/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
237.7.354 by Teddy Hogeborn
Fix Debian dependency bugs and lintian checks.
1
#!/usr/bin/python
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2
# -*- mode: python; coding: utf-8 -*-
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
4
# Mandos server - give out binary blobs to connecting clients.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
5
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
237.2.99 by Teddy Hogeborn
Code cleanup.
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
12
#
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
237.7.355 by Teddy Hogeborn
Update copyright year.
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
16
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
19
# the Free Software Foundation, either version 3 of the License, or
20
# (at your option) any later version.
21
#
22
#     This program is distributed in the hope that it will be useful,
23
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
24
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25
#     GNU General Public License for more details.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
26
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
27
# You should have received a copy of the GNU General Public License
109 by Teddy Hogeborn
* .bzrignore: New.
28
# along with this program.  If not, see
29
# <http://www.gnu.org/licenses/>.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
30
#
237.11.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
31
# Contact the authors at <mandos@recompile.se>.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
32
#
3 by Björn Påhlsson
Python based server
33
237.8.5 by teddy at bsnet
* mandos: Use unicode string literals.
34
from __future__ import (division, absolute_import, print_function,
35
                        unicode_literals)
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
36
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
37
try:
38
    from future_builtins import *
39
except ImportError:
40
    pass
237.7.127 by Teddy Hogeborn
* mandos: Use all new builtins.
41
237.7.297 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
42
try:
43
    import SocketServer as socketserver
44
except ImportError:
45
    import socketserver
3 by Björn Påhlsson
Python based server
46
import socket
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
47
import argparse
3 by Björn Påhlsson
Python based server
48
import datetime
49
import errno
237.7.297 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
50
try:
51
    import ConfigParser as configparser
52
except ImportError:
53
    import configparser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
54
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
55
import re
56
import os
57
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
58
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
59
import atexit
60
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
61
import logging
62
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
63
import pwd
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
64
import contextlib
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
65
import struct
66
import fcntl
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
67
import functools
237.7.297 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
68
try:
69
    import cPickle as pickle
70
except ImportError:
71
    import pickle
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
72
import multiprocessing
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
73
import types
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
74
import binascii
75
import tempfile
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
76
import itertools
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
77
import collections
237.7.299 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
78
import codecs
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
79
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
80
import dbus
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
81
import dbus.service
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
82
from gi.repository import GLib
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
83
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
84
import ctypes
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
85
import ctypes.util
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
86
import xml.dom.minidom
87
import inspect
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
88
237.7.400 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
89
# Try to find the value of SO_BINDTODEVICE:
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
90
try:
237.7.400 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
91
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
    # newer, and it is also the most natural place for it:
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
93
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
except AttributeError:
95
    try:
237.7.400 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
96
        # This is where SO_BINDTODEVICE was up to and including Python
97
        # 2.6, and also 3.2:
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
98
        from IN import SO_BINDTODEVICE
99
    except ImportError:
237.7.400 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
100
        # In Python 2.7 it seems to have been removed entirely.
101
        # Try running the C preprocessor:
102
        try:
103
            cc = subprocess.Popen(["cc", "--language=c", "-E",
104
                                   "/dev/stdin"],
105
                                  stdin=subprocess.PIPE,
106
                                  stdout=subprocess.PIPE)
107
            stdout = cc.communicate(
108
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
        except (OSError, ValueError, IndexError):
111
            # No value found
112
            SO_BINDTODEVICE = None
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
113
237.7.278 by Teddy Hogeborn
mandos: Replace unicode() with str().
114
if sys.version_info.major == 2:
115
    str = unicode
116
357 by Teddy Hogeborn
* Makefile (version): Change to 1.7.14.
117
version = "1.7.14"
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
118
stored_state_file = "clients.pickle"
13 by Björn Påhlsson
Added following support:
119
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
120
logger = logging.getLogger()
237.7.203 by Teddy Hogeborn
Allow self-tests to run without needing /dev/log.
121
syslogger = None
13 by Björn Påhlsson
Added following support:
122
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
123
try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
124
    if_nametoindex = ctypes.cdll.LoadLibrary(
125
        ctypes.util.find_library("c")).if_nametoindex
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
126
except (OSError, AttributeError):
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
127
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
128
    def if_nametoindex(interface):
129
        "Get an interface index the hard way, i.e. using fcntl()"
130
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
131
        with contextlib.closing(socket.socket()) as s:
132
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
237.7.277 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
133
                                struct.pack(b"16s16x", interface))
134
        interface_index = struct.unpack("I", ifreq[16:20])[0]
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
135
        return interface_index
136
137
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
138
def copy_function(func):
139
    """Make a copy of a function"""
140
    if sys.version_info.major == 2:
141
        return types.FunctionType(func.func_code,
142
                                  func.func_globals,
143
                                  func.func_name,
144
                                  func.func_defaults,
145
                                  func.func_closure)
146
    else:
147
        return types.FunctionType(func.__code__,
148
                                  func.__globals__,
149
                                  func.__name__,
150
                                  func.__defaults__,
151
                                  func.__closure__)
152
153
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
154
def initlogger(debug, level=logging.WARNING):
237.12.4 by Björn Påhlsson
restructured logger
155
    """init logger and add loglevel"""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
156
237.7.246 by Teddy Hogeborn
Fix mandos server "--servicename" option, broken since 1.6.4.
157
    global syslogger
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
158
    syslogger = (logging.handlers.SysLogHandler(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
159
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
160
        address="/dev/log"))
237.12.4 by Björn Påhlsson
restructured logger
161
    syslogger.setFormatter(logging.Formatter
162
                           ('Mandos [%(process)d]: %(levelname)s:'
163
                            ' %(message)s'))
164
    logger.addHandler(syslogger)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
165
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
166
    if debug:
167
        console = logging.StreamHandler()
168
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
169
                                               ' [%(process)d]:'
170
                                               ' %(levelname)s:'
171
                                               ' %(message)s'))
172
        logger.addHandler(console)
237.12.4 by Björn Påhlsson
restructured logger
173
    logger.setLevel(level)
28 by Teddy Hogeborn
* server.conf: New file.
