012
    def bump_timeout(self, timeout=None):
651
1014
        if timeout is None:
652
1015
            timeout = self.timeout
653
1016
        if self.disable_initiator_tag is not None:
654
 
            gobject.source_remove(self.disable_initiator_tag)
 
1017
            GLib.source_remove(self.disable_initiator_tag)
655
1018
            self.disable_initiator_tag = None
656
1019
        if getattr(self, "enabled", False):
657
 
            self.disable_initiator_tag = (gobject.timeout_add
658
 
                                          (timedelta_to_milliseconds
659
 
                                           (timeout), self.disable))
 
1020
            self.disable_initiator_tag = GLib.timeout_add(
 
1021
                int(timeout.total_seconds() * 1000), self.disable)
660
1022
            self.expires = datetime.datetime.utcnow() + timeout
661
1023
    
662
1024
    def need_approval(self):
676
1038
        # than 'timeout' for the client to be disabled, which is as it
677
1039
        # should be.
678
1040
        
679
 
        # If a checker exists, make sure it is not a zombie
680
 
        try:
681
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
 
        except (AttributeError, OSError) as error:
683
 
            if (isinstance(error, OSError)
684
 
                and error.errno != errno.ECHILD):
685
 
                raise error
686
 
        else:
687
 
            if pid:
688
 
                logger.warning("Checker was a zombie")
689
 
                gobject.source_remove(self.checker_callback_tag)
690
 
                self.checker_callback(pid, status,
691
 
                                      self.current_checker_command)
 
1041
        if self.checker is not None and not self.checker.is_alive():
 
1042
            logger.warning("Checker was not alive; joining")
 
1043
            self.checker.join()
 
1044
            self.checker = None
692
1045
        # Start a new checker if needed
693
1046
        if self.checker is None:
694
1047
            # Escape attributes for the shell
695
 
            escaped_attrs = dict(
696
 
                (attr, re.escape(unicode(getattr(self, attr))))
697
 
                for attr in
698
 
                self.runtime_expansions)
 
1048
            escaped_attrs = {
 
1049
                attr: re.escape(str(getattr(self, attr)))
 
1050
                for attr in self.runtime_expansions }
699
1051
            try:
700
1052
                command = self.checker_command % escaped_attrs
701
1053
            except TypeError as error:
702
1054
                logger.error('Could not format string "%s"',
703
 
                             self.checker_command, exc_info=error)
704
 
                return True # Try again later
 
1055
                             self.checker_command,
 
1056
                             exc_info=error)
 
1057
                return True     # Try again later
705
1058
            self.current_checker_command = command
706
 
            try:
707
 
                logger.info("Starting checker %r for %s",
708
 
                            command, self.name)
709
 
                # We don't need to redirect stdout and stderr, since
710
 
                # in normal mode, that is already done by daemon(),
711
 
                # and in debug mode we don't want to.  (Stdin is
712
 
                # always replaced by /dev/null.)
713
 
                self.checker = subprocess.Popen(command,
714
 
                                                close_fds=True,
715
 
                                                shell=True, cwd="/")
716
 
            except OSError as error:
717
 
                logger.error("Failed to start subprocess",
718
 
                             exc_info=error)
719
 
            self.checker_callback_tag = (gobject.child_watch_add
720
 
                                         (self.checker.pid,
721
 
                                          self.checker_callback,
722
 
                                          data=command))
723
 
            # The checker may have completed before the gobject
724
 
            # watch was added.  Check for this.
725
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
726
 
            if pid:
727
 
                gobject.source_remove(self.checker_callback_tag)
728
 
                self.checker_callback(pid, status, command)
729
 
        # Re-run this periodically if run by gobject.timeout_add
 
1059
            logger.info("Starting checker %r for %s", command,
 
1060
                        self.name)
 
1061
            # We don't need to redirect stdout and stderr, since
 
1062
            # in normal mode, that is already done by daemon(),
 
1063
            # and in debug mode we don't want to.  (Stdin is
 
1064
            # always replaced by /dev/null.)
 
1065
            # The exception is when not debugging but nevertheless
 
1066
            # running in the foreground; use the previously
 
1067
            # created wnull.
 
1068
            popen_args = { "close_fds": True,
 
1069
                           "shell": True,
 
1070
                           "cwd": "/" }
 
1071
            if (not self.server_settings["debug"]
 
1072
                and self.server_settings["foreground"]):
 
1073
                popen_args.update({"stdout": wnull,
 
1074
                                   "stderr": wnull })
 
1075
            pipe = multiprocessing.Pipe(duplex = False)
 
1076
            self.checker = multiprocessing.Process(
 
1077
                target = call_pipe,
 
1078
                args = (pipe[1], subprocess.call, command),
 
1079
                kwargs = popen_args)
 
1080
            self.checker.start()
 
1081
            self.checker_callback_tag = GLib.io_add_watch(
 
1082
                pipe[0].fileno(), GLib.IO_IN,
 
1083
                self.checker_callback, pipe[0], command)
 
1084
        # Re-run this periodically if run by GLib.timeout_add
730
1085
        return True
731
1086
    
732
1087
    def stop_checker(self):
733
1088
        """Force the checker process, if any, to stop."""
734
1089
        if self.checker_callback_tag:
735
 
            gobject.source_remove(self.checker_callback_tag)
 
1090
            GLib.source_remove(self.checker_callback_tag)
736
1091
            self.checker_callback_tag = None
737
1092
        if getattr(self, "checker", None) is None:
738
1093
            return
739
1094
        logger.debug("Stopping checker for %(name)s", vars(self))
740
 
        try:
741
 
            self.checker.terminate()
742
 
            #time.sleep(0.5)
743
 
            #if self.checker.poll() is None:
744
 
            #    self.checker.kill()
745
 
        except OSError as error:
746
 
            if error.errno != errno.ESRCH: # No such process
747
 
                raise
 
1095
        self.checker.terminate()
748
1096
        self.checker = None
749
1097
 
750
1098
 
751
 
def dbus_service_property(dbus_interface, signature="v",
752
 
                          access="readwrite", byte_arrays=False):
 
1099
def dbus_service_property(dbus_interface,
 
1100
                          signature="v",
 
1101
                          access="readwrite",
 
1102
                          byte_arrays=False):
753
1103
    """Decorators for marking methods of a DBusObjectWithProperties to
754
1104
    become properties on the D-Bus.
755
1105
    
764
1114
    # "Set" method, so we fail early here:
765
1115
    if byte_arrays and signature != "ay":
766
1116
        raise ValueError("Byte arrays not supported for non-'ay'"
767
 
                         " signature {0!r}".format(signature))
 
1117
                         " signature {!r}".format(signature))
 
1118
    
768
1119
    def decorator(func):
769
1120
        func._dbus_is_property = True
770
1121
        func._dbus_interface = dbus_interface
775
1126
            func._dbus_name = func._dbus_name[:-14]
776
1127
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
777
1128
        return func
 
1129
    
778
1130
    return decorator
779
1131
 
780
1132
 
789
1141
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
790
1142
                    "false"}
791
1143
    """
 
1144
    
792
1145
    def decorator(func):
793
1146
        func._dbus_is_interface = True
794
1147
        func._dbus_interface = dbus_interface
795
1148
        func._dbus_name = dbus_interface
796
1149
        return func
 
1150
    
797
1151
    return decorator
798
1152
 
799
1153
 
801
1155
    """Decorator to annotate D-Bus methods, signals or properties
802
1156
    Usage:
803
1157
    
 
1158
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
 
1159
                       "org.freedesktop.DBus.Property."
 
1160
                       "EmitsChangedSignal": "false"})
804
1161
    @dbus_service_property("org.example.Interface", signature="b",
805
1162
                           access="r")
806
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
807
 
                        "org.freedesktop.DBus.Property."
808
 
                        "EmitsChangedSignal": "false"})
809
1163
    def Property_dbus_property(self):
810
1164
        return dbus.Boolean(False)
 
1165
    
 
1166
    See also the DBusObjectWithAnnotations class.
811
1167
    """
 
1168
    
812
1169
    def decorator(func):
813
1170
        func._dbus_annotations = annotations
814
1171
        return func
 
1172
    
815
1173
    return decorator
816
1174
 
817
1175
 
818
1176
class DBusPropertyException(dbus.exceptions.DBusException):
819
1177
    """A base class for D-Bus property-related exceptions
820
1178
    """
821
 
    def __unicode__(self):
822
 
        return unicode(str(self))
 
1179
    pass
823
1180
 
824
1181
 
825
1182
class DBusPropertyAccessException(DBusPropertyException):
834
1191
    pass
835
1192
 
836
1193
 
837
 
class DBusObjectWithProperties(dbus.service.Object):
838
 
    """A D-Bus object with properties.
 
1194
class DBusObjectWithAnnotations(dbus.service.Object):
 
1195
    """A D-Bus object with annotations.
839
1196
    
840
 
    Classes inheriting from this can use the dbus_service_property
841
 
    decorator to expose methods as D-Bus properties.  It exposes the
842
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1197
    Classes inheriting from this can use the dbus_annotations
 
1198
    decorator to add annotations to methods or signals.
843
1199
    """
844
1200
    
845
1201
    @staticmethod
849
1205
        If called like _is_dbus_thing("method") it returns a function
850
1206
        suitable for use as predicate to inspect.getmembers().
851
1207
        """
852
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
1208
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
853
1209
                                   False)
854
1210
    
855
1211
    def _get_all_dbus_things(self, thing):
856
1212
        """Returns a generator of (name, attribute) pairs
857
1213
        """
858
 
        return ((getattr(athing.__get__(self), "_dbus_name",
859
 
                         name),
 
1214
        return ((getattr(athing.__get__(self), "_dbus_name", name),
860
1215
                 athing.__get__(self))
861
1216
                for cls in self.__class__.__mro__
862
1217
                for name, athing in
863
 
                inspect.getmembers(cls,
864
 
                                   self._is_dbus_thing(thing)))
 
1218
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
1219
    
 
1220
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1221
                         out_signature = "s",
 
1222
                         path_keyword = 'object_path',
 
1223
                         connection_keyword = 'connection')
 
1224
    def Introspect(self, object_path, connection):
 
1225
        """Overloading of standard D-Bus method.
 
1226
        
 
1227
        Inserts annotation tags on methods and signals.
 
1228
        """
 
1229
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
1230
                                                   connection)
 
1231
        try:
 
1232
            document = xml.dom.minidom.parseString(xmlstring)
 
1233
            
 
1234
            for if_tag in document.getElementsByTagName("interface"):
 
1235
                # Add annotation tags
 
1236
                for typ in ("method", "signal"):
 
1237
                    for tag in if_tag.getElementsByTagName(typ):
 
1238
                        annots = dict()
 
1239
                        for name, prop in (self.
 
1240
                                           _get_all_dbus_things(typ)):
 
1241
                            if (name == tag.getAttribute("name")
 
1242
                                and prop._dbus_interface
 
1243
                                == if_tag.getAttribute("name")):
 
1244
                                annots.update(getattr(
 
1245
                                    prop, "_dbus_annotations", {}))
 
1246
                        for name, value in annots.items():
 
1247
                            ann_tag = document.createElement(
 
1248
                                "annotation")
 
1249
                            ann_tag.setAttribute("name", name)
 
1250
                            ann_tag.setAttribute("value", value)
 
1251
                            tag.appendChild(ann_tag)
 
1252
                # Add interface annotation tags
 
1253
                for annotation, value in dict(
 
1254
                    itertools.chain.from_iterable(
 
1255
                        annotations().items()
 
1256
                        for name, annotations
 
1257
                        in self._get_all_dbus_things("interface")
 
1258
                        if name == if_tag.getAttribute("name")
 
1259
                        )).items():
 
1260
                    ann_tag = document.createElement("annotation")
 
1261
                    ann_tag.setAttribute("name", annotation)
 
1262
                    ann_tag.setAttribute("value", value)
 
1263
                    if_tag.appendChild(ann_tag)
 
1264
                # Fix argument name for the Introspect method itself
 
1265
                if (if_tag.getAttribute("name")
 
1266
                                == dbus.INTROSPECTABLE_IFACE):
 
1267
                    for cn in if_tag.getElementsByTagName("method"):
 
1268
                        if cn.getAttribute("name") == "Introspect":
 
1269
                            for arg in cn.getElementsByTagName("arg"):
 
1270
                                if (arg.getAttribute("direction")
 
1271
                                    == "out"):
 
1272
                                    arg.setAttribute("name",
 
1273
                                                     "xml_data")
 
1274
            xmlstring = document.toxml("utf-8")
 
1275
            document.unlink()
 
1276
        except (AttributeError, xml.dom.DOMException,
 
1277
                xml.parsers.expat.ExpatError) as error:
 
1278
            logger.error("Failed to override Introspection method",
 
1279
                         exc_info=error)
 
1280
        return xmlstring
 
1281
 
 
1282
 
 
1283
class DBusObjectWithProperties(DBusObjectWithAnnotations):
 
1284
    """A D-Bus object with properties.
 
1285
    
 
1286
    Classes inheriting from this can use the dbus_service_property
 
1287
    decorator to expose methods as D-Bus properties.  It exposes the
 
1288
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1289
    """
865
1290
    
866
1291
    def _get_dbus_property(self, interface_name, property_name):
867
1292
        """Returns a bound method if one exists which is a D-Bus
868
1293
        property with the specified name and interface.
869
1294
        """
870
 
        for cls in  self.__class__.__mro__:
871
 
            for name, value in (inspect.getmembers
872
 
                                (cls,
873
 
                                 self._is_dbus_thing("property"))):
 
1295
        for cls in self.__class__.__mro__:
 
1296
            for name, value in inspect.getmembers(
 
1297
                    cls, self._is_dbus_thing("property")):
874
1298
                if (value._dbus_name == property_name
875
1299
                    and value._dbus_interface == interface_name):
876
1300
                    return value.__get__(self)
877
1301
        
878
1302
        # No such property
879
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
 
                                   + interface_name + "."
881
 
                                   + property_name)
882
 
    
883
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
1303
        raise DBusPropertyNotFound("{}:{}.{}".format(
 
1304
            self.dbus_object_path, interface_name, property_name))
 
1305
    
 
1306
    @classmethod
 
1307
    def _get_all_interface_names(cls):
 
1308
        """Get a sequence of all interfaces supported by an object"""
 
1309
        return (name for name in set(getattr(getattr(x, attr),
 
1310
                                             "_dbus_interface", None)
 
1311
                                     for x in (inspect.getmro(cls))
 
1312
                                     for attr in dir(x))
 
1313
                if name is not None)
 
1314
    
 
1315
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1316
                         in_signature="ss",
884
1317
                         out_signature="v")
885
1318
    def Get(self, interface_name, property_name):
886
1319
        """Standard D-Bus property Get() method, see D-Bus standard.
904
1337
            # The byte_arrays option is not supported yet on
905
1338
            # signatures other than "ay".
906
1339
            if prop._dbus_signature != "ay":
907
 
                raise ValueError
 
1340
                raise ValueError("Byte arrays not supported for non-"
 
1341
                                 "'ay' signature {!r}"
 
1342
                                 .format(prop._dbus_signature))
908
1343
            value = dbus.ByteArray(b''.join(chr(byte)
909
1344
                                            for byte in value))
910
1345
        prop(value)
911
1346
    
912
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
1347
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1348
                         in_signature="s",
913
1349
                         out_signature="a{sv}")
914
1350
    def GetAll(self, interface_name):
915
1351
        """Standard D-Bus property GetAll() method, see D-Bus
930
1366
            if not hasattr(value, "variant_level"):
931
1367
                properties[name] = value
932
1368
                continue
933
 
            properties[name] = type(value)(value, variant_level=
934
 
                                           value.variant_level+1)
 
1369
            properties[name] = type(value)(
 
1370
                value, variant_level = value.variant_level + 1)
935
1371
        return dbus.Dictionary(properties, signature="sv")
936
1372
    
 
1373
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
 
1374
    def PropertiesChanged(self, interface_name, changed_properties,
 
1375
                          invalidated_properties):
 
1376
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
 
1377
        standard.
 
1378
        """
 
1379
        pass
 
1380
    
937
1381
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
938
1382
                         out_signature="s",
939
1383
                         path_keyword='object_path',
943
1387
        
944
1388
        Inserts property tags and interface annotation tags.
945
1389
        """
946
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
947
 
                                                   connection)
 
1390
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1391
                                                         object_path,
 
1392
                                                         connection)
948
1393
        try:
949
1394
            document = xml.dom.minidom.parseString(xmlstring)
 
1395
            
950
1396
            def make_tag(document, name, prop):
951
1397
                e = document.createElement("property")
952
1398
                e.setAttribute("name", name)
953
1399
                e.setAttribute("type", prop._dbus_signature)
954
1400
                e.setAttribute("access", prop._dbus_access)
955
1401
                return e
 
1402
            
956
1403
            for if_tag in document.getElementsByTagName("interface"):
957
1404
                # Add property tags
958
1405
                for tag in (make_tag(document, name, prop)
961
1408
                            if prop._dbus_interface
962
1409
                            == if_tag.getAttribute("name")):
963
1410
                    if_tag.appendChild(tag)
964
 
                # Add annotation tags
965
 
                for typ in ("method", "signal", "property"):
966
 
                    for tag in if_tag.getElementsByTagName(typ):
967
 
                        annots = dict()
968
 
                        for name, prop in (self.
969
 
                                           _get_all_dbus_things(typ)):
970
 
                            if (name == tag.getAttribute("name")
971
 
                                and prop._dbus_interface
972
 
                                == if_tag.getAttribute("name")):
973
 
                                annots.update(getattr
974
 
                                              (prop,
975
 
                                               "_dbus_annotations",
976
 
                                               {}))
977
 
                        for name, value in annots.iteritems():
978
 
                            ann_tag = document.createElement(
979
 
                                "annotation")
980
 
                            ann_tag.setAttribute("name", name)
981
 
                            ann_tag.setAttribute("value", value)
982
 
                            tag.appendChild(ann_tag)
983
 
                # Add interface annotation tags
984
 
                for annotation, value in dict(
985
 
                    itertools.chain.from_iterable(
986
 
                        annotations().iteritems()
987
 
                        for name, annotations in
988
 
                        self._get_all_dbus_things("interface")
989
 
                        if name == if_tag.getAttribute("name")
990
 
                        )).iteritems():
991
 
                    ann_tag = document.createElement("annotation")
992
 
                    ann_tag.setAttribute("name", annotation)
993
 
                    ann_tag.setAttribute("value", value)
994
 
                    if_tag.appendChild(ann_tag)
 
1411
                # Add annotation tags for properties
 
1412
                for tag in if_tag.getElementsByTagName("property"):
 
1413
                    annots = dict()
 
1414
                    for name, prop in self._get_all_dbus_things(
 
1415
                            "property"):
 
1416
                        if (name == tag.getAttribute("name")
 
1417
                            and prop._dbus_interface
 
1418
                            == if_tag.getAttribute("name")):
 
1419
                            annots.update(getattr(
 
1420
                                prop, "_dbus_annotations", {}))
 
1421
                    for name, value in annots.items():
 
1422
                        ann_tag = document.createElement(
 
1423
                            "annotation")
 
1424
                        ann_tag.setAttribute("name", name)
 
1425
                        ann_tag.setAttribute("value", value)
 
1426
                        tag.appendChild(ann_tag)
995
1427
                # Add the names to the return values for the
996
1428
                # "org.freedesktop.DBus.Properties" methods
997
1429
                if (if_tag.getAttribute("name")
1015
1447
                         exc_info=error)
1016
1448
        return xmlstring
1017
1449
 
 
1450
try:
 
1451
    dbus.OBJECT_MANAGER_IFACE
 
1452
except AttributeError:
 
1453
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
 
1454
 
 
1455
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
 
1456
    """A D-Bus object with an ObjectManager.
 
1457
    
 
1458
    Classes inheriting from this exposes the standard
 
1459
    GetManagedObjects call and the InterfacesAdded and
 
1460
    InterfacesRemoved signals on the standard
 
1461
    "org.freedesktop.DBus.ObjectManager" interface.
 
1462
    
 
1463
    Note: No signals are sent automatically; they must be sent
 
1464
    manually.
 
1465
    """
 
1466
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
1467
                         out_signature = "a{oa{sa{sv}}}")
 
1468
    def GetManagedObjects(self):
 
1469
        """This function must be overridden"""
 
1470
        raise NotImplementedError()
 
1471
    
 
1472
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
 
1473
                         signature = "oa{sa{sv}}")
 
1474
    def InterfacesAdded(self, object_path, interfaces_and_properties):
 
1475
        pass
 
1476
    
 
1477
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
 
1478
    def InterfacesRemoved(self, object_path, interfaces):
 
1479
        pass
 
1480
    
 
1481
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1482
                         out_signature = "s",
 
1483
                         path_keyword = 'object_path',
 
1484
                         connection_keyword = 'connection')
 
1485
    def Introspect(self, object_path, connection):
 
1486
        """Overloading of standard D-Bus method.
 
1487
        
 
1488
        Override return argument name of GetManagedObjects to be
 
1489
        "objpath_interfaces_and_properties"
 
1490
        """
 
1491
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1492
                                                         object_path,
 
1493
                                                         connection)
 
1494
        try:
 
1495
            document = xml.dom.minidom.parseString(xmlstring)
 
1496
            
 
1497
            for if_tag in document.getElementsByTagName("interface"):
 
1498
                # Fix argument name for the GetManagedObjects method
 
1499
                if (if_tag.getAttribute("name")
 
1500
                                == dbus.OBJECT_MANAGER_IFACE):
 
1501
                    for cn in if_tag.getElementsByTagName("method"):
 
1502
                        if (cn.getAttribute("name")
 
1503
                            == "GetManagedObjects"):
 
1504
                            for arg in cn.getElementsByTagName("arg"):
 
1505
                                if (arg.getAttribute("direction")
 
1506
                                    == "out"):
 
1507
                                    arg.setAttribute(
 
1508
                                        "name",
 
1509
                                        "objpath_interfaces"
 
1510
                                        "_and_properties")
 
1511
            xmlstring = document.toxml("utf-8")
 
1512
            document.unlink()
 
1513
        except (AttributeError, xml.dom.DOMException,
 
1514
                xml.parsers.expat.ExpatError) as error:
 
1515
            logger.error("Failed to override Introspection method",
 
1516
                         exc_info = error)
 
1517
        return xmlstring
1018
1518
 
1019
1519
def datetime_to_dbus(dt, variant_level=0):
1020
1520
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1021
1521
    if dt is None:
1022
1522
        return dbus.String("", variant_level = variant_level)
1023
 
    return dbus.String(dt.isoformat(),
1024
 
                       variant_level=variant_level)
 
1523
    return dbus.String(dt.isoformat(), variant_level=variant_level)
1025
1524
 
1026
1525
 
1027
1526
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1047
1546
    (from DBusObjectWithProperties) and interfaces (from the
1048
1547
    dbus_interface_annotations decorator).
1049
1548
    """
 
1549
    
1050
1550
    def wrapper(cls):
1051
1551
        for orig_interface_name, alt_interface_name in (
1052
 
            alt_interface_names.iteritems()):
 
1552
                alt_interface_names.items()):
1053
1553
            attr = {}
1054
1554
            interface_names = set()
1055
1555
            # Go though all attributes of the class
1057
1557
                # Ignore non-D-Bus attributes, and D-Bus attributes
1058
1558
                # with the wrong interface name
1059
1559
                if (not hasattr(attribute, "_dbus_interface")
1060
 
                    or not attribute._dbus_interface
1061
 
                    .startswith(orig_interface_name)):
 
1560
                    or not attribute._dbus_interface.startswith(
 
1561
                        orig_interface_name)):
1062
1562
                    continue
1063
1563
                # Create an alternate D-Bus interface name based on
1064
1564
                # the current name
1065
 
                alt_interface = (attribute._dbus_interface
1066
 
                                 .replace(orig_interface_name,
1067
 
                                          alt_interface_name))
 
1565
                alt_interface = attribute._dbus_interface.replace(
 
1566
                    orig_interface_name, alt_interface_name)
1068
1567
                interface_names.add(alt_interface)
1069
1568
                # Is this a D-Bus signal?
1070
1569
                if getattr(attribute, "_dbus_is_signal", False):
1071
 
                    # Extract the original non-method function by
1072
 
                    # black magic
1073
 
                    nonmethod_func = (dict(
 
1570
                    # Extract the original non-method undecorated
 
1571
                    # function by black magic
 
1572
                    if sys.version_info.major == 2:
 
1573
                        nonmethod_func = (dict(
1074
1574
                            zip(attribute.func_code.co_freevars,
1075
 
                                attribute.__closure__))["func"]
1076
 
                                      .cell_contents)
 
1575
                                attribute.__closure__))
 
1576
                                          ["func"].cell_contents)
 
1577
                    else:
 
1578
                        nonmethod_func = (dict(
 
1579
                            zip(attribute.__code__.co_freevars,
 
1580
                                attribute.__closure__))
 
1581
                                          ["func"].cell_contents)
1077
1582
                    # Create a new, but exactly alike, function
1078
1583
                    # object, and decorate it to be a new D-Bus signal
1079
1584
                    # with the alternate D-Bus interface name
1080
 
                    new_function = (dbus.service.signal
1081
 
                                    (alt_interface,
1082
 
                                     attribute._dbus_signature)
1083
 
                                    (types.FunctionType(
1084
 
                                nonmethod_func.func_code,
1085
 
                                nonmethod_func.func_globals,
1086
 
                                nonmethod_func.func_name,
1087
 
                                nonmethod_func.func_defaults,
1088
 
                                nonmethod_func.func_closure)))
 
1585
                    new_function = copy_function(nonmethod_func)
 
1586
                    new_function = (dbus.service.signal(
 
1587
                        alt_interface,
 
1588
                        attribute._dbus_signature)(new_function))
1089
1589
                    # Copy annotations, if any
1090
1590
                    try:
1091
 
                        new_function._dbus_annotations = (
1092
 
                            dict(attribute._dbus_annotations))
 
1591
                        new_function._dbus_annotations = dict(
 
1592
                            attribute._dbus_annotations)
1093
1593
                    except AttributeError:
1094
1594
                        pass
1095
1595
                    # Define a creator of a function to call both the
1100
1600
                        """This function is a scope container to pass
1101
1601
                        func1 and func2 to the "call_both" function
1102
1602
                        outside of its arguments"""
 
1603
                        
 
1604
                        @functools.wraps(func2)
1103
1605
                        def call_both(*args, **kwargs):
1104
1606
                            """This function will emit two D-Bus
1105
1607
                            signals by calling func1 and func2"""
1106
1608
                            func1(*args, **kwargs)
1107
1609
                            func2(*args, **kwargs)
 
1610
                        # Make wrapper function look like a D-Bus signal
 
1611
                        for name, attr in inspect.getmembers(func2):
 
1612
                            if name.startswith("_dbus_"):
 
1613
                                setattr(call_both, name, attr)
 