174
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
175
237.12.9 by Björn Påhlsson
renamed variables
176
class PGPError(Exception):
177
    """Exception if encryption/decryption fails"""
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
178
    pass
179
180
237.12.9 by Björn Påhlsson
renamed variables
181
class PGPEngine(object):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
182
    """A simple class for OpenPGP symmetric encryption & decryption"""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
183
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
184
    def __init__(self):
185
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
237.7.353 by Teddy Hogeborn
Use GnuPG 2 if available
186
        self.gpg = "gpg"
187
        try:
188
            output = subprocess.check_output(["gpgconf"])
189
            for line in output.splitlines():
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
190
                name, text, path = line.split(b":")
237.7.353 by Teddy Hogeborn
Use GnuPG 2 if available
191
                if name == "gpg":
192
                    self.gpg = path
193
                    break
194
        except OSError as e:
195
            if e.errno != errno.ENOENT:
196
                raise
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
197
        self.gnupgargs = ['--batch',
237.7.353 by Teddy Hogeborn
Use GnuPG 2 if available
198
                          '--homedir', self.tempdir,
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
199
                          '--force-mdc',
237.7.397 by Teddy Hogeborn
mandos: Bug fix: Only use the --no-use-agent option for GPG 1
200
                          '--quiet']
201
        # Only GPG version 1 has the --no-use-agent option.
202
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
            self.gnupgargs.append("--no-use-agent")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
204
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
205
    def __enter__(self):
206
        return self
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
207
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
208
    def __exit__(self, exc_type, exc_value, traceback):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
209
        self._cleanup()
210
        return False
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
211
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
212
    def __del__(self):
213
        self._cleanup()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
214
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
215
    def _cleanup(self):
216
        if self.tempdir is not None:
217
            # Delete contents of tempdir
218
            for root, dirs, files in os.walk(self.tempdir,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
219
                                             topdown=False):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
220
                for filename in files:
221
                    os.remove(os.path.join(root, filename))
222
                for dirname in dirs:
223
                    os.rmdir(os.path.join(root, dirname))
224
            # Remove tempdir
225
            os.rmdir(self.tempdir)
226
            self.tempdir = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
227
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
228
    def password_encode(self, password):
229
        # Passphrase can not be empty and can not contain newlines or
230
        # NUL bytes.  So we prefix it and hex encode it.
237.7.178 by Teddy Hogeborn
* mandos (PGPEngine.password_encode): Bug fix: GnuPG can't handle
231
        encoded = b"mandos" + binascii.hexlify(password)
232
        if len(encoded) > 2048:
233
            # GnuPG can't handle long passwords, so encode differently
234
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
235
                       .replace(b"\n", b"\\n")
236
                       .replace(b"\0", b"\\x00"))
237
        return encoded
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
238
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
239
    def encrypt(self, data, password):
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
240
        passphrase = self.password_encode(password)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
241
        with tempfile.NamedTemporaryFile(
242
                dir=self.tempdir) as passfile:
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
243
            passfile.write(passphrase)
244
            passfile.flush()
237.7.353 by Teddy Hogeborn
Use GnuPG 2 if available
245
            proc = subprocess.Popen([self.gpg, '--symmetric',
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
246
                                     '--passphrase-file',
247
                                     passfile.name]
248
                                    + self.gnupgargs,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
249
                                    stdin=subprocess.PIPE,
250
                                    stdout=subprocess.PIPE,
251
                                    stderr=subprocess.PIPE)
252
            ciphertext, err = proc.communicate(input=data)
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
253
        if proc.returncode != 0:
254
            raise PGPError(err)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
255
        return ciphertext
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
256
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
257
    def decrypt(self, data, password):
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
258
        passphrase = self.password_encode(password)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
259
        with tempfile.NamedTemporaryFile(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
260
                dir=self.tempdir) as passfile:
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
261
            passfile.write(passphrase)
262
            passfile.flush()
237.7.353 by Teddy Hogeborn
Use GnuPG 2 if available
263
            proc = subprocess.Popen([self.gpg, '--decrypt',
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
264
                                     '--passphrase-file',
265
                                     passfile.name]
266
                                    + self.gnupgargs,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
267
                                    stdin=subprocess.PIPE,
268
                                    stdout=subprocess.PIPE,
269
                                    stderr=subprocess.PIPE)
270
            decrypted_plaintext, err = proc.communicate(input=data)
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
271
        if proc.returncode != 0:
272
            raise PGPError(err)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
273
        return decrypted_plaintext
274
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
275
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
276
# Pretend that we have an Avahi module
277
class Avahi(object):
278
    """This isn't so much a class as it is a module-like namespace.
279
    It is instantiated once, and simulates having an Avahi module."""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
280
    IF_UNSPEC = -1               # avahi-common/address.h
281
    PROTO_UNSPEC = -1            # avahi-common/address.h
282
    PROTO_INET = 0               # avahi-common/address.h
283
    PROTO_INET6 = 1              # avahi-common/address.h
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
284
    DBUS_NAME = "org.freedesktop.Avahi"
285
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
    DBUS_PATH_SERVER = "/"
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
288
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
289
    def string_array_to_txt_array(self, t):
290
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
                           for s in t), signature="ay")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
292
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
293
    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h
294
    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h
295
    SERVER_INVALID = 0           # avahi-common/defs.h
296
    SERVER_REGISTERING = 1       # avahi-common/defs.h
297
    SERVER_RUNNING = 2           # avahi-common/defs.h
298
    SERVER_COLLISION = 3         # avahi-common/defs.h
299
    SERVER_FAILURE = 4           # avahi-common/defs.h
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
300
avahi = Avahi()
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
301
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
302
28 by Teddy Hogeborn
* server.conf: New file.
303
class AvahiError(Exception):
237.2.5 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
304
    def __init__(self, value, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
305
        self.value = value
237.7.277 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
306
        return super(AvahiError, self).__init__(value, *args,
307
                                                **kwargs)
28 by Teddy Hogeborn
* server.conf: New file.
308
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
309
28 by Teddy Hogeborn
* server.conf: New file.
310
class AvahiServiceError(AvahiError):
311
    pass
312
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
313
28 by Teddy Hogeborn
* server.conf: New file.
314
class AvahiGroupError(AvahiError):
315
    pass
316
317
318
class AvahiService(object):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
319
    """An Avahi (Zeroconf) service.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
320
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
321
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
322
    interface: integer; avahi.IF_UNSPEC or an interface index.
323
               Used to optionally bind to the specified interface.
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
324
    name: string; Example: 'Mandos'
325
    type: string; Example: '_mandos._tcp'.
237.7.162 by Teddy Hogeborn
* mandos: Comment changes.
326
     See <https://www.iana.org/assignments/service-names-port-numbers>
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
327
    port: integer; what port to announce
328
    TXT: list of strings; TXT record for the service
329
    domain: string; Domain to publish on, default to .local if empty.
330
    host: string; Host to publish records for, default is localhost
331
    max_renames: integer; maximum number of renames
332
    rename_count: integer; counter so we only rename after collisions
333
                  a sensible number of times
237.2.99 by Teddy Hogeborn
Code cleanup.
334
    group: D-Bus Entry Group
335
    server: D-Bus Server
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
336
    bus: dbus.SystemBus()
28 by Teddy Hogeborn
* server.conf: New file.
337
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
338
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
339
    def __init__(self,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
340
                 interface=avahi.IF_UNSPEC,
341
                 name=None,
342
                 servicetype=None,
343
                 port=None,
344
                 TXT=None,
345
                 domain="",
346
                 host="",
347
                 max_renames=32768,
348
                 protocol=avahi.PROTO_UNSPEC,
349
                 bus=None):
28 by Teddy Hogeborn
* server.conf: New file.
350
        self.interface = interface
351
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
352
        self.type = servicetype
28 by Teddy Hogeborn
* server.conf: New file.
353
        self.port = port
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
354
        self.TXT = TXT if TXT is not None else []
28 by Teddy Hogeborn
* server.conf: New file.
355
        self.domain = domain
356
        self.host = host
357
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
358
        self.max_renames = max_renames
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
359
        self.protocol = protocol
237.2.99 by Teddy Hogeborn
Code cleanup.
360
        self.group = None       # our entry group
361
        self.server = None
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
362
        self.bus = bus
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
363
        self.entry_group_state_changed_match = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
364
237.7.286 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
365
    def rename(self, remove=True):
28 by Teddy Hogeborn
* server.conf: New file.
366
        """Derived from the Avahi example code"""
367
        if self.rename_count >= self.max_renames:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
368
            logger.critical("No suitable Zeroconf service name found"
369
                            " after %i retries, exiting.",
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
370
                            self.rename_count)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
371
            raise AvahiServiceError("Too many renames")
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
372
        self.name = str(
373
            self.server.GetAlternativeServiceName(self.name))
237.7.286 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
374
        self.rename_count += 1
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
375
        logger.info("Changing Zeroconf service name to %r ...",
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
376
                    self.name)
237.7.286 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
377
        if remove:
378
            self.remove()
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
379
        try:
380
            self.add()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
381
        except dbus.exceptions.DBusException as error:
237.7.286 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
382
            if (error.get_dbus_name()
383
                == "org.freedesktop.Avahi.CollisionError"):
384
                logger.info("Local Zeroconf service name collision.")
385
                return self.rename(remove=False)
386
            else:
387
                logger.critical("D-Bus Exception", exc_info=error)
388
                self.cleanup()
389
                os._exit(1)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
390
28 by Teddy Hogeborn
* server.conf: New file.
391
    def remove(self):
392
        """Derived from the Avahi example code"""
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
393
        if self.entry_group_state_changed_match is not None:
394
            self.entry_group_state_changed_match.remove()
395
            self.entry_group_state_changed_match = None
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
396
        if self.group is not None:
397
            self.group.Reset()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
398
28 by Teddy Hogeborn
* server.conf: New file.
399
    def add(self):
400
        """Derived from the Avahi example code"""
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
401
        self.remove()
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
402
        if self.group is None:
403
            self.group = dbus.Interface(
404
                self.bus.get_object(avahi.DBUS_NAME,
405
                                    self.server.EntryGroupNew()),
406
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
407
        self.entry_group_state_changed_match = (
408
            self.group.connect_to_signal(
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
409
                'StateChanged', self.entry_group_state_changed))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
410
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
237.2.99 by Teddy Hogeborn
Code cleanup.
411
                     self.name, self.type)
412
        self.group.AddService(
413
            self.interface,
414
            self.protocol,
415
            dbus.UInt32(0),     # flags
416
            self.name, self.type,
417
            self.domain, self.host,
418
            dbus.UInt16(self.port),
419
            avahi.string_array_to_txt_array(self.TXT))
420
        self.group.Commit()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
421
237.2.99 by Teddy Hogeborn
Code cleanup.
422
    def entry_group_state_changed(self, state, error):
423
        """Derived from the Avahi example code"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
424
        logger.debug("Avahi entry group state change: %i", state)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
425
237.2.99 by Teddy Hogeborn
Code cleanup.
426
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
427
            logger.debug("Zeroconf service established.")
237.2.99 by Teddy Hogeborn
Code cleanup.
428
        elif state == avahi.ENTRY_GROUP_COLLISION:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
429
            logger.info("Zeroconf service name collision.")
237.2.99 by Teddy Hogeborn
Code cleanup.
430
            self.rename()
431
        elif state == avahi.ENTRY_GROUP_FAILURE:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
432
            logger.critical("Avahi: Error in group state changed %s",
237.7.278 by Teddy Hogeborn
mandos: Replace unicode() with str().
433
                            str(error))
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
434
            raise AvahiGroupError("State changed: {!s}".format(error))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
435
237.2.99 by Teddy Hogeborn
Code cleanup.
436
    def cleanup(self):
437
        """Derived from the Avahi example code"""
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
438
        if self.group is not None:
439
            try:
440
                self.group.Free()
441
            except (dbus.exceptions.UnknownMethodException,
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
442
                    dbus.exceptions.DBusException):
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
443
                pass
444
            self.group = None
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
445
        self.remove()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
446
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
447
    def server_state_changed(self, state, error=None):
237.2.99 by Teddy Hogeborn
Code cleanup.
448
        """Derived from the Avahi example code"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
449
        logger.debug("Avahi server state change: %i", state)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
450
        bad_states = {
451
            avahi.SERVER_INVALID: "Zeroconf server invalid",
452
            avahi.SERVER_REGISTERING: None,
453
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
454
            avahi.SERVER_FAILURE: "Zeroconf server failure",
455
        }
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
456
        if state in bad_states:
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
457
            if bad_states[state] is not None:
458
                if error is None:
459
                    logger.error(bad_states[state])
460
                else:
461
                    logger.error(bad_states[state] + ": %r", error)
462
            self.cleanup()
237.2.99 by Teddy Hogeborn
Code cleanup.
463
        elif state == avahi.SERVER_RUNNING:
237.7.317 by Teddy Hogeborn
Handle local Zeroconf service name collisions on startup, too.
464
            try:
465
                self.add()
466
            except dbus.exceptions.DBusException as error:
467
                if (error.get_dbus_name()
468
                    == "org.freedesktop.Avahi.CollisionError"):
469
                    logger.info("Local Zeroconf service name"
470
                                " collision.")