1614
                        
1108
1615
                        return call_both
1109
1616
                    # Create the "call_both" function and add it to
1110
1617
                    # the class
1115
1622
                    # object.  Decorate it to be a new D-Bus method
1116
1623
                    # with the alternate D-Bus interface name.  Add it
1117
1624
                    # to the class.
1118
 
                    attr[attrname] = (dbus.service.method
1119
 
                                      (alt_interface,
1120
 
                                       attribute._dbus_in_signature,
1121
 
                                       attribute._dbus_out_signature)
1122
 
                                      (types.FunctionType
1123
 
                                       (attribute.func_code,
1124
 
                                        attribute.func_globals,
1125
 
                                        attribute.func_name,
1126
 
                                        attribute.func_defaults,
1127
 
                                        attribute.func_closure)))
 
1625
                    attr[attrname] = (
 
1626
                        dbus.service.method(
 
1627
                            alt_interface,
 
1628
                            attribute._dbus_in_signature,
 
1629
                            attribute._dbus_out_signature)
 
1630
                        (copy_function(attribute)))
1128
1631
                    # Copy annotations, if any
1129
1632
                    try:
1130
 
                        attr[attrname]._dbus_annotations = (
1131
 
                            dict(attribute._dbus_annotations))
 
1633
                        attr[attrname]._dbus_annotations = dict(
 
1634
                            attribute._dbus_annotations)
1132
1635
                    except AttributeError:
1133
1636
                        pass
1134
1637
                # Is this a D-Bus property?
1137
1640
                    # object, and decorate it to be a new D-Bus
1138
1641
                    # property with the alternate D-Bus interface
1139
1642
                    # name.  Add it to the class.
1140
 
                    attr[attrname] = (dbus_service_property
1141
 
                                      (alt_interface,
1142
 
                                       attribute._dbus_signature,
1143
 
                                       attribute._dbus_access,
1144
 
                                       attribute
1145
 
                                       ._dbus_get_args_options
1146
 
                                       ["byte_arrays"])
1147
 
                                      (types.FunctionType
1148
 
                                       (attribute.func_code,
1149
 
                                        attribute.func_globals,
1150
 
                                        attribute.func_name,
1151
 
                                        attribute.func_defaults,
1152
 
                                        attribute.func_closure)))
 
1643
                    attr[attrname] = (dbus_service_property(
 
1644
                        alt_interface, attribute._dbus_signature,
 
1645
                        attribute._dbus_access,
 
1646
                        attribute._dbus_get_args_options
 
1647
                        ["byte_arrays"])
 
1648
                                      (copy_function(attribute)))
1153
1649
                    # Copy annotations, if any
1154
1650
                    try:
1155
 
                        attr[attrname]._dbus_annotations = (
1156
 
                            dict(attribute._dbus_annotations))
 
1651
                        attr[attrname]._dbus_annotations = dict(
 
1652
                            attribute._dbus_annotations)
1157
1653
                    except AttributeError:
1158
1654
                        pass
1159
1655
                # Is this a D-Bus interface?
1162
1658
                    # object.  Decorate it to be a new D-Bus interface
1163
1659
                    # with the alternate D-Bus interface name.  Add it
1164
1660
                    # to the class.
1165
 
                    attr[attrname] = (dbus_interface_annotations
1166
 
                                      (alt_interface)
1167
 
                                      (types.FunctionType
1168
 
                                       (attribute.func_code,
1169
 
                                        attribute.func_globals,
1170
 
                                        attribute.func_name,
1171
 
                                        attribute.func_defaults,
1172
 
                                        attribute.func_closure)))
 
1661
                    attr[attrname] = (
 
1662
                        dbus_interface_annotations(alt_interface)
 
1663
                        (copy_function(attribute)))
1173
1664
            if deprecate:
1174
1665
                # Deprecate all alternate interfaces
1175
 
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1666
                iname="_AlternateDBusNames_interface_annotation{}"
1176
1667
                for interface_name in interface_names:
 
1668
                    
1177
1669
                    @dbus_interface_annotations(interface_name)
1178
1670
                    def func(self):
1179
1671
                        return { "org.freedesktop.DBus.Deprecated":
1180
 
                                     "true" }
 
1672
                                 "true" }
1181
1673
                    # Find an unused name
1182
1674
                    for aname in (iname.format(i)
1183
1675
                                  for i in itertools.count()):
1187
1679
            if interface_names:
1188
1680
                # Replace the class with a new subclass of it with
1189
1681
                # methods, signals, etc. as created above.
1190
 
                cls = type(b"{0}Alternate".format(cls.__name__),
1191
 
                           (cls,), attr)
 
1682
                if sys.version_info.major == 2:
 
1683
                    cls = type(b"{}Alternate".format(cls.__name__),
 
1684
                               (cls, ), attr)
 
1685
                else:
 
1686
                    cls = type("{}Alternate".format(cls.__name__),
 
1687
                               (cls, ), attr)
1192
1688
        return cls
 
1689
    
1193
1690
    return wrapper
1194
1691
 
1195
1692
 
1196
1693
@alternate_dbus_interfaces({"se.recompile.Mandos":
1197
 
                                "se.bsnet.fukt.Mandos"})
 
1694
                            "se.bsnet.fukt.Mandos"})
1198
1695
class ClientDBus(Client, DBusObjectWithProperties):
1199
1696
    """A Client class using D-Bus
1200
1697
    
1204
1701
    """
1205
1702
    
1206
1703
    runtime_expansions = (Client.runtime_expansions
1207
 
                          + ("dbus_object_path",))
 
1704
                          + ("dbus_object_path", ))
 
1705
    
 
1706
    _interface = "se.recompile.Mandos.Client"
1208
1707
    
1209
1708
    # dbus.service.Object doesn't use super(), so we can't either.
1210
1709
    
1213
1712
        Client.__init__(self, *args, **kwargs)
1214
1713
        # Only now, when this client is initialized, can it show up on
1215
1714
        # the D-Bus
1216
 
        client_object_name = unicode(self.name).translate(
 
1715
        client_object_name = str(self.name).translate(
1217
1716
            {ord("."): ord("_"),
1218
1717
             ord("-"): ord("_")})
1219
 
        self.dbus_object_path = (dbus.ObjectPath
1220
 
                                 ("/clients/" + client_object_name))
 
1718
        self.dbus_object_path = dbus.ObjectPath(
 
1719
            "/clients/" + client_object_name)
1221
1720
        DBusObjectWithProperties.__init__(self, self.bus,
1222
1721
                                          self.dbus_object_path)
1223
1722
    
1224
 
    def notifychangeproperty(transform_func,
1225
 
                             dbus_name, type_func=lambda x: x,
1226
 
                             variant_level=1):
 
1723
    def notifychangeproperty(transform_func, dbus_name,
 
1724
                             type_func=lambda x: x,
 
1725
                             variant_level=1,
 
1726
                             invalidate_only=False,
 
1727
                             _interface=_interface):
1227
1728
        """ Modify a variable so that it's a property which announces
1228
1729
        its changes to DBus.
1229
1730
        
1234
1735
                   to the D-Bus.  Default: no transform
1235
1736
        variant_level: D-Bus variant level.  Default: 1
1236
1737
        """
1237
 
        attrname = "_{0}".format(dbus_name)
 
1738
        attrname = "_{}".format(dbus_name)
 
1739
        
1238
1740
        def setter(self, value):
1239
1741
            if hasattr(self, "dbus_object_path"):
1240
1742
                if (not hasattr(self, attrname) or
1241
1743
                    type_func(getattr(self, attrname, None))
1242
1744
                    != type_func(value)):
1243
 
                    dbus_value = transform_func(type_func(value),
1244
 
                                                variant_level
1245
 
                                                =variant_level)
1246
 
                    self.PropertyChanged(dbus.String(dbus_name),
1247
 
                                         dbus_value)
 
1745
                    if invalidate_only:
 
1746
                        self.PropertiesChanged(
 
1747
                            _interface, dbus.Dictionary(),
 
1748
                            dbus.Array((dbus_name, )))
 
1749
                    else:
 
1750
                        dbus_value = transform_func(
 
1751
                            type_func(value),
 
1752
                            variant_level = variant_level)
 
1753
                        self.PropertyChanged(dbus.String(dbus_name),
 
1754
                                             dbus_value)
 
1755
                        self.PropertiesChanged(
 
1756
                            _interface,
 
1757
                            dbus.Dictionary({ dbus.String(dbus_name):
 
1758
                                              dbus_value }),
 
1759
                            dbus.Array())
1248
1760
            setattr(self, attrname, value)
1249
1761
        
1250
1762
        return property(lambda self: getattr(self, attrname), setter)
1256
1768
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1257
1769
    last_enabled = notifychangeproperty(datetime_to_dbus,
1258
1770
                                        "LastEnabled")
1259
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1260
 
                                   type_func = lambda checker:
1261
 
                                       checker is not None)
 
1771
    checker = notifychangeproperty(
 
1772
        dbus.Boolean, "CheckerRunning",
 
1773
        type_func = lambda checker: checker is not None)
1262
1774
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1263
1775
                                           "LastCheckedOK")
1264
1776
    last_checker_status = notifychangeproperty(dbus.Int16,
1267
1779
        datetime_to_dbus, "LastApprovalRequest")
1268
1780
    approved_by_default = notifychangeproperty(dbus.Boolean,
1269
1781
                                               "ApprovedByDefault")
1270
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1271
 
                                          "ApprovalDelay",
1272
 
                                          type_func =
1273
 
                                          timedelta_to_milliseconds)
 
1782
    approval_delay = notifychangeproperty(
 
1783
        dbus.UInt64, "ApprovalDelay",
 
1784
        type_func = lambda td: td.total_seconds() * 1000)
1274
1785
    approval_duration = notifychangeproperty(
1275
1786
        dbus.UInt64, "ApprovalDuration",
1276
 
        type_func = timedelta_to_milliseconds)
 
1787
        type_func = lambda td: td.total_seconds() * 1000)
1277
1788
    host = notifychangeproperty(dbus.String, "Host")
1278
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1279
 
                                   type_func =
1280
 
                                   timedelta_to_milliseconds)
 
1789
    timeout = notifychangeproperty(
 
1790
        dbus.UInt64, "Timeout",
 
1791
        type_func = lambda td: td.total_seconds() * 1000)
1281
1792
    extended_timeout = notifychangeproperty(
1282
1793
        dbus.UInt64, "ExtendedTimeout",
1283
 
        type_func = timedelta_to_milliseconds)
1284
 
    interval = notifychangeproperty(dbus.UInt64,
1285
 
                                    "Interval",
1286
 
                                    type_func =
1287
 
                                    timedelta_to_milliseconds)
 
1794
        type_func = lambda td: td.total_seconds() * 1000)
 
1795
    interval = notifychangeproperty(
 
1796
        dbus.UInt64, "Interval",
 
1797
        type_func = lambda td: td.total_seconds() * 1000)
1288
1798
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1799
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
 
1800
                                  invalidate_only=True)
1289
1801
    
1290
1802
    del notifychangeproperty
1291
1803
    
1298
1810
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1299
1811
        Client.__del__(self, *args, **kwargs)
1300
1812
    
1301
 
    def checker_callback(self, pid, condition, command,
1302
 
                         *args, **kwargs):
1303
 
        self.checker_callback_tag = None
1304
 
        self.checker = None
1305
 
        if os.WIFEXITED(condition):
1306
 
            exitstatus = os.WEXITSTATUS(condition)
 
1813
    def checker_callback(self, source, condition,
 
1814
                         connection, command, *args, **kwargs):
 
1815
        ret = Client.checker_callback(self, source, condition,
 
1816
                                      connection, command, *args,
 
1817
                                      **kwargs)
 
1818
        exitstatus = self.last_checker_status
 
1819
        if exitstatus >= 0:
1307
1820
            # Emit D-Bus signal
1308
1821
            self.CheckerCompleted(dbus.Int16(exitstatus),
1309
 
                                  dbus.Int64(condition),
 
1822
                                  # This is specific to GNU libC
 
1823
                                  dbus.Int64(exitstatus << 8),
1310
1824
                                  dbus.String(command))
1311
1825
        else:
1312
1826
            # Emit D-Bus signal
1313
1827
            self.CheckerCompleted(dbus.Int16(-1),
1314
 
                                  dbus.Int64(condition),
 
1828
                                  dbus.Int64(
 
1829
                                      # This is specific to GNU libC
 
1830
                                      (exitstatus << 8)
 
1831
                                      | self.last_checker_signal),
1315
1832
                                  dbus.String(command))
1316
 
        
1317
 
        return Client.checker_callback(self, pid, condition, command,
1318
 
                                       *args, **kwargs)
 
1833
        return ret
1319
1834
    
1320
1835
    def start_checker(self, *args, **kwargs):
1321
 
        old_checker = self.checker
1322
 
        if self.checker is not None:
1323
 
            old_checker_pid = self.checker.pid
1324
 
        else:
1325
 
            old_checker_pid = None
 
1836
        old_checker_pid = getattr(self.checker, "pid", None)
1326
1837
        r = Client.start_checker(self, *args, **kwargs)
1327
1838
        # Only if new checker process was started
1328
1839
        if (self.checker is not None
1337
1848
    
1338
1849
    def approve(self, value=True):
1339
1850
        self.approved = value
1340
 
        gobject.timeout_add(timedelta_to_milliseconds
1341
 
                            (self.approval_duration),
1342
 
                            self._reset_approved)
 
1851
        GLib.timeout_add(int(self.approval_duration.total_seconds()
 
1852
                             * 1000), self._reset_approved)
1343
1853
        self.send_changedstate()
1344
1854
    
1345
1855
    ## D-Bus methods, signals & properties
1346
 
    _interface = "se.recompile.Mandos.Client"
1347
1856
    
1348
1857
    ## Interfaces
1349
1858
    
1350
 
    @dbus_interface_annotations(_interface)
1351
 
    def _foo(self):
1352
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1353
 
                     "false"}
1354
 
    
1355
1859
    ## Signals
1356
1860
    
1357
1861
    # CheckerCompleted - signal
1367
1871
        pass
1368
1872
    
1369
1873
    # PropertyChanged - signal
 
1874
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1370
1875
    @dbus.service.signal(_interface, signature="sv")
1371
1876
    def PropertyChanged(self, property, value):
1372
1877
        "D-Bus signal"
1406
1911
        self.checked_ok()
1407
1912
    
1408
1913
    # Enable - method
 
1914
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1409
1915
    @dbus.service.method(_interface)
1410
1916
    def Enable(self):
1411
1917
        "D-Bus method"
1412
1918
        self.enable()
1413
1919
    
1414
1920
    # StartChecker - method
 
1921
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1415
1922
    @dbus.service.method(_interface)
1416
1923
    def StartChecker(self):
1417
1924
        "D-Bus method"
1418
1925
        self.start_checker()
1419
1926
    
1420
1927
    # Disable - method
 
1928
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1421
1929
    @dbus.service.method(_interface)
1422
1930
    def Disable(self):
1423
1931
        "D-Bus method"
1424
1932
        self.disable()
1425
1933
    
1426
1934
    # StopChecker - method
 
1935
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1427
1936
    @dbus.service.method(_interface)
1428
1937
    def StopChecker(self):
1429
1938
        self.stop_checker()
1436
1945
        return dbus.Boolean(bool(self.approvals_pending))
1437
1946
    
1438
1947
    # ApprovedByDefault - property
1439
 
    @dbus_service_property(_interface, signature="b",
 
1948
    @dbus_service_property(_interface,
 
1949
                           signature="b",
1440
1950
                           access="readwrite")
1441
1951
    def ApprovedByDefault_dbus_property(self, value=None):
1442
1952
        if value is None:       # get
1444
1954
        self.approved_by_default = bool(value)
1445
1955
    
1446
1956
    # ApprovalDelay - property
1447
 
    @dbus_service_property(_interface, signature="t",
 
1957
    @dbus_service_property(_interface,
 
1958
                           signature="t",
1448
1959
                           access="readwrite")
1449
1960
    def ApprovalDelay_dbus_property(self, value=None):
1450
1961
        if value is None:       # get
1451
 
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1962
            return dbus.UInt64(self.approval_delay.total_seconds()
 
1963
                               * 1000)
1452
1964
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1453
1965
    
1454
1966
    # ApprovalDuration - property
1455
 
    @dbus_service_property(_interface, signature="t",
 
1967
    @dbus_service_property(_interface,
 
1968
                           signature="t",
1456
1969
                           access="readwrite")
1457
1970
    def ApprovalDuration_dbus_property(self, value=None):
1458
1971
        if value is None:       # get
1459
 
            return dbus.UInt64(timedelta_to_milliseconds(
1460
 
                    self.approval_duration))
 
1972
            return dbus.UInt64(self.approval_duration.total_seconds()
 
1973
                               * 1000)
1461
1974
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1462
1975
    
1463
1976
    # Name - property
 
1977
    @dbus_annotations(
 
1978
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1464
1979
    @dbus_service_property(_interface, signature="s", access="read")
1465
1980
    def Name_dbus_property(self):
1466
1981
        return dbus.String(self.name)
1467
1982
    
1468
1983
    # Fingerprint - property
 
1984
    @dbus_annotations(
 
1985
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1469
1986
    @dbus_service_property(_interface, signature="s", access="read")
1470
1987
    def Fingerprint_dbus_property(self):
1471
1988
        return dbus.String(self.fingerprint)
1472
1989
    
1473
1990
    # Host - property
1474
 
    @dbus_service_property(_interface, signature="s",
 
1991
    @dbus_service_property(_interface,
 
1992
                           signature="s",
1475
1993
                           access="readwrite")
1476
1994
    def Host_dbus_property(self, value=None):
1477
1995
        if value is None:       # get
1478
1996
            return dbus.String(self.host)
1479
 
        self.host = unicode(value)
 
1997
        self.host = str(value)
1480
1998
    
1481
1999
    # Created - property
 
2000
    @dbus_annotations(
 
2001
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1482
2002
    @dbus_service_property(_interface, signature="s", access="read")
1483
2003
    def Created_dbus_property(self):
1484
2004
        return datetime_to_dbus(self.created)
1489
2009
        return datetime_to_dbus(self.last_enabled)
1490
2010
    
1491
2011
    # Enabled - property
1492
 
    @dbus_service_property(_interface, signature="b",
 
2012
    @dbus_service_property(_interface,
 
2013
                           signature="b",
1493
2014
                           access="readwrite")
1494
2015
    def Enabled_dbus_property(self, value=None):
1495
2016
        if value is None:       # get
1500
2021
            self.disable()
1501
2022
    
1502
2023
    # LastCheckedOK - property
1503
 
    @dbus_service_property(_interface, signature="s",
 
2024
    @dbus_service_property(_interface,
 
2025
                           signature="s",
1504
2026
                           access="readwrite")
1505
2027
    def LastCheckedOK_dbus_property(self, value=None):
1506
2028
        if value is not None:
1509
2031
        return datetime_to_dbus(self.last_checked_ok)
1510
2032
    
1511
2033
    # LastCheckerStatus - property
1512
 
    @dbus_service_property(_interface, signature="n",
1513
 
                           access="read")
 
2034
    @dbus_service_property(_interface, signature="n", access="read")
1514
2035
    def LastCheckerStatus_dbus_property(self):
1515
2036
        return dbus.Int16(self.last_checker_status)
1516
2037
    
1525
2046
        return datetime_to_dbus(self.last_approval_request)
1526
2047
    
1527
2048
    # Timeout - property
1528
 
    @dbus_service_property(_interface, signature="t",
 
2049
    @dbus_service_property(_interface,
 
2050
                           signature="t",
1529
2051
                           access="readwrite")
1530
2052
    def Timeout_dbus_property(self, value=None):
1531
2053
        if value is None:       # get
1532
 
            return dbus.UInt64(self.timeout_milliseconds())
 
2054
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
1533
2055
        old_timeout = self.timeout
1534
2056
        self.timeout = datetime.timedelta(0, 0, 0, value)
1535
2057
        # Reschedule disabling
1543
2065
                if (getattr(self, "disable_initiator_tag", None)
1544
2066
                    is None):
1545
2067
                    return
1546
 
                gobject.source_remove(self.disable_initiator_tag)
1547
 
                self.disable_initiator_tag = (
1548
 
                    gobject.timeout_add(
1549
 
                        timedelta_to_milliseconds(self.expires - now),
1550
 
                        self.disable))
 
2068
                GLib.source_remove(self.disable_initiator_tag)
 
2069
                self.disable_initiator_tag = GLib.timeout_add(
 
2070
                    int((self.expires - now).total_seconds() * 1000),
 
2071
                    self.disable)
1551
2072
    
1552
2073
    # ExtendedTimeout - property
1553
 
    @dbus_service_property(_interface, signature="t",
 
2074
    @dbus_service_property(_interface,
 
2075
                           signature="t",
1554
2076
                           access="readwrite")
1555
2077
    def ExtendedTimeout_dbus_property(self, value=None):
1556
2078
        if value is None:       # get
1557
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
2079
            return dbus.UInt64(self.extended_timeout.total_seconds()
 
2080
                               * 1000)
1558
2081
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1559
2082
    
1560
2083
    # Interval - property
1561
 
    @dbus_service_property(_interface, signature="t",
 
2084
    @dbus_service_property(_interface,
 
2085
                           signature="t",
1562
2086
                           access="readwrite")
1563
2087
    def Interval_dbus_property(self, value=None):
1564
2088
        if value is None:       # get
1565
 
            return dbus.UInt64(self.interval_milliseconds())
 
2089
            return dbus.UInt64(self.interval.total_seconds() * 1000)
1566
2090
        self.interval = datetime.timedelta(0, 0, 0, value)
1567
2091
        if getattr(self, "checker_initiator_tag", None) is None:
1568
2092
            return
1569
2093
        if self.enabled:
1570
2094
            # Reschedule checker run
1571
 
            gobject.source_remove(self.checker_initiator_tag)
1572
 
            self.checker_initiator_tag = (gobject.timeout_add
1573
 
                                          (value, self.start_checker))
1574
 
            self.start_checker()    # Start one now, too
 
2095
            GLib.source_remove(self.checker_initiator_tag)
 
2096
            self.checker_initiator_tag = GLib.timeout_add(
 
2097
                value, self.start_checker)
 
2098
            self.start_checker() # Start one now, too
1575
2099
    
1576
2100
    # Checker - property
1577
 
    @dbus_service_property(_interface, signature="s",
 
2101
    @dbus_service_property(_interface,
 
2102
                           signature="s",
1578
2103
                           access="readwrite")
1579
2104
    def Checker_dbus_property(self, value=None):
1580
2105
        if value is None:       # get
1581
2106
            return dbus.String(self.checker_command)
1582
 
        self.checker_command = unicode(value)
 
2107
        self.checker_command = str(value)
1583
2108
    
1584
2109
    # CheckerRunning - property
1585
 
    @dbus_service_property(_interface, signature="b",
 
2110
    @dbus_service_property(_interface,
 
2111
                           signature="b",
1586
2112
                           access="readwrite")
1587
2113
    def CheckerRunning_dbus_property(self, value=None):
1588
2114
        if value is None:       # get
1593
2119
            self.stop_checker()
1594
2120
    
1595
2121
    # ObjectPath - property
 
2122
    @dbus_annotations(
 
2123
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
 
2124
         "org.freedesktop.DBus.Deprecated": "true"})
1596
2125
    @dbus_service_property(_interface, signature="o", access="read")
1597
2126
    def ObjectPath_dbus_property(self):
1598
2127
        return self.dbus_object_path # is already a dbus.ObjectPath
1599
2128
    
1600
2129
    # Secret = property
1601
 
    @dbus_service_property(_interface, signature="ay",
1602
 
                           access="write", byte_arrays=True)
 
2130
    @dbus_annotations(
 
2131
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
 
2132
         "invalidates"})
 
2133
    @dbus_service_property(_interface,
 
2134
                           signature="ay",
 
2135
                           access="write",
 
2136
                           byte_arrays=True)
1603
2137
    def Secret_dbus_property(self, value):
1604
 
        self.secret = str(value)
 
2138
        self.secret = bytes(value)
1605
2139
    
1606
2140
    del _interface
1607
2141
 
1611
2145
        self._pipe = child_pipe
1612
2146
        self._pipe.send(('init', fpr, address))
1613
2147
        if not self._pipe.recv():
1614
 
            raise KeyError()
 
2148
            raise KeyError(fpr)
1615
2149
    
1616
2150
    def __getattribute__(self, name):
1617
2151
        if name == '_pipe':
1621
2155
        if data[0] == 'data':
1622
2156
            return data[1]
1623
2157
        if data[0] == 'function':
 
2158
            
1624
2159
            def func(*args, **kwargs):
1625
2160
                self._pipe.send(('funcall', name, args, kwargs))
1626
2161
                return self._pipe.recv()[1]
 
2162
            
1627
2163
            return func
1628
2164
    
1629
2165
    def __setattr__(self, name, value):
1641
2177
    def handle(self):
1642
2178
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1643
2179
            logger.info("TCP connection from: %s",
1644
 
                        unicode(self.client_address))
 
2180
                        str(self.client_address))
1645
2181
            logger.debug("Pipe FD: %d",
1646
2182
                         self.server.child_pipe.fileno())
1647
2183
            
1648
 
            session = (gnutls.connection
1649
 
                       .ClientSession(self.request,
1650
 
                                      gnutls.connection
1651
 
                                      .X509Credentials()))
1652
 
            
1653
 
            # Note: gnutls.connection.X509Credentials is really a
1654
 
            # generic GnuTLS certificate credentials object so long as
1655
 
            # no X.509 keys are added to it.  Therefore, we can use it
1656
 
            # here despite using OpenPGP certificates.
 
2184
            session = gnutls.ClientSession(self.request)
1657
2185
            
1658
2186
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1659
2187
            #                      "+AES-256-CBC", "+SHA1",
1663
2191
            priority = self.server.gnutls_priority
1664
2192
            if priority is None:
1665
2193
                priority = "NORMAL"
1666
 
            (gnutls.library.functions
1667
 
             .gnutls_priority_set_direct(session._c_object,
1668
 
                                         priority, None))
 
2194
            gnutls.priority_set_direct(session._c_object,
 
2195
                                       priority.encode("utf-8"),
 
2196
                                       None)
1669
2197
            
1670
2198
            # Start communication using the Mandos protocol
1671
2199
            # Get protocol number
1673
2201
            logger.debug("Protocol version: %r", line)
1674
2202
            try:
1675
2203
                if int(line.strip().split()[0]) > 1:
1676
 
                    raise RuntimeError
 
2204
                    raise RuntimeError(line)
1677
2205
            except (ValueError, IndexError, RuntimeError) as error:
1678
2206
                logger.error("Unknown protocol version: %s", error)
1679
2207
                return
1681
2209
            # Start GnuTLS connection
1682
2210
            try:
1683
2211
                session.handshake()
1684
 
            except gnutls.errors.GNUTLSError as error:
 