471
                    return self.rename(remove=False)
472
                else:
473
                    logger.critical("D-Bus Exception", exc_info=error)
474
                    self.cleanup()
475
                    os._exit(1)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
476
        else:
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
477
            if error is None:
478
                logger.debug("Unknown state: %r", state)
479
            else:
480
                logger.debug("Unknown state: %r: %r", state, error)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
481
237.2.99 by Teddy Hogeborn
Code cleanup.
482
    def activate(self):
483
        """Derived from the Avahi example code"""
484
        if self.server is None:
485
            self.server = dbus.Interface(
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
486
                self.bus.get_object(avahi.DBUS_NAME,
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
487
                                    avahi.DBUS_PATH_SERVER,
488
                                    follow_name_owner_changes=True),
237.2.99 by Teddy Hogeborn
Code cleanup.
489
                avahi.DBUS_INTERFACE_SERVER)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
490
        self.server.connect_to_signal("StateChanged",
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
491
                                      self.server_state_changed)
237.2.99 by Teddy Hogeborn
Code cleanup.
492
        self.server_state_changed(self.server.GetState())
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
493
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
494
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
495
class AvahiServiceToSyslog(AvahiService):
237.7.286 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
496
    def rename(self, *args, **kwargs):
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
497
        """Add the new name to the syslog messages"""
237.7.286 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
498
        ret = AvahiService.rename(self, *args, **kwargs)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
499
        syslogger.setFormatter(logging.Formatter(
500
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
501
            .format(self.name)))
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
502
        return ret
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
503
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
504
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
505
# Pretend that we have a GnuTLS module
506
class GnuTLS(object):
507
    """This isn't so much a class as it is a module-like namespace.
508
    It is instantiated once, and simulates having a GnuTLS module."""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
509
237.7.423 by Teddy Hogeborn
Fix bug where mandos server could not find GnuTLS library
510
    library = ctypes.util.find_library("gnutls")
511
    if library is None:
512
        library = ctypes.util.find_library("gnutls-deb0")
513
    _library = ctypes.cdll.LoadLibrary(library)
514
    del library
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
515
    _need_version = b"3.3.0"
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
516
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
517
    def __init__(self):
237.7.432 by Teddy Hogeborn
mandos: Use "self" instead of class name "GnuTLS" in __init__.
518
        # Need to use "self" here, since this method is called before
519
        # the assignment to the "gnutls" global variable happens.
520
        if self.check_version(self._need_version) is None:
521
            raise self.Error("Needs GnuTLS {} or later"
522
                             .format(self._need_version))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
523
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
524
    # Unless otherwise indicated, the constants and types below are
525
    # all from the gnutls/gnutls.h C header file.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
526
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
527
    # Constants
528
    E_SUCCESS = 0
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
529
    E_INTERRUPTED = -52
530
    E_AGAIN = -28
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
531
    CRT_OPENPGP = 2
532
    CLIENT = 2
533
    SHUT_RDWR = 0
534
    CRD_CERTIFICATE = 1
535
    E_NO_CERTIFICATE_FOUND = -49
536
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
537
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
538
    # Types
539
    class session_int(ctypes.Structure):
540
        _fields_ = []
541
    session_t = ctypes.POINTER(session_int)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
542
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
543
    class certificate_credentials_st(ctypes.Structure):
544
        _fields_ = []
545
    certificate_credentials_t = ctypes.POINTER(
546
        certificate_credentials_st)
547
    certificate_type_t = ctypes.c_int
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
548
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
549
    class datum_t(ctypes.Structure):
550
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
551
                    ('size', ctypes.c_uint)]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
552
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
553
    class openpgp_crt_int(ctypes.Structure):
554
        _fields_ = []
555
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
556
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
557
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
237.7.372 by Teddy Hogeborn
Remove empty comment
558
    credentials_type_t = ctypes.c_int
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
559
    transport_ptr_t = ctypes.c_void_p
560
    close_request_t = ctypes.c_int
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
561
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
562
    # Exceptions
563
    class Error(Exception):
564
        # We need to use the class name "GnuTLS" here, since this
565
        # exception might be raised from within GnuTLS.__init__,
566
        # which is called before the assignment to the "gnutls"
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
567
        # global variable has happened.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
568
        def __init__(self, message=None, code=None, args=()):
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
569
            # Default usage is by a message string, but if a return
570
            # code is passed, convert it to a string with
571
            # gnutls.strerror()
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
572
            self.code = code
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
573
            if message is None and code is not None:
574
                message = GnuTLS.strerror(code)
575
            return super(GnuTLS.Error, self).__init__(
576
                message, *args)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
577
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
578
    class CertificateSecurityError(Error):
579
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
580
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
581
    # Classes
582
    class Credentials(object):
583
        def __init__(self):
584
            self._c_object = gnutls.certificate_credentials_t()
585
            gnutls.certificate_allocate_credentials(
586
                ctypes.byref(self._c_object))
587
            self.type = gnutls.CRD_CERTIFICATE
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
588
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
589
        def __del__(self):
590
            gnutls.certificate_free_credentials(self._c_object)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
591
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
592
    class ClientSession(object):
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
593
        def __init__(self, socket, credentials=None):
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
594
            self._c_object = gnutls.session_t()
595
            gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
596
            gnutls.set_default_priority(self._c_object)
597
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
598
            gnutls.handshake_set_private_extensions(self._c_object,
599
                                                    True)
600
            self.socket = socket
601
            if credentials is None:
602
                credentials = gnutls.Credentials()
603
            gnutls.credentials_set(self._c_object, credentials.type,
604
                                   ctypes.cast(credentials._c_object,
605
                                               ctypes.c_void_p))
606
            self.credentials = credentials
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
607
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
608
        def __del__(self):
609
            gnutls.deinit(self._c_object)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
610
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
611
        def handshake(self):
612
            return gnutls.handshake(self._c_object)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
613
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
614
        def send(self, data):
615
            data = bytes(data)
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
616
            data_len = len(data)
617
            while data_len > 0:
618
                data_len -= gnutls.record_send(self._c_object,
619
                                               data[-data_len:],
620
                                               data_len)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
621
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
622
        def bye(self):
623
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
624
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
625
    # Error handling functions
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
626
    def _error_code(result):
627
        """A function to raise exceptions on errors, suitable
628
        for the 'restype' attribute on ctypes functions"""
629
        if result >= 0:
630
            return result
631
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
632
            raise gnutls.CertificateSecurityError(code=result)
633
        raise gnutls.Error(code=result)
634
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
635
    def _retry_on_error(result, func, arguments):
636
        """A function to retry on some errors, suitable
637
        for the 'errcheck' attribute on ctypes functions"""
638
        while result < 0:
639
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
640
                return _error_code(result)
641
            result = func(*arguments)
642
        return result
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
643
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
644
    # Unless otherwise indicated, the function declarations below are
645
    # all from the gnutls/gnutls.h C header file.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
646
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
647
    # Functions
648
    priority_set_direct = _library.gnutls_priority_set_direct
649
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
650