2212
            except gnutls.Error as error:
1685
2213
                logger.warning("Handshake failed: %s", error)
1686
2214
                # Do not run session.bye() here: the session is not
1687
2215
                # established.  Just abandon the request.
1691
2219
            approval_required = False
1692
2220
            try:
1693
2221
                try:
1694
 
                    fpr = self.fingerprint(self.peer_certificate
1695
 
                                           (session))
1696
 
                except (TypeError,
1697
 
                        gnutls.errors.GNUTLSError) as error:
 
2222
                    fpr = self.fingerprint(
 
2223
                        self.peer_certificate(session))
 
2224
                except (TypeError, gnutls.Error) as error:
1698
2225
                    logger.warning("Bad certificate: %s", error)
1699
2226
                    return
1700
2227
                logger.debug("Fingerprint: %s", fpr)
1713
2240
                while True:
1714
2241
                    if not client.enabled:
1715
2242
                        logger.info("Client %s is disabled",
1716
 
                                       client.name)
 
2243
                                    client.name)
1717
2244
                        if self.server.use_dbus:
1718
2245
                            # Emit D-Bus signal
1719
2246
                            client.Rejected("Disabled")
1728
2255
                        if self.server.use_dbus:
1729
2256
                            # Emit D-Bus signal
1730
2257
                            client.NeedApproval(
1731
 
                                client.approval_delay_milliseconds(),
1732
 
                                client.approved_by_default)
 
2258
                                client.approval_delay.total_seconds()
 
2259
                                * 1000, client.approved_by_default)
1733
2260
                    else:
1734
2261
                        logger.warning("Client %s was not approved",
1735
2262
                                       client.name)
1741
2268
                    #wait until timeout or approved
1742
2269
                    time = datetime.datetime.now()
1743
2270
                    client.changedstate.acquire()
1744
 
                    client.changedstate.wait(
1745
 
                        float(timedelta_to_milliseconds(delay)
1746
 
                              / 1000))
 
2271
                    client.changedstate.wait(delay.total_seconds())
1747
2272
                    client.changedstate.release()
1748
2273
                    time2 = datetime.datetime.now()
1749
2274
                    if (time2 - time) >= delay:
1760
2285
                    else:
1761
2286
                        delay -= time2 - time
1762
2287
                
1763
 
                sent_size = 0
1764
 
                while sent_size < len(client.secret):
1765
 
                    try:
1766
 
                        sent = session.send(client.secret[sent_size:])
1767
 
                    except gnutls.errors.GNUTLSError as error:
1768
 
                        logger.warning("gnutls send failed",
1769
 
                                       exc_info=error)
1770
 
                        return
1771
 
                    logger.debug("Sent: %d, remaining: %d",
1772
 
                                 sent, len(client.secret)
1773
 
                                 - (sent_size + sent))
1774
 
                    sent_size += sent
 
2288
                try:
 
2289
                    session.send(client.secret)
 
2290
                except gnutls.Error as error:
 
2291
                    logger.warning("gnutls send failed",
 
2292
                                   exc_info = error)
 
2293
                    return
1775
2294
                
1776
2295
                logger.info("Sending secret to %s", client.name)
1777
2296
                # bump the timeout using extended_timeout
1785
2304
                    client.approvals_pending -= 1
1786
2305
                try:
1787
2306
                    session.bye()
1788
 
                except gnutls.errors.GNUTLSError as error:
 
2307
                except gnutls.Error as error:
1789
2308
                    logger.warning("GnuTLS bye failed",
1790
2309
                                   exc_info=error)
1791
2310
    
1793
2312
    def peer_certificate(session):
1794
2313
        "Return the peer's OpenPGP certificate as a bytestring"
1795
2314
        # If not an OpenPGP certificate...
1796
 
        if (gnutls.library.functions
1797
 
            .gnutls_certificate_type_get(session._c_object)
1798
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1799
 
            # ...do the normal thing
1800
 
            return session.peer_certificate
 
2315
        if (gnutls.certificate_type_get(session._c_object)
 
2316
            != gnutls.CRT_OPENPGP):
 
2317
            # ...return invalid data
 
2318
            return b""
1801
2319
        list_size = ctypes.c_uint(1)
1802
 
        cert_list = (gnutls.library.functions
1803
 
                     .gnutls_certificate_get_peers
 
2320
        cert_list = (gnutls.certificate_get_peers
1804
2321
                     (session._c_object, ctypes.byref(list_size)))
1805
2322
        if not bool(cert_list) and list_size.value != 0:
1806
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1807
 
                                            " certificate")
 
2323
            raise gnutls.Error("error getting peer certificate")
1808
2324
        if list_size.value == 0:
1809
2325
            return None
1810
2326
        cert = cert_list[0]
1814
2330
    def fingerprint(openpgp):
1815
2331
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1816
2332
        # New GnuTLS "datum" with the OpenPGP public key
1817
 
        datum = (gnutls.library.types
1818
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1819
 
                                             ctypes.POINTER
1820
 
                                             (ctypes.c_ubyte)),
1821
 
                                 ctypes.c_uint(len(openpgp))))
 
2333
        datum = gnutls.datum_t(
 
2334
            ctypes.cast(ctypes.c_char_p(openpgp),
 
2335
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2336
            ctypes.c_uint(len(openpgp)))
1822
2337
        # New empty GnuTLS certificate
1823
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1824
 
        (gnutls.library.functions
1825
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
2338
        crt = gnutls.openpgp_crt_t()
 
2339
        gnutls.openpgp_crt_init(ctypes.byref(crt))
1826
2340
        # Import the OpenPGP public key into the certificate
1827
 
        (gnutls.library.functions
1828
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1829
 
                                    gnutls.library.constants
1830
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
2341
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
 
2342
                                  gnutls.OPENPGP_FMT_RAW)
1831
2343
        # Verify the self signature in the key
1832
2344
        crtverify = ctypes.c_uint()
1833
 
        (gnutls.library.functions
1834
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1835
 
                                         ctypes.byref(crtverify)))
 
2345
        gnutls.openpgp_crt_verify_self(crt, 0,
 
2346
                                       ctypes.byref(crtverify))
1836
2347
        if crtverify.value != 0:
1837
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1838
 
            raise (gnutls.errors.CertificateSecurityError
1839
 
                   ("Verify failed"))
 
2348
            gnutls.openpgp_crt_deinit(crt)
 
2349
            raise gnutls.CertificateSecurityError("Verify failed")
1840
2350
        # New buffer for the fingerprint
1841
2351
        buf = ctypes.create_string_buffer(20)
1842
2352
        buf_len = ctypes.c_size_t()
1843
2353
        # Get the fingerprint from the certificate into the buffer
1844
 
        (gnutls.library.functions
1845
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1846
 
                                             ctypes.byref(buf_len)))
 
2354
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
2355
                                           ctypes.byref(buf_len))
1847
2356
        # Deinit the certificate
1848
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
2357
        gnutls.openpgp_crt_deinit(crt)
1849
2358
        # Convert the buffer to a Python bytestring
1850
2359
        fpr = ctypes.string_at(buf, buf_len.value)
1851
2360
        # Convert the bytestring to hexadecimal notation
1855
2364
 
1856
2365
class MultiprocessingMixIn(object):
1857
2366
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
2367
    
1858
2368
    def sub_process_main(self, request, address):
1859
2369
        try:
1860
2370
            self.finish_request(request, address)
1872
2382
 
1873
2383
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1874
2384
    """ adds a pipe to the MixIn """
 
2385
    
1875
2386
    def process_request(self, request, client_address):
1876
2387
        """Overrides and wraps the original process_request().
1877
2388
        
1886
2397
    
1887
2398
    def add_pipe(self, parent_pipe, proc):
1888
2399
        """Dummy function; override as necessary"""
1889
 
        raise NotImplementedError
 
2400
        raise NotImplementedError()
1890
2401
 
1891
2402
 
1892
2403
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1898
2409
        interface:      None or a network interface name (string)
1899
2410
        use_ipv6:       Boolean; to use IPv6 or not
1900
2411
    """
 
2412
    
1901
2413
    def __init__(self, server_address, RequestHandlerClass,
1902
 
                 interface=None, use_ipv6=True, socketfd=None):
 
2414
                 interface=None,
 
2415
                 use_ipv6=True,
 
2416
                 socketfd=None):
1903
2417
        """If socketfd is set, use that file descriptor instead of
1904
2418
        creating a new one with socket.socket().
1905
2419
        """
1939
2453
        """This overrides the normal server_bind() function
1940
2454
        to bind to an interface if one was specified, and also NOT to
1941
2455
        bind to an address or port if they were not specified."""
 
2456
        global SO_BINDTODEVICE
1942
2457
        if self.interface is not None:
1943
2458
            if SO_BINDTODEVICE is None:
1944
 
                logger.error("SO_BINDTODEVICE does not exist;"
1945
 
                             " cannot bind to interface %s",
1946
 
                             self.interface)
1947
 
            else:
1948
 
                try:
1949
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1950
 
                                           SO_BINDTODEVICE,
1951
 
                                           str(self.interface + '\0'))
1952
 
                except socket.error as error:
1953
 
                    if error.errno == errno.EPERM:
1954
 
                        logger.error("No permission to bind to"
1955
 
                                     " interface %s", self.interface)
1956
 
                    elif error.errno == errno.ENOPROTOOPT:
1957
 
                        logger.error("SO_BINDTODEVICE not available;"
1958
 
                                     " cannot bind to interface %s",
1959
 
                                     self.interface)
1960
 
                    elif error.errno == errno.ENODEV:
1961
 
                        logger.error("Interface %s does not exist,"
1962
 
                                     " cannot bind", self.interface)
1963
 
                    else:
1964
 
                        raise
 
2459
                # Fall back to a hard-coded value which seems to be
 
2460
                # common enough.
 
2461
                logger.warning("SO_BINDTODEVICE not found, trying 25")
 
2462
                SO_BINDTODEVICE = 25
 
2463
            try:
 
2464
                self.socket.setsockopt(
 
2465
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
 
2466
                    (self.interface + "\0").encode("utf-8"))
 
2467
            except socket.error as error:
 
2468
                if error.errno == errno.EPERM:
 
2469
                    logger.error("No permission to bind to"
 
2470
                                 " interface %s", self.interface)
 
2471
                elif error.errno == errno.ENOPROTOOPT:
 
2472
                    logger.error("SO_BINDTODEVICE not available;"
 
2473
                                 " cannot bind to interface %s",
 
2474
                                 self.interface)
 
2475
                elif error.errno == errno.ENODEV:
 
2476
                    logger.error("Interface %s does not exist,"
 
2477
                                 " cannot bind", self.interface)
 
2478
                else:
 
2479
                    raise
1965
2480
        # Only bind(2) the socket if we really need to.
1966
2481
        if self.server_address[0] or self.server_address[1]:
1967
2482
            if not self.server_address[0]:
1968
2483
                if self.address_family == socket.AF_INET6:
1969
2484
                    any_address = "::" # in6addr_any
1970
2485
                else:
1971
 
                    any_address = socket.INADDR_ANY
 
2486
                    any_address = "0.0.0.0" # INADDR_ANY
1972
2487
                self.server_address = (any_address,
1973
2488
                                       self.server_address[1])
1974
2489
            elif not self.server_address[1]:
1975
 
                self.server_address = (self.server_address[0],
1976
 
                                       0)
 
2490
                self.server_address = (self.server_address[0], 0)
1977
2491
#                 if self.interface:
1978
2492
#                     self.server_address = (self.server_address[0],
1979
2493
#                                            0, # port
1991
2505
        gnutls_priority GnuTLS priority string
1992
2506
        use_dbus:       Boolean; to emit D-Bus signals or not
1993
2507
    
1994
 
    Assumes a gobject.MainLoop event loop.
 
2508
    Assumes a GLib.MainLoop event loop.
1995
2509
    """
 
2510
    
1996
2511
    def __init__(self, server_address, RequestHandlerClass,
1997
 
                 interface=None, use_ipv6=True, clients=None,
1998
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
2512
                 interface=None,
 
2513
                 use_ipv6=True,
 
2514
                 clients=None,
 
2515
                 gnutls_priority=None,
 
2516
                 use_dbus=True,
 
2517
                 socketfd=None):
1999
2518
        self.enabled = False
2000
2519
        self.clients = clients
2001
2520
        if self.clients is None:
2007
2526
                                interface = interface,
2008
2527
                                use_ipv6 = use_ipv6,
2009
2528
                                socketfd = socketfd)
 
2529
    
2010
2530
    def server_activate(self):
2011
2531
        if self.enabled:
2012
2532
            return socketserver.TCPServer.server_activate(self)
2016
2536
    
2017
2537
    def add_pipe(self, parent_pipe, proc):
2018
2538
        # Call "handle_ipc" for both data and EOF events
2019
 
        gobject.io_add_watch(parent_pipe.fileno(),
2020
 
                             gobject.IO_IN | gobject.IO_HUP,
2021
 
                             functools.partial(self.handle_ipc,
2022
 
                                               parent_pipe =
2023
 
                                               parent_pipe,
2024
 
                                               proc = proc))
 
2539
        GLib.io_add_watch(
 
2540
            parent_pipe.fileno(),
 
2541
            GLib.IO_IN | GLib.IO_HUP,
 
2542
            functools.partial(self.handle_ipc,
 
2543
                              parent_pipe = parent_pipe,
 
2544
                              proc = proc))
2025
2545
    
2026
 
    def handle_ipc(self, source, condition, parent_pipe=None,
2027
 
                   proc = None, client_object=None):
 
2546
    def handle_ipc(self, source, condition,
 
2547
                   parent_pipe=None,
 
2548
                   proc = None,
 
2549
                   client_object=None):
2028
2550
        # error, or the other end of multiprocessing.Pipe has closed
2029
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2551
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
2030
2552
            # Wait for other process to exit
2031
2553
            proc.join()
2032
2554
            return False
2039
2561
            fpr = request[1]
2040
2562
            address = request[2]
2041
2563
            
2042
 
            for c in self.clients.itervalues():
 
2564
            for c in self.clients.values():
2043
2565
                if c.fingerprint == fpr:
2044
2566
                    client = c
2045
2567
                    break
2053
2575
                parent_pipe.send(False)
2054
2576
                return False
2055
2577
            
2056
 
            gobject.io_add_watch(parent_pipe.fileno(),
2057
 
                                 gobject.IO_IN | gobject.IO_HUP,
2058
 
                                 functools.partial(self.handle_ipc,
2059
 
                                                   parent_pipe =
2060
 
                                                   parent_pipe,
2061
 
                                                   proc = proc,
2062
 
                                                   client_object =
2063
 
                                                   client))
 
2578
            GLib.io_add_watch(
 
2579
                parent_pipe.fileno(),
 
2580
                GLib.IO_IN | GLib.IO_HUP,
 
2581
                functools.partial(self.handle_ipc,
 
2582
                                  parent_pipe = parent_pipe,
 
2583
                                  proc = proc,
 
2584
                                  client_object = client))
2064
2585
            parent_pipe.send(True)
2065
2586
            # remove the old hook in favor of the new above hook on
2066
2587
            # same fileno
2072
2593
            
2073
2594
            parent_pipe.send(('data', getattr(client_object,
2074
2595
                                              funcname)(*args,
2075
 
                                                         **kwargs)))
 
2596
                                                        **kwargs)))
2076
2597
        
2077
2598
        if command == 'getattr':
2078
2599
            attrname = request[1]
2079
 
            if callable(client_object.__getattribute__(attrname)):
2080
 
                parent_pipe.send(('function',))
 
2600
            if isinstance(client_object.__getattribute__(attrname),
 
2601
                          collections.Callable):
 
2602
                parent_pipe.send(('function', ))
2081
2603
            else:
2082
 
                parent_pipe.send(('data', client_object
2083
 
                                  .__getattribute__(attrname)))
 
2604
                parent_pipe.send((
 
2605
                    'data', client_object.__getattribute__(attrname)))
2084
2606
        
2085
2607
        if command == 'setattr':
2086
2608
            attrname = request[1]
2090
2612
        return True
2091
2613
 
2092
2614
 
 
2615
def rfc3339_duration_to_delta(duration):
 
2616
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2617
    
 
2618
    >>> rfc3339_duration_to_delta("P7D")
 
2619
    datetime.timedelta(7)
 
2620
    >>> rfc3339_duration_to_delta("PT60S")
 
2621
    datetime.timedelta(0, 60)
 
2622
    >>> rfc3339_duration_to_delta("PT60M")
 
2623
    datetime.timedelta(0, 3600)
 
2624
    >>> rfc3339_duration_to_delta("PT24H")
 
2625
    datetime.timedelta(1)
 
2626
    >>> rfc3339_duration_to_delta("P1W")
 
2627
    datetime.timedelta(7)
 
2628
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2629
    datetime.timedelta(0, 330)
 
2630
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2631
    datetime.timedelta(1, 200)
 
2632
    """
 
2633
    
 
2634
    # Parsing an RFC 3339 duration with regular expressions is not
 
2635
    # possible - there would have to be multiple places for the same
 
2636
    # values, like seconds.  The current code, while more esoteric, is
 
2637
    # cleaner without depending on a parsing library.  If Python had a
 
2638
    # built-in library for parsing we would use it, but we'd like to
 
2639
    # avoid excessive use of external libraries.
 
2640
    
 
2641
    # New type for defining tokens, syntax, and semantics all-in-one
 
2642
    Token = collections.namedtuple("Token", (
 
2643
        "regexp",  # To match token; if "value" is not None, must have
 
2644
                   # a "group" containing digits
 
2645
        "value",   # datetime.timedelta or None
 
2646
        "followers"))           # Tokens valid after this token
 
2647
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2648
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2649
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2650
    token_second = Token(re.compile(r"(\d+)S"),
 
2651
                         datetime.timedelta(seconds=1),
 
2652
                         frozenset((token_end, )))
 
2653
    token_minute = Token(re.compile(r"(\d+)M"),
 
2654
                         datetime.timedelta(minutes=1),
 
2655
                         frozenset((token_second, token_end)))
 
2656
    token_hour = Token(re.compile(r"(\d+)H"),
 
2657
                       datetime.timedelta(hours=1),
 
2658
                       frozenset((token_minute, token_end)))
 
2659
    token_time = Token(re.compile(r"T"),
 
2660
                       None,
 
2661
                       frozenset((token_hour, token_minute,
 
2662
                                  token_second)))
 
2663
    token_day = Token(re.compile(r"(\d+)D"),
 
2664
                      datetime.timedelta(days=1),
 
2665
                      frozenset((token_time, token_end)))
 
2666
    token_month = Token(re.compile(r"(\d+)M"),
 
2667
                        datetime.timedelta(weeks=4),
 
2668
                        frozenset((token_day, token_end)))
 
2669
    token_year = Token(re.compile(r"(\d+)Y"),
 
2670
                       datetime.timedelta(weeks=52),
 
2671
                       frozenset((token_month, token_end)))
 
2672
    token_week = Token(re.compile(r"(\d+)W"),
 
2673
                       datetime.timedelta(weeks=1),
 
2674
                       frozenset((token_end, )))
 
2675
    token_duration = Token(re.compile(r"P"), None,
 
2676
                           frozenset((token_year, token_month,
 
2677
                                      token_day, token_time,
 
2678
                                      token_week)))
 
2679
    # Define starting values
 
2680
    value = datetime.timedelta() # Value so far
 
2681
    found_token = None
 
2682
    followers = frozenset((token_duration, )) # Following valid tokens
 
2683
    s = duration                # String left to parse
 
2684
    # Loop until end token is found
 
2685
    while found_token is not token_end:
 
2686
        # Search for any currently valid tokens
 
2687
        for token in followers:
 
2688
            match = token.regexp.match(s)
 
2689
            if match is not None:
 
2690
                # Token found
 
2691
                if token.value is not None:
 
2692
                    # Value found, parse digits
 
2693
                    factor = int(match.group(1), 10)
 
2694
                    # Add to value so far
 
2695
                    value += factor * token.value
 
2696
                # Strip token from string
 
2697
                s = token.regexp.sub("", s, 1)
 
2698
                # Go to found token
 
2699
                found_token = token
 
2700
                # Set valid next tokens
 
2701
                followers = found_token.followers
 
2702
                break
 
2703
        else:
 
2704
            # No currently valid tokens were found
 
2705
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
2706
                             .format(duration))
 
2707
    # End token found
 
2708
    return value
 
2709
 
 
2710
 
2093
2711
def string_to_delta(interval):
2094
2712
    """Parse a string and return a datetime.timedelta
2095
2713
    
2106
2724
    >>> string_to_delta('5m 30s')
2107
2725
    datetime.timedelta(0, 330)
2108
2726
    """
 
2727
    
 
2728
    try:
 
2729
        return rfc3339_duration_to_delta(interval)
 
2730
    except ValueError:
 
2731
        pass
 
2732
    
2109
2733
    timevalue = datetime.timedelta(0)
2110
2734
    for s in interval.split():
2111
2735
        try:
2112
 
            suffix = unicode(s[-1])
 
2736
            suffix = s[-1]
2113
2737
            value = int(s[:-1])
2114
2738
            if suffix == "d":
2115
2739
                delta = datetime.timedelta(value)
2122
2746
            elif suffix == "w":
2123
2747
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2124
2748
            else:
2125
 
                raise ValueError("Unknown suffix {0!r}"
2126
 
                                 .format(suffix))
2127
 
        except (ValueError, IndexError) as e:
 
2749
                raise ValueError("Unknown suffix {!r}".format(suffix))
 
2750
        except IndexError as e:
2128
2751
            raise ValueError(*(e.args))
2129
2752
        timevalue += delta
2130
2753
    return timevalue
2146
2769
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2147
2770
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2148
2771
            raise OSError(errno.ENODEV,
2149
 
                          "{0} not a character device"
 
2772
                          "{} not a character device"
2150
2773
                          .format(os.devnull))
2151
2774
        os.dup2(null, sys.stdin.fileno())
2152
2775
        os.dup2(null, sys.stdout.fileno())
2162
2785
    
2163
2786
    parser = argparse.ArgumentParser()
2164
2787
    parser.add_argument("-v", "--version", action="version",
2165
 
                        version = "%(prog)s {0}".format(version),
 
2788
                        version = "%(prog)s {}".format(version),
2166
2789
                        help="show version number and exit")
2167
2790
    parser.add_argument("-i", "--interface", metavar="IF",
2168
2791
                        help="Bind to interface IF")
2174
2797
                        help="Run self-test")
2175
2798
    parser.add_argument("--debug", action="store_true",
2176
2799
                        help="Debug mode; run in foreground and log"
2177
 
                        " to terminal")
 
2800
                        " to terminal", default=None)
2178
2801
    parser.add_argument("--debuglevel", metavar="LEVEL",
2179
2802
                        help="Debug level for stdout output")
2180
2803
    parser.add_argument("--priority", help="GnuTLS"
2187
2810
                        " files")
2188
2811
    parser.add_argument("--no-dbus", action="store_false",
2189
2812
                        dest="use_dbus", help="Do not provide D-Bus"
2190
 
                        " system bus interface")
 
2813
                        " system bus interface", default=None)
2191
2814
    parser.add_argument("--no-ipv6", action="store_false",
2192
 
                        dest="use_ipv6", help="Do not use IPv6")
 
2815
                        dest="use_ipv6", help="Do not use IPv6",
 
2816
                        default=None)
2193
2817
    parser.add_argument("--no-restore", action="store_false",
2194
2818
                        dest="restore", help="Do not restore stored"
2195
 
                        " state")
 
2819
                        " state", default=None)
2196
2820
    parser.add_argument("--socket", type=int,
2197
2821
                        help="Specify a file descriptor to a network"
2198
2822
                        " socket to use instead of creating one")
2199
2823
    parser.add_argument("--statedir", metavar="DIR",
2200
2824
                        help="Directory to save/restore state in")
2201
2825
    parser.add_argument("--foreground", action="store_true",
2202
 
                        help="Run in foreground")
 
2826
                        help="Run in foreground", default=None)
 
2827
    parser.add_argument("--no-zeroconf", action="store_false",
 
2828
                        dest="zeroconf", help="Do not use Zeroconf",
 
2829
                        default=None)
2203
2830
    
2204
2831
    options = parser.parse_args()
2205
2832
    
2206
2833
    if options.check:
2207
2834
        import doctest
2208
 
        doctest.testmod()
2209
 
        sys.exit()
 
2835
        fail_count, test_count = doctest.testmod()
 
2836
        sys.exit(os.EX_OK if fail_count == 0 else 1)
2210
2837
    
2211
2838
    # Default values for config file for server-global settings
2212
2839
    server_defaults = { "interface": "",
2214
2841
                        "port": "",
2215
2842
                        "debug": "False",
2216
2843
                        "priority":
2217
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2844
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
 
2845
                        ":+SIGN-DSA-SHA256",
2218
2846
                        "servicename": "Mandos",
2219
2847
                        "use_dbus": "True",
2220
2848
                        "use_ipv6": "True",
2223
2851
                        "socket": "",
2224
2852
                        "statedir": "/var/lib/mandos",
2225
2853
                        "foreground": "False",
2226
 
                        }
 
2854
                        "zeroconf": "True",
 
2855
                    }
2227
2856
    
2228
2857
    # Parse config file for server-global settings
2229
2858
    server_config = configparser.SafeConfigParser(server_defaults)
2230
2859
    del server_defaults
2231
 
    server_config.read(os.path.join(options.configdir,
2232
 
                                    "mandos.conf"))
 
2860
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
2233
2861
    # Convert the SafeConfigParser object to a dict
2234
2862
    server_settings = server_config.defaults()
2235
2863
    # Use the appropriate methods on the non-string config options
2253
2881
    # Override the settings from the config file with command line
2254
2882
    # options, if set.
2255
2883
    for option in ("interface", "address", "port", "debug",
2256
 
                   "priority", "servicename", "configdir",
2257
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2258
 
                   "statedir", "socket", "foreground"):
 
2884
                   "priority", "servicename", "configdir", "use_dbus",
 
2885
                   "use_ipv6", "debuglevel", "restore", "statedir",
 
2886
                   "socket", "foreground", "zeroconf"):
2259
2887
        value = getattr(options, option)
2260
2888
        if value is not None:
2261
2889
            server_settings[option] = value
2262
2890
    del options
2263
2891
    # Force all strings to be unicode
2264
2892
    for option in server_settings.keys():
2265
 
        if type(server_settings[option]) is str:
2266
 
            server_settings[option] = unicode(server_settings[option])
 
2893
        if isinstance(server_settings[option], bytes):
 
2894
            server_settings[option] = (server_settings[option]
 
2895
                                       .decode("utf-8"))
 
2896
    # Force all boolean options to be boolean
 
2897
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2898
                   "foreground", "zeroconf"):
 
2899
        server_settings[option] = bool(server_settings[option])
2267
2900
    # Debug implies foreground
2268
2901
    if server_settings["debug"]:
2269
2902
        server_settings["foreground"] = True
2271
2904
    
2272
2905
    ##################################################################
2273
2906
    
 
2907
    if (not server_settings["zeroconf"]
 
2908
        and not (server_settings["port"]
 
2909
                 or server_settings["socket"] != "")):
 
2910
        parser.error("Needs port or socket to work without Zeroconf")
 