                                    ctypes.POINTER(ctypes.c_char_p)]
651
    priority_set_direct.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
652
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
653
    init = _library.gnutls_init
654
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
655
    init.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
656
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
657
    set_default_priority = _library.gnutls_set_default_priority
658
    set_default_priority.argtypes = [session_t]
659
    set_default_priority.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
660
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
661
    record_send = _library.gnutls_record_send
662
    record_send.argtypes = [session_t, ctypes.c_void_p,
663
                            ctypes.c_size_t]
664
    record_send.restype = ctypes.c_ssize_t
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
665
    record_send.errcheck = _retry_on_error
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
666
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
667
    certificate_allocate_credentials = (
668
        _library.gnutls_certificate_allocate_credentials)
669
    certificate_allocate_credentials.argtypes = [
670
        ctypes.POINTER(certificate_credentials_t)]
671
    certificate_allocate_credentials.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
672
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
673
    certificate_free_credentials = (
674
        _library.gnutls_certificate_free_credentials)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
675
    certificate_free_credentials.argtypes = [
676
        certificate_credentials_t]
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
677
    certificate_free_credentials.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
678
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
679
    handshake_set_private_extensions = (
680
        _library.gnutls_handshake_set_private_extensions)
681
    handshake_set_private_extensions.argtypes = [session_t,
682
                                                 ctypes.c_int]
683
    handshake_set_private_extensions.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
684
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
685
    credentials_set = _library.gnutls_credentials_set
686
    credentials_set.argtypes = [session_t, credentials_type_t,
687
                                ctypes.c_void_p]
688
    credentials_set.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
689
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
690
    strerror = _library.gnutls_strerror
691
    strerror.argtypes = [ctypes.c_int]
692
    strerror.restype = ctypes.c_char_p
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
693
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
694
    certificate_type_get = _library.gnutls_certificate_type_get
695
    certificate_type_get.argtypes = [session_t]
696
    certificate_type_get.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
697
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
698
    certificate_get_peers = _library.gnutls_certificate_get_peers
699
    certificate_get_peers.argtypes = [session_t,
700
                                      ctypes.POINTER(ctypes.c_uint)]
701
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
702
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
703
    global_set_log_level = _library.gnutls_global_set_log_level
704
    global_set_log_level.argtypes = [ctypes.c_int]
705
    global_set_log_level.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
706
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
707
    global_set_log_function = _library.gnutls_global_set_log_function
708
    global_set_log_function.argtypes = [log_func]
709
    global_set_log_function.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
710
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
711
    deinit = _library.gnutls_deinit
712
    deinit.argtypes = [session_t]
713
    deinit.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
714
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
715
    handshake = _library.gnutls_handshake
716
    handshake.argtypes = [session_t]
717
    handshake.restype = _error_code
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
718
    handshake.errcheck = _retry_on_error
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
719
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
720
    transport_set_ptr = _library.gnutls_transport_set_ptr
721
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
722
    transport_set_ptr.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
723
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
724
    bye = _library.gnutls_bye
725
    bye.argtypes = [session_t, close_request_t]
726
    bye.restype = _error_code
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
727
    bye.errcheck = _retry_on_error
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
728
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
729
    check_version = _library.gnutls_check_version
730
    check_version.argtypes = [ctypes.c_char_p]
731
    check_version.restype = ctypes.c_char_p
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
732
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
733
    # All the function declarations below are from gnutls/openpgp.h
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
734
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
735
    openpgp_crt_init = _library.gnutls_openpgp_crt_init
736
    openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
737
    openpgp_crt_init.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
738
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
739
    openpgp_crt_import = _library.gnutls_openpgp_crt_import
740
    openpgp_crt_import.argtypes = [openpgp_crt_t,
741
                                   ctypes.POINTER(datum_t),
742
                                   openpgp_crt_fmt_t]
743
    openpgp_crt_import.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
744
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
745
    openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
746
    openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
747
                                        ctypes.POINTER(ctypes.c_uint)]
748
    openpgp_crt_verify_self.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
749
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
750
    openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
751
    openpgp_crt_deinit.argtypes = [openpgp_crt_t]
752
    openpgp_crt_deinit.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
753
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
754
    openpgp_crt_get_fingerprint = (
755
        _library.gnutls_openpgp_crt_get_fingerprint)
756
    openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
757
                                            ctypes.c_void_p,
758
                                            ctypes.POINTER(
759
                                                ctypes.c_size_t)]
760
    openpgp_crt_get_fingerprint.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
761
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
762
    # Remove non-public functions
763
    del _error_code, _retry_on_error
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
764
# Create the global "gnutls" object, simulating a module
765
gnutls = GnuTLS()
766
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
767
237.24.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
768
def call_pipe(connection,       # : multiprocessing.Connection
769
              func, *args, **kwargs):
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
770
    """This function is meant to be called by multiprocessing.Process
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
771
237.24.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
772
    This function runs func(*args, **kwargs), and writes the resulting
773
    return value on the provided multiprocessing.Connection.
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
774
    """
237.24.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
775
    connection.send(func(*args, **kwargs))
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
776
    connection.close()
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
777
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
778
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
779
class Client(object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
780
    """A representation of a client host served by this server.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
781
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
782
    Attributes:
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
783
    approved:   bool(); 'None' if not yet approved/disapproved
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
784
    approval_delay: datetime.timedelta(); Time to wait for approval
785
    approval_duration: datetime.timedelta(); Duration of one approval
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
786
    checker:    subprocess.Popen(); a running checker process used
787
                                    to see if the client lives.
788
                                    'None' if no process is running.
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
789
    checker_callback_tag: a GLib event source tag, or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
790
    checker_command: string; External command which is run to check
791
                     if client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
792
                     runtime with vars(self) as dict, so that for
793
                     instance %(name)s can be used in the command.
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
794
    checker_initiator_tag: a GLib event source tag, or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
795
    created:    datetime.datetime(); (UTC) object creation
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
796
    client_structure: Object describing what attributes a client has
797
                      and is used for storing the client at exit
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
798
    current_checker_command: string; current running checker_command
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
799
    disable_initiator_tag: a GLib event source tag, or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
800
    enabled:    bool()
801
    fingerprint: string (40 or 32 hexadecimal digits); used to
802
                 uniquely identify the client
803
    host:       string; available for use by the checker command
804
    interval:   datetime.timedelta(); How often to start a new checker
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
805
    last_approval_request: datetime.datetime(); (UTC) or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
806
    last_checked_ok: datetime.datetime(); (UTC) or None
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
807
    last_checker_status: integer between 0 and 255 reflecting exit
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
808
                         status of last checker. -1 reflects crashed
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
809
                         checker, -2 means no checker completed yet.