2911
    
2274
2912
    # For convenience
2275
2913
    debug = server_settings["debug"]
2276
2914
    debuglevel = server_settings["debuglevel"]
2279
2917
    stored_state_path = os.path.join(server_settings["statedir"],
2280
2918
                                     stored_state_file)
2281
2919
    foreground = server_settings["foreground"]
 
2920
    zeroconf = server_settings["zeroconf"]
2282
2921
    
2283
2922
    if debug:
2284
2923
        initlogger(debug, logging.DEBUG)
2290
2929
            initlogger(debug, level)
2291
2930
    
2292
2931
    if server_settings["servicename"] != "Mandos":
2293
 
        syslogger.setFormatter(logging.Formatter
2294
 
                               ('Mandos ({0}) [%(process)d]:'
2295
 
                                ' %(levelname)s: %(message)s'
2296
 
                                .format(server_settings
2297
 
                                        ["servicename"])))
 
2932
        syslogger.setFormatter(
 
2933
            logging.Formatter('Mandos ({}) [%(process)d]:'
 
2934
                              ' %(levelname)s: %(message)s'.format(
 
2935
                                  server_settings["servicename"])))
2298
2936
    
2299
2937
    # Parse config file with clients
2300
2938
    client_config = configparser.SafeConfigParser(Client
2305
2943
    global mandos_dbus_service
2306
2944
    mandos_dbus_service = None
2307
2945
    
2308
 
    tcp_server = MandosServer((server_settings["address"],
2309
 
                               server_settings["port"]),
2310
 
                              ClientHandler,
2311
 
                              interface=(server_settings["interface"]
2312
 
                                         or None),
2313
 
                              use_ipv6=use_ipv6,
2314
 
                              gnutls_priority=
2315
 
                              server_settings["priority"],
2316
 
                              use_dbus=use_dbus,
2317
 
                              socketfd=(server_settings["socket"]
2318
 
                                        or None))
 
2946
    socketfd = None
 
2947
    if server_settings["socket"] != "":
 
2948
        socketfd = server_settings["socket"]
 
2949
    tcp_server = MandosServer(
 
2950
        (server_settings["address"], server_settings["port"]),
 
2951
        ClientHandler,
 
2952
        interface=(server_settings["interface"] or None),
 
2953
        use_ipv6=use_ipv6,
 
2954
        gnutls_priority=server_settings["priority"],
 
2955
        use_dbus=use_dbus,
 
2956
        socketfd=socketfd)
2319
2957
    if not foreground:
2320
 
        pidfilename = "/var/run/mandos.pid"
 
2958
        pidfilename = "/run/mandos.pid"
 
2959
        if not os.path.isdir("/run/."):
 
2960
            pidfilename = "/var/run/mandos.pid"
2321
2961
        pidfile = None
2322
2962
        try:
2323
 
            pidfile = open(pidfilename, "w")
 
2963
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2324
2964
        except IOError as e:
2325
2965
            logger.error("Could not open file %r", pidfilename,
2326
2966
                         exc_info=e)
2327
2967
    
2328
 
    for name in ("_mandos", "mandos", "nobody"):
 
2968
    for name, group in (("_mandos", "_mandos"),
 
2969
                        ("mandos", "mandos"),
 
2970
                        ("nobody", "nogroup")):
2329
2971
        try:
2330
2972
            uid = pwd.getpwnam(name).pw_uid
2331
 
            gid = pwd.getpwnam(name).pw_gid
 
2973
            gid = pwd.getpwnam(group).pw_gid
2332
2974
            break
2333
2975
        except KeyError:
2334
2976
            continue
2338
2980
    try:
2339
2981
        os.setgid(gid)
2340
2982
        os.setuid(uid)
 
2983
        if debug:
 
2984
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
 
2985
                                                             gid))
2341
2986
    except OSError as error:
 
2987
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
 
2988
                       .format(uid, gid, os.strerror(error.errno)))
2342
2989
        if error.errno != errno.EPERM:
2343
 
            raise error
 
2990
            raise
2344
2991
    
2345
2992
    if debug:
2346
2993
        # Enable all possible GnuTLS debugging
2347
2994
        
2348
2995
        # "Use a log level over 10 to enable all debugging options."
2349
2996
        # - GnuTLS manual
2350
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
2997
        gnutls.global_set_log_level(11)
2351
2998
        
2352
 
        @gnutls.library.types.gnutls_log_func
 
2999
        @gnutls.log_func
2353
3000
        def debug_gnutls(level, string):
2354
3001
            logger.debug("GnuTLS: %s", string[:-1])
2355
3002
        
2356
 
        (gnutls.library.functions
2357
 
         .gnutls_global_set_log_function(debug_gnutls))
 
3003
        gnutls.global_set_log_function(debug_gnutls)
2358
3004
        
2359
3005
        # Redirect stdin so all checkers get /dev/null
2360
3006
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2367
3013
        # Close all input and output, do double fork, etc.
2368
3014
        daemon()
2369
3015
    
2370
 
    # multiprocessing will use threads, so before we use gobject we
2371
 
    # need to inform gobject that threads will be used.
2372
 
    gobject.threads_init()
 
3016
    # multiprocessing will use threads, so before we use GLib we need
 
3017
    # to inform GLib that threads will be used.
 
3018
    GLib.threads_init()
2373
3019
    
2374
3020
    global main_loop
2375
3021
    # From the Avahi example code
2376
3022
    DBusGMainLoop(set_as_default=True)
2377
 
    main_loop = gobject.MainLoop()
 
3023
    main_loop = GLib.MainLoop()
2378
3024
    bus = dbus.SystemBus()
2379
3025
    # End of Avahi example code
2380
3026
    if use_dbus:
2381
3027
        try:
2382
3028
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2383
 
                                            bus, do_not_queue=True)
2384
 
            old_bus_name = (dbus.service.BusName
2385
 
                            ("se.bsnet.fukt.Mandos", bus,
2386
 
                             do_not_queue=True))
2387
 
        except dbus.exceptions.NameExistsException as e:
 
3029
                                            bus,
 
3030
                                            do_not_queue=True)
 
3031
            old_bus_name = dbus.service.BusName(
 
3032
                "se.bsnet.fukt.Mandos", bus,
 
3033
                do_not_queue=True)
 
3034
        except dbus.exceptions.DBusException as e:
2388
3035
            logger.error("Disabling D-Bus:", exc_info=e)
2389
3036
            use_dbus = False
2390
3037
            server_settings["use_dbus"] = False
2391
3038
            tcp_server.use_dbus = False
2392
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2393
 
    service = AvahiServiceToSyslog(name =
2394
 
                                   server_settings["servicename"],
2395
 
                                   servicetype = "_mandos._tcp",
2396
 
                                   protocol = protocol, bus = bus)
2397
 
    if server_settings["interface"]:
2398
 
        service.interface = (if_nametoindex
2399
 
                             (str(server_settings["interface"])))
 
3039
    if zeroconf:
 
3040
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
3041
        service = AvahiServiceToSyslog(
 
3042
            name = server_settings["servicename"],
 
3043
            servicetype = "_mandos._tcp",
 
3044
            protocol = protocol,
 
3045
            bus = bus)
 
3046
        if server_settings["interface"]:
 
3047
            service.interface = if_nametoindex(
 
3048
                server_settings["interface"].encode("utf-8"))
2400
3049
    
2401
3050
    global multiprocessing_manager
2402
3051
    multiprocessing_manager = multiprocessing.Manager()
2409
3058
    old_client_settings = {}
2410
3059
    clients_data = {}
2411
3060
    
 
3061
    # This is used to redirect stdout and stderr for checker processes
 
3062
    global wnull
 
3063
    wnull = open(os.devnull, "w") # A writable /dev/null
 
3064
    # Only used if server is running in foreground but not in debug
 
3065
    # mode
 
3066
    if debug or not foreground:
 
3067
        wnull.close()
 
3068
    
2412
3069
    # Get client data and settings from last running state.
2413
3070
    if server_settings["restore"]:
2414
3071
        try:
2415
3072
            with open(stored_state_path, "rb") as stored_state:
2416
 
                clients_data, old_client_settings = (pickle.load
2417
 
                                                     (stored_state))
 
3073
                if sys.version_info.major == 2:                
 
3074
                    clients_data, old_client_settings = pickle.load(
 
3075
                        stored_state)
 
3076
                else:
 
3077
                    bytes_clients_data, bytes_old_client_settings = (
 
3078
                        pickle.load(stored_state, encoding = "bytes"))
 
3079
                    ### Fix bytes to strings
 
3080
                    ## clients_data
 
3081
                    # .keys()
 
3082
                    clients_data = { (key.decode("utf-8")
 
3083
                                      if isinstance(key, bytes)
 
3084
                                      else key): value
 
3085
                                     for key, value in
 
3086
                                     bytes_clients_data.items() }
 
3087
                    del bytes_clients_data
 
3088
                    for key in clients_data:
 
3089
                        value = { (k.decode("utf-8")
 
3090
                                   if isinstance(k, bytes) else k): v
 
3091
                                  for k, v in
 
3092
                                  clients_data[key].items() }
 
3093
                        clients_data[key] = value
 
3094
                        # .client_structure
 
3095
                        value["client_structure"] = [
 
3096
                            (s.decode("utf-8")
 
3097
                             if isinstance(s, bytes)
 
3098
                             else s) for s in
 
3099
                            value["client_structure"] ]
 
3100
                        # .name & .host
 
3101
                        for k in ("name", "host"):
 
3102
                            if isinstance(value[k], bytes):
 
3103
                                value[k] = value[k].decode("utf-8")
 
3104
                    ## old_client_settings
 
3105
                    # .keys()
 
3106
                    old_client_settings = {
 
3107
                        (key.decode("utf-8")
 
3108
                         if isinstance(key, bytes)
 
3109
                         else key): value
 
3110
                        for key, value in
 
3111
                        bytes_old_client_settings.items() }
 
3112
                    del bytes_old_client_settings
 
3113
                    # .host
 
3114
                    for value in old_client_settings.values():
 
3115
                        if isinstance(value["host"], bytes):
 
3116
                            value["host"] = (value["host"]
 
3117
                                             .decode("utf-8"))
2418
3118
            os.remove(stored_state_path)
2419
3119
        except IOError as e:
2420
3120
            if e.errno == errno.ENOENT:
2421
 
                logger.warning("Could not load persistent state: {0}"
2422
 
                                .format(os.strerror(e.errno)))
 
3121
                logger.warning("Could not load persistent state:"
 
3122
                               " {}".format(os.strerror(e.errno)))
2423
3123
            else:
2424
3124
                logger.critical("Could not load persistent state:",
2425
3125
                                exc_info=e)
2426
3126
                raise
2427
3127
        except EOFError as e:
2428
3128
            logger.warning("Could not load persistent state: "
2429
 
                           "EOFError:", exc_info=e)
 
3129
                           "EOFError:",
 
3130
                           exc_info=e)
2430
3131
    
2431
3132
    with PGPEngine() as pgp:
2432
 
        for client_name, client in clients_data.iteritems():
 
3133
        for client_name, client in clients_data.items():
 
3134
            # Skip removed clients
 
3135
            if client_name not in client_settings:
 
3136
                continue
 
3137
            
2433
3138
            # Decide which value to use after restoring saved state.
2434
3139
            # We have three different values: Old config file,
2435
3140
            # new config file, and saved state.
2440
3145
                    # For each value in new config, check if it
2441
3146
                    # differs from the old config value (Except for
2442
3147
                    # the "secret" attribute)
2443
 
                    if (name != "secret" and
2444
 
                        value != old_client_settings[client_name]
2445
 
                        [name]):
 
3148
                    if (name != "secret"
 
3149
                        and (value !=
 
3150
                             old_client_settings[client_name][name])):
2446
3151
                        client[name] = value
2447
3152
                except KeyError:
2448
3153
                    pass
2449
3154
            
2450
3155
            # Clients who has passed its expire date can still be
2451
 
            # enabled if its last checker was successful.  Clients
 
3156
            # enabled if its last checker was successful.  A Client
2452
3157
            # whose checker succeeded before we stored its state is
2453
3158
            # assumed to have successfully run all checkers during
2454
3159
            # downtime.
2456
3161
                if datetime.datetime.utcnow() >= client["expires"]:
2457
3162
                    if not client["last_checked_ok"]:
2458
3163
                        logger.warning(
2459
 
                            "disabling client {0} - Client never "
2460
 
                            "performed a successful checker"
2461
 
                            .format(client_name))
 
3164
                            "disabling client {} - Client never "
 
3165
                            "performed a successful checker".format(
 
3166
                                client_name))
2462
3167
                        client["enabled"] = False
2463
3168
                    elif client["last_checker_status"] != 0:
2464
3169
                        logger.warning(
2465
 
                            "disabling client {0} - Client "
2466
 
                            "last checker failed with error code {1}"
2467
 
                            .format(client_name,
2468
 
                                    client["last_checker_status"]))
 
3170
                            "disabling client {} - Client last"
 
3171
                            " checker failed with error code"
 
3172
                            " {}".format(
 
3173
                                client_name,
 
3174
                                client["last_checker_status"]))
2469
3175
                        client["enabled"] = False
2470
3176
                    else:
2471
 
                        client["expires"] = (datetime.datetime
2472
 
                                             .utcnow()
2473
 
                                             + client["timeout"])
 
3177
                        client["expires"] = (
 
3178
                            datetime.datetime.utcnow()
 
3179
                            + client["timeout"])
2474
3180
                        logger.debug("Last checker succeeded,"
2475
 
                                     " keeping {0} enabled"
2476
 
                                     .format(client_name))
 