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
810
    last_checker_signal: The signal which killed the last checker, if
811
                         last_checker_status is -1
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
812
    last_enabled: datetime.datetime(); (UTC) or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
813
    name:       string; from the config file, used in log messages and
814
                        D-Bus identifiers
815
    secret:     bytestring; sent verbatim (over TLS) to client
816
    timeout:    datetime.timedelta(); How long from last_checked_ok
817
                                      until this client is disabled
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
818
    extended_timeout:   extra long timeout when secret has been sent
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
819
    runtime_expansions: Allowed attributes for runtime expansion.
237.7.45 by Teddy Hogeborn
* DBUS-API: Document new "Expires" and "ExtendedTimeout" properties.
820
    expires:    datetime.datetime(); time (UTC) when a client will be
24.1.179 by Björn Påhlsson
New feature:
821
                disabled, or None
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
822
    server_settings: The server_settings dict from main()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
823
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
824
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
825
    runtime_expansions = ("approval_delay", "approval_duration",
237.7.132 by Teddy Hogeborn
* mandos (Client.runtime_expansions): Add "expires" and (bug fix)
826
                          "created", "enabled", "expires",
827
                          "fingerprint", "host", "interval",
828
                          "last_approval_request", "last_checked_ok",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
829
                          "last_enabled", "name", "timeout")
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
830
    client_defaults = {
831
        "timeout": "PT5M",
832
        "extended_timeout": "PT15M",
833
        "interval": "PT2M",
834
        "checker": "fping -q -- %%(host)s",
835
        "host": "",
836
        "approval_delay": "PT0S",
837
        "approval_duration": "PT1S",
838
        "approved_by_default": "True",
839
        "enabled": "True",
840
    }
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
841
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
842
    @staticmethod
843
    def config_parser(config):
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
844
        """Construct a new dict of client settings of this form:
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
845
        { client_name: {setting_name: value, ...}, ...}
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
846
        with exceptions for any special settings as defined above.
847
        NOTE: Must be a pure function. Must return the same result
848
        value given the same arguments.
849
        """
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
850
        settings = {}
851
        for client_name in config.sections():
852
            section = dict(config.items(client_name))
853
            client = settings[client_name] = {}
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
854
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
855
            client["host"] = section["host"]
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
856
            # Reformat values from string types to Python types
857
            client["approved_by_default"] = config.getboolean(
858
                client_name, "approved_by_default")
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
859
            client["enabled"] = config.getboolean(client_name,
860
                                                  "enabled")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
861
237.7.287 by Teddy Hogeborn
mandos (Client.config_parser): Move comment to correct place.
862
            # Uppercase and remove spaces from fingerprint for later
863
            # comparison purposes with return value from the
864
            # fingerprint() function
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
865
            client["fingerprint"] = (section["fingerprint"].upper()
866
                                     .replace(" ", ""))
867
            if "secret" in section:
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
868
                client["secret"] = codecs.decode(section["secret"]
869
                                                 .encode("utf-8"),
870
                                                 "base64")
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
871
            elif "secfile" in section:
872
                with open(os.path.expanduser(os.path.expandvars
873
                                             (section["secfile"])),
874
                          "rb") as secfile:
875
                    client["secret"] = secfile.read()
876
            else:
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
877
                raise TypeError("No secret or secfile for section {}"
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
878
                                .format(section))
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
879
            client["timeout"] = string_to_delta(section["timeout"])
880
            client["extended_timeout"] = string_to_delta(
881
                section["extended_timeout"])
882
            client["interval"] = string_to_delta(section["interval"])
883
            client["approval_delay"] = string_to_delta(
884
                section["approval_delay"])
885
            client["approval_duration"] = string_to_delta(
886
                section["approval_duration"])
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
887
            client["checker_command"] = section["checker"]
888
            client["last_approval_request"] = None
889
            client["last_checked_ok"] = None
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
890
            client["last_checker_status"] = -2
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
891
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
892
        return settings
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
893
894
    def __init__(self, settings, name=None, server_settings=None):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
895
        self.name = name
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
896
        if server_settings is None:
897
            server_settings = {}
898
        self.server_settings = server_settings
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
899
        # adding all client settings
237.23.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
900
        for setting, value in settings.items():
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
901
            setattr(self, setting, value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
902
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
903
        if self.enabled:
904
            if not hasattr(self, "last_enabled"):
905
                self.last_enabled = datetime.datetime.utcnow()
906
            if not hasattr(self, "expires"):
907
                self.expires = (datetime.datetime.utcnow()
908
                                + self.timeout)
909
        else:
910
            self.last_enabled = None
911
            self.expires = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
912
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
913
        logger.debug("Creating client %r", self.name)
914
        logger.debug("  Fingerprint: %s", self.fingerprint)
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
915
        self.created = settings.get("created",
916
                                    datetime.datetime.utcnow())
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
917
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
918
        # attributes specific for this server instance
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
919
        self.checker = None
920
        self.checker_initiator_tag = None
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
921
        self.disable_initiator_tag = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
922
        self.checker_callback_tag = None
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
923
        self.current_checker_command = None
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
924
        self.approved = None
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
925
        self.approvals_pending = 0
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
926
        self.changedstate = multiprocessing_manager.Condition(
927
            multiprocessing_manager.Lock())
928
        self.client_structure = [attr
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
929
                                 for attr in self.__dict__.keys()
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
930
                                 if not attr.startswith("_")]
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
931
        self.client_structure.append("client_structure")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
932
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
933
        for name, t in inspect.getmembers(
934
                type(self), lambda obj: isinstance(obj, property)):
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
935
            if not name.startswith("_"):
936
                self.client_structure.append(name)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
937
237.7.68 by Björn Påhlsson
merge persistent state
938
    # Send notice to process children that client state has changed
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
939
    def send_changedstate(self):
237.7.68 by Björn Påhlsson
merge persistent state
940
        with self.changedstate:
941
            self.changedstate.notify_all()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
942
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
943
    def enable(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
944
        """Start this client's checker and timeout hooks"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
945
        if getattr(self, "enabled", False):
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
946
            # Already enabled
947
            return
24.1.179 by Björn Påhlsson
New feature:
948
        self.expires = datetime.datetime.utcnow() + self.timeout
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
949
        self.enabled = True
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
950
        self.last_enabled = datetime.datetime.utcnow()
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
951
        self.init_checker()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
952
        self.send_changedstate()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
953
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
954
    def disable(self, quiet=True):
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
955
        """Disable this client."""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
956
        if not getattr(self, "enabled", False):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
957
            return False
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
958
        if not quiet:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
959
            logger.info("Disabling client %s", self.name)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
960
        if getattr(self, "disable_initiator_tag", None) is not None:
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
961
            GLib.source_remove(self.disable_initiator_tag)
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
962
            self.disable_initiator_tag = None
24.1.179 by Björn Påhlsson
New feature:
963
        self.expires = None
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
964
        if getattr(self, "checker_initiator_tag", None) is not None:
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
965
            GLib.source_remove(self.checker_initiator_tag)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
966
            self.checker_initiator_tag = None
967
        self.stop_checker()
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
968
        self.enabled = False
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
969
        if not quiet:
970
            self.send_changedstate()
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
971
        # Do not run this again if called by a GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
972
        return False
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
973
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
974
    def __del__(self):
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
975
        self.disable()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
976
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
977
    def init_checker(self):
978
        # Schedule a new checker to be started an 'interval' from now,
979
        # and every interval from then on.
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
980
        if self.checker_initiator_tag is not None:
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
981
            GLib.source_remove(self.checker_initiator_tag)
982
        self.checker_initiator_tag = GLib.timeout_add(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
983
            int(self.interval.total_seconds() * 1000),
984
            self.start_checker)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
985
        # Schedule a disable() when 'timeout' has passed
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
986
        if self.disable_initiator_tag is not None:
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
987
            GLib.source_remove(self.disable_initiator_tag)
988
        self.disable_initiator_tag = GLib.timeout_add(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
989
            int(self.timeout.total_seconds() * 1000), self.disable)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
990
        # Also start a new checker *right now*.
991
        self.start_checker()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
992
237.7.304 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
993
    def checker_callback(self, source, condition, connection,
994
                         command):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
995
        """The checker has completed, so take appropriate actions."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
996
        self.checker_callback_tag = None
997
        self.checker = None
237.24.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
998
        # Read return code from connection (see call_pipe)
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
999
        returncode = connection.recv()
1000
        connection.close()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1001
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1002
        if returncode >= 0:
1003
            self.last_checker_status = returncode
1004
            self.last_checker_signal = None
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1005
            if self.last_checker_status == 0:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1006
                logger.info("Checker for %(name)s succeeded",
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1007
                            vars(self))
237.2.44 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
1008
                self.checked_ok()
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1009
            else:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1010
                logger.info("Checker for %(name)s failed", vars(self))
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1011
        else:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1012
            self.last_checker_status = -1
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1013
            self.last_checker_signal = -returncode
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1014
            logger.warning("Checker for %(name)s crashed?",
13 by Björn Påhlsson
Added following support:
1015
                           vars(self))
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1016
        return False
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1017
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1018
    def checked_ok(self):
1019
        """Assert that the client has been seen, alive and well."""
1020
        self.last_checked_ok = datetime.datetime.utcnow()
1021
        self.last_checker_status = 0
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1022
        self.last_checker_signal = None
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1023
        self.bump_timeout()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1024
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1025
    def bump_timeout(self, timeout=None):
1026
        """Bump up the timeout for this client."""
24.1.179 by Björn Påhlsson
New feature:
1027
        if timeout is None:
1028
            timeout = self.timeout
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1029
        if self.disable_initiator_tag is not None:
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1030
            GLib.source_remove(self.disable_initiator_tag)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1031
            self.disable_initiator_tag = None
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1032
        if getattr(self, "enabled", False):
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1033
            self.disable_initiator_tag = GLib.timeout_add(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1034
                int(timeout.total_seconds() * 1000), self.disable)
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1035
            self.expires = datetime.datetime.utcnow() + timeout
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1036
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1037
    def need_approval(self):
1038
        self.last_approval_request = datetime.datetime.utcnow()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1039
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1040
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1041
        """Start a new checker subprocess if one is not running.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1042
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1043
        If a checker already exists, leave it running and do
1044
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1045
        # The reason for not killing a running checker is that if we
237.7.125 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
1046
        # did that, and if a checker (for some reason) started running
1047
        # slowly and taking more than 'interval' time, then the client
1048
        # would inevitably timeout, since no checker would get a
1049
        # chance to run to completion.  If we instead leave running
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1050
        # checkers alone, the checker would have to take more time
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1051
        # than 'timeout' for the client to be disabled, which is as it
1052
        # should be.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1053
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1054
        if self.checker is not None and not self.checker.is_alive():
1055
            logger.warning("Checker was not alive; joining")
1056
            self.checker.join()
1057
            self.checker = None
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
1058
        # Start a new checker if needed
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1059
        if self.checker is None:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1060
            # Escape attributes for the shell
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1061
            escaped_attrs = {
1062
                attr: re.escape(str(getattr(self, attr)))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1063
                for attr in self.runtime_expansions}
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1064
            try:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1065
                command = self.checker_command % escaped_attrs
1066
            except TypeError as error:
1067
                logger.error('Could not format string "%s"',
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1068
                             self.checker_command,
1069
                             exc_info=error)
1070
                return True     # Try again later
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1071
            self.current_checker_command = command
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1072
            logger.info("Starting checker %r for %s", command,
1073
                        self.name)
1074
            # We don't need to redirect stdout and stderr, since
1075
            # in normal mode, that is already done by daemon(),
1076
            # and in debug mode we don't want to.  (Stdin is
1077
            # always replaced by /dev/null.)
1078
            # The exception is when not debugging but nevertheless
1079
            # running in the foreground; use the previously
1080
            # created wnull.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1081
            popen_args = {"close_fds": True,
1082
                          "shell": True,
1083
                          "cwd": "/"}
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1084
            if (not self.server_settings["debug"]
1085
                and self.server_settings["foreground"]):
1086
                popen_args.update({"stdout": wnull,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1087
                                   "stderr": wnull})
1088
            pipe = multiprocessing.Pipe(duplex=False)
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1089
            self.checker = multiprocessing.Process(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1090
                target=call_pipe,
1091
                args=(pipe[1], subprocess.call, command),
1092
                kwargs=popen_args)
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1093
            self.checker.start()
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1094
            self.checker_callback_tag = GLib.io_add_watch(
1095
                pipe[0].fileno(), GLib.IO_IN,
237.7.304 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1096
                self.checker_callback, pipe[0], command)
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1097
        # Re-run this periodically if run by GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1098
        return True
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1099
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1100
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1101
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1102
        if self.checker_callback_tag:
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1103
            GLib.source_remove(self.checker_callback_tag)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1104
            self.checker_callback_tag = None
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1105
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1106
            return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1107
        logger.debug("Stopping checker for %(name)s", vars(self))
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1108
        self.checker.terminate()
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1109
        self.checker = None
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1110
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1111
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1112
def dbus_service_property(dbus_interface,
1113
                          signature="v",
1114
                          access="readwrite",
1115
                          byte_arrays=False):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1116
    """Decorators for marking methods of a DBusObjectWithProperties to
1117
    become properties on the D-Bus.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1118
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1119
    The decorated method will be called with no arguments by "Get"
1120
    and with one argument by "Set".