3181
                                     " keeping {} enabled".format(
 
3182
                                         client_name))
2477
3183
            try:
2478
 
                client["secret"] = (
2479
 
                    pgp.decrypt(client["encrypted_secret"],
2480
 
                                client_settings[client_name]
2481
 
                                ["secret"]))
 
3184
                client["secret"] = pgp.decrypt(
 
3185
                    client["encrypted_secret"],
 
3186
                    client_settings[client_name]["secret"])
2482
3187
            except PGPError:
2483
3188
                # If decryption fails, we use secret from new settings
2484
 
                logger.debug("Failed to decrypt {0} old secret"
2485
 
                             .format(client_name))
2486
 
                client["secret"] = (
2487
 
                    client_settings[client_name]["secret"])
 
3189
                logger.debug("Failed to decrypt {} old secret".format(
 
3190
                    client_name))
 
3191
                client["secret"] = (client_settings[client_name]
 
3192
                                    ["secret"])
2488
3193
    
2489
3194
    # Add/remove clients based on new changes made to config
2490
3195
    for client_name in (set(old_client_settings)
2495
3200
        clients_data[client_name] = client_settings[client_name]
2496
3201
    
2497
3202
    # Create all client objects
2498
 
    for client_name, client in clients_data.iteritems():
 
3203
    for client_name, client in clients_data.items():
2499
3204
        tcp_server.clients[client_name] = client_class(
2500
 
            name = client_name, settings = client)
 
3205
            name = client_name,
 
3206
            settings = client,
 
3207
            server_settings = server_settings)
2501
3208
    
2502
3209
    if not tcp_server.clients:
2503
3210
        logger.warning("No clients defined")
2504
3211
    
2505
3212
    if not foreground:
2506
3213
        if pidfile is not None:
 
3214
            pid = os.getpid()
2507
3215
            try:
2508
3216
                with pidfile:
2509
 
                    pid = os.getpid()
2510
 
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
3217
                    print(pid, file=pidfile)
2511
3218
            except IOError:
2512
3219
                logger.error("Could not write to file %r with PID %d",
2513
3220
                             pidfilename, pid)
2514
3221
        del pidfile
2515
3222
        del pidfilename
2516
3223
    
2517
 
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2518
 
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
 
3224
    for termsig in (signal.SIGHUP, signal.SIGTERM):
 
3225
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
 
3226
                             lambda: main_loop.quit() and False)
2519
3227
    
2520
3228
    if use_dbus:
2521
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2522
 
                                        "se.bsnet.fukt.Mandos"})
2523
 
        class MandosDBusService(DBusObjectWithProperties):
 
3229
        
 
3230
        @alternate_dbus_interfaces(
 
3231
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
 
3232
        class MandosDBusService(DBusObjectWithObjectManager):
2524
3233
            """A D-Bus proxy object"""
 
3234
            
2525
3235
            def __init__(self):
2526
3236
                dbus.service.Object.__init__(self, bus, "/")
 
3237
            
2527
3238
            _interface = "se.recompile.Mandos"
2528
3239
            
2529
 
            @dbus_interface_annotations(_interface)
2530
 
            def _foo(self):
2531
 
                return { "org.freedesktop.DBus.Property"
2532
 
                         ".EmitsChangedSignal":
2533
 
                             "false"}
2534
 
            
2535
3240
            @dbus.service.signal(_interface, signature="o")
2536
3241
            def ClientAdded(self, objpath):
2537
3242
                "D-Bus signal"
2542
3247
                "D-Bus signal"
2543
3248
                pass
2544
3249
            
 
3250
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3251
                               "true"})
2545
3252
            @dbus.service.signal(_interface, signature="os")
2546
3253
            def ClientRemoved(self, objpath, name):
2547
3254
                "D-Bus signal"
2548
3255
                pass
2549
3256
            
 
3257
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3258
                               "true"})
2550
3259
            @dbus.service.method(_interface, out_signature="ao")
2551
3260
            def GetAllClients(self):
2552
3261
                "D-Bus method"
2553
 
                return dbus.Array(c.dbus_object_path
2554
 
                                  for c in
2555
 
                                  tcp_server.clients.itervalues())
 
3262
                return dbus.Array(c.dbus_object_path for c in
 
3263
                                  tcp_server.clients.values())
2556
3264
            
 
3265
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3266
                               "true"})
2557
3267
            @dbus.service.method(_interface,
2558
3268
                                 out_signature="a{oa{sv}}")
2559
3269
            def GetAllClientsWithProperties(self):
2560
3270
                "D-Bus method"
2561
3271
                return dbus.Dictionary(
2562
 
                    ((c.dbus_object_path, c.GetAll(""))
2563
 
                     for c in tcp_server.clients.itervalues()),
 
3272
                    { c.dbus_object_path: c.GetAll(
 
3273
                        "se.recompile.Mandos.Client")
 
3274
                      for c in tcp_server.clients.values() },
2564
3275
                    signature="oa{sv}")
2565
3276
            
2566
3277
            @dbus.service.method(_interface, in_signature="o")
2567
3278
            def RemoveClient(self, object_path):
2568
3279
                "D-Bus method"
2569
 
                for c in tcp_server.clients.itervalues():
 
3280
                for c in tcp_server.clients.values():
2570
3281
                    if c.dbus_object_path == object_path:
2571
3282
                        del tcp_server.clients[c.name]
2572
3283
                        c.remove_from_connection()
2573
 
                        # Don't signal anything except ClientRemoved
 
3284
                        # Don't signal the disabling
2574
3285
                        c.disable(quiet=True)
2575
 
                        # Emit D-Bus signal
2576
 
                        self.ClientRemoved(object_path, c.name)
 
3286
                        # Emit D-Bus signal for removal
 
3287
                        self.client_removed_signal(c)
2577
3288
                        return
2578
3289
                raise KeyError(object_path)
2579
3290
            
2580
3291
            del _interface
 
3292
            
 
3293
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
3294
                                 out_signature = "a{oa{sa{sv}}}")
 
3295
            def GetManagedObjects(self):
 
3296
                """D-Bus method"""
 
3297
                return dbus.Dictionary(
 
3298
                    { client.dbus_object_path:
 
3299
                      dbus.Dictionary(
 
3300
                          { interface: client.GetAll(interface)
 
3301
                            for interface in
 
3302
                                 client._get_all_interface_names()})
 
3303
                      for client in tcp_server.clients.values()})
 
3304
            
 
3305
            def client_added_signal(self, client):
 
3306
                """Send the new standard signal and the old signal"""
 
3307
                if use_dbus:
 
3308
                    # New standard signal
 
3309
                    self.InterfacesAdded(
 
3310
                        client.dbus_object_path,
 
3311
                        dbus.Dictionary(
 
3312
                            { interface: client.GetAll(interface)
 
3313
                              for interface in
 
3314
                              client._get_all_interface_names()}))
 
3315
                    # Old signal
 
3316
                    self.ClientAdded(client.dbus_object_path)
 
3317
            
 
3318
            def client_removed_signal(self, client):
 
3319
                """Send the new standard signal and the old signal"""
 
3320
                if use_dbus:
 
3321
                    # New standard signal
 
3322
                    self.InterfacesRemoved(
 
3323
                        client.dbus_object_path,
 
3324
                        client._get_all_interface_names())
 
3325
                    # Old signal
 
3326
                    self.ClientRemoved(client.dbus_object_path,
 
3327
                                       client.name)
2581
3328
        
2582
3329
        mandos_dbus_service = MandosDBusService()
2583
3330
    
 
3331
    # Save modules to variables to exempt the modules from being
 
3332
    # unloaded before the function registered with atexit() is run.
 
3333
    mp = multiprocessing
 
3334
    wn = wnull
2584
3335
    def cleanup():
2585
3336
        "Cleanup function; run on exit"
2586
 
        service.cleanup()
 
3337
        if zeroconf:
 
3338
            service.cleanup()
2587
3339
        
2588
 
        multiprocessing.active_children()
 
3340
        mp.active_children()
 
3341
        wn.close()
2589
3342
        if not (tcp_server.clients or client_settings):
2590
3343
            return
2591
3344
        
2594
3347
        # removed/edited, old secret will thus be unrecovable.
2595
3348
        clients = {}
2596
3349
        with PGPEngine() as pgp:
2597
 
            for client in tcp_server.clients.itervalues():
 
3350
            for client in tcp_server.clients.values():
2598
3351
                key = client_settings[client.name]["secret"]
2599
3352
                client.encrypted_secret = pgp.encrypt(client.secret,
2600
3353
                                                      key)
2602
3355
                
2603
3356
                # A list of attributes that can not be pickled
2604
3357
                # + secret.
2605
 
                exclude = set(("bus", "changedstate", "secret",
2606
 
                               "checker"))
2607
 
                for name, typ in (inspect.getmembers
2608
 
                                  (dbus.service.Object)):
 
3358
                exclude = { "bus", "changedstate", "secret",
 
3359
                            "checker", "server_settings" }
 
3360
                for name, typ in inspect.getmembers(dbus.service
 
3361
                                                    .Object):
2609
3362
                    exclude.add(name)
2610
3363
                
2611
3364
                client_dict["encrypted_secret"] = (client
2618
3371
                del client_settings[client.name]["secret"]
2619
3372
        
2620
3373
        try:
2621
 
            with (tempfile.NamedTemporaryFile
2622
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2623
 
                   dir=os.path.dirname(stored_state_path),
2624
 
                   delete=False)) as stored_state:
2625
 
                pickle.dump((clients, client_settings), stored_state)
2626
 
                tempname=stored_state.name
 
3374
            with tempfile.NamedTemporaryFile(
 
3375
                    mode='wb',
 
3376
                    suffix=".pickle",
 
3377
                    prefix='clients-',
 
3378
                    dir=os.path.dirname(stored_state_path),
 
3379
                    delete=False) as stored_state:
 
3380
                pickle.dump((clients, client_settings), stored_state,
 
3381
                            protocol = 2)
 
3382
                tempname = stored_state.name
2627
3383
            os.rename(tempname, stored_state_path)
2628
3384
        except (IOError, OSError) as e:
2629
3385
            if not debug:
2632
3388
                except NameError:
2633
3389
                    pass
2634
3390
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2635
 
                logger.warning("Could not save persistent state: {0}"
 
3391
                logger.warning("Could not save persistent state: {}"
2636
3392
                               .format(os.strerror(e.errno)))
2637
3393
            else:
2638
3394
                logger.warning("Could not save persistent state:",
2639
3395
                               exc_info=e)
2640
 
                raise e
 
3396
                raise
2641
3397
        
2642
3398
        # Delete all clients, and settings from config
2643
3399
        while tcp_server.clients:
2644
3400
            name, client = tcp_server.clients.popitem()
2645
3401
            if use_dbus:
2646
3402
                client.remove_from_connection()
2647
 
            # Don't signal anything except ClientRemoved
 
3403
            # Don't signal the disabling
2648
3404
            client.disable(quiet=True)
 
3405
            # Emit D-Bus signal for removal
2649
3406
            if use_dbus:
2650
 
                # Emit D-Bus signal
2651
 
                mandos_dbus_service.ClientRemoved(client
2652
 
                                                  .dbus_object_path,
2653
 
                                                  client.name)
 
3407
                mandos_dbus_service.client_removed_signal(client)
2654
3408
        client_settings.clear()
2655
3409
    
2656
3410
    atexit.register(cleanup)
2657
3411
    
2658
 
    for client in tcp_server.clients.itervalues():
 
3412
    for client in tcp_server.clients.values():
2659
3413
        if use_dbus:
2660
 
            # Emit D-Bus signal
2661
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
3414
            # Emit D-Bus signal for adding
 
3415
            mandos_dbus_service.client_added_signal(client)
2662
3416
        # Need to initiate checking of clients
2663
3417
        if client.enabled:
2664
3418
            client.init_checker()
2667
3421
    tcp_server.server_activate()
2668
3422
    
2669
3423
    # Find out what port we got
2670
 
    service.port = tcp_server.socket.getsockname()[1]
 
3424
    if zeroconf:
 
3425
        service.port = tcp_server.socket.getsockname()[1]
2671
3426
    if use_ipv6:
2672
3427
        logger.info("Now listening on address %r, port %d,"
2673
3428
                    " flowinfo %d, scope_id %d",
2679
3434
    #service.interface = tcp_server.socket.getsockname()[3]
2680
3435
    
2681
3436
    try:
2682
 
        # From the Avahi example code
2683
 
        try:
2684
 
            service.activate()
2685
 
        except dbus.exceptions.DBusException as error:
2686
 
            logger.critical("D-Bus Exception", exc_info=error)
2687
 
            cleanup()
2688
 
            sys.exit(1)
2689
 
        # End of Avahi example code
 
3437
        if zeroconf:
 
3438
            # From the Avahi example code
 
3439
            try:
 
3440
                service.activate()
 
3441
            except dbus.exceptions.DBusException as error:
 
3442
                logger.critical("D-Bus Exception", exc_info=error)
 
3443
                cleanup()
 
3444
                sys.exit(1)
 
3445
            # End of Avahi example code
2690
3446
        
2691
 
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2692
 
                             lambda *args, **kwargs:
2693
 
                             (tcp_server.handle_request
2694
 
                              (*args[2:], **kwargs) or True))
 
3447
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
 
3448
                          lambda *args, **kwargs:
 
3449
                          (tcp_server.handle_request
 
3450
                           (*args[2:], **kwargs) or True))
2695
3451
        
2696
3452
        logger.debug("Starting main loop")
2697
3453
        main_loop.run()
2707
3463
    # Must run before the D-Bus bus name gets deregistered
2708
3464
    cleanup()
2709
3465
 
 
3466
 
2710
3467
if __name__ == '__main__':
2711
3468
    main()