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1121
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1122
    The parameters, where they are supported, are the same as
1123
    dbus.service.method, except there is only "signature", since the
1124
    type from Get() and the type sent to Set() is the same.
1125
    """
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1126
    # Encoding deeply encoded byte arrays is not supported yet by the
1127
    # "Set" method, so we fail early here:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1128
    if byte_arrays and signature != "ay":
1129
        raise ValueError("Byte arrays not supported for non-'ay'"
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1130
                         " signature {!r}".format(signature))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1131
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1132
    def decorator(func):
1133
        func._dbus_is_property = True
1134
        func._dbus_interface = dbus_interface
1135
        func._dbus_signature = signature
1136
        func._dbus_access = access
1137
        func._dbus_name = func.__name__
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1138
        if func._dbus_name.endswith("_dbus_property"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1139
            func._dbus_name = func._dbus_name[:-14]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1140
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1141
        return func
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1142
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1143
    return decorator
1144
1145
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1146
def dbus_interface_annotations(dbus_interface):
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1147
    """Decorator for marking functions returning interface annotations
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1148
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1149
    Usage:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1150
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1151
    @dbus_interface_annotations("org.example.Interface")
1152
    def _foo(self):  # Function name does not matter
1153
        return {"org.freedesktop.DBus.Deprecated": "true",
1154
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
1155
                    "false"}
1156
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1157
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1158
    def decorator(func):
1159
        func._dbus_is_interface = True
1160
        func._dbus_interface = dbus_interface
1161
        func._dbus_name = dbus_interface
1162
        return func
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1163
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1164
    return decorator
1165
1166
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1167
def dbus_annotations(annotations):
1168
    """Decorator to annotate D-Bus methods, signals or properties
1169
    Usage:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1170
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1171
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1172
                       "org.freedesktop.DBus.Property."
1173
                       "EmitsChangedSignal": "false"})
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1174
    @dbus_service_property("org.example.Interface", signature="b",
1175
                           access="r")
1176
    def Property_dbus_property(self):
1177
        return dbus.Boolean(False)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1178
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1179
    See also the DBusObjectWithAnnotations class.
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1180
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1181
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1182
    def decorator(func):
1183
        func._dbus_annotations = annotations
1184
        return func
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1185
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1186
    return decorator
1187
1188
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1189
class DBusPropertyException(dbus.exceptions.DBusException):
1190
    """A base class for D-Bus property-related exceptions
1191
    """
237.7.277 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
1192
    pass
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1193
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1194
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1195
class DBusPropertyAccessException(DBusPropertyException):
1196
    """A property's access permissions disallows an operation.
1197
    """
1198
    pass
1199
1200
1201
class DBusPropertyNotFound(DBusPropertyException):
1202
    """An attempt was made to access a non-existing property.
1203
    """
1204
    pass
1205
1206
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1207
class DBusObjectWithAnnotations(dbus.service.Object):
1208
    """A D-Bus object with annotations.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1209
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1210
    Classes inheriting from this can use the dbus_annotations
1211
    decorator to add annotations to methods or signals.
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1212
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1213
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1214
    @staticmethod
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1215
    def _is_dbus_thing(thing):
1216
        """Returns a function testing if an attribute is a D-Bus thing
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1217
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1218
        If called like _is_dbus_thing("method") it returns a function
1219
        suitable for use as predicate to inspect.getmembers().
1220
        """
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1221
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1222
                                   False)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1223
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1224
    def _get_all_dbus_things(self, thing):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1225
        """Returns a generator of (name, attribute) pairs
1226
        """
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1227
        return ((getattr(athing.__get__(self), "_dbus_name", name),
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1228
                 athing.__get__(self))
24.1.186 by Björn Påhlsson
transitional stuff actually working
1229
                for cls in self.__class__.__mro__
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1230
                for name, athing in
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1231
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1232
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1233
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1234
                         out_signature="s",
1235
                         path_keyword='object_path',
1236
                         connection_keyword='connection')
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1237
    def Introspect(self, object_path, connection):
1238
        """Overloading of standard D-Bus method.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1239
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1240
        Inserts annotation tags on methods and signals.
1241
        """
1242
        xmlstring = dbus.service.Object.Introspect(self, object_path,
1243
                                                   connection)
1244
        try:
1245
            document = xml.dom.minidom.parseString(xmlstring)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1246
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1247
            for if_tag in document.getElementsByTagName("interface"):
1248
                # Add annotation tags
1249
                for typ in ("method", "signal"):
1250
                    for tag in if_tag.getElementsByTagName(typ):
1251
                        annots = dict()
1252
                        for name, prop in (self.
1253
                                           _get_all_dbus_things(typ)):
1254
                            if (name == tag.getAttribute("name")
1255
                                and prop._dbus_interface
1256
                                == if_tag.getAttribute("name")):
1257
                                annots.update(getattr(
1258
                                    prop, "_dbus_annotations", {}))
1259
                        for name, value in annots.items():
1260
                            ann_tag = document.createElement(
1261
                                "annotation")
1262
                            ann_tag.setAttribute("name", name)
1263
                            ann_tag.setAttribute("value", value)
1264
                            tag.appendChild(ann_tag)
1265
                # Add interface annotation tags
1266
                for annotation, value in dict(
1267
                    itertools.chain.from_iterable(
1268
                        annotations().items()
1269
                        for name, annotations
1270
                        in self._get_all_dbus_things("interface")
1271
                        if name == if_tag.getAttribute("name")
1272
                        )).items():
1273
                    ann_tag = document.createElement("annotation")
1274
                    ann_tag.setAttribute("name", annotation)
1275
                    ann_tag.setAttribute("value", value)
1276
                    if_tag.appendChild(ann_tag)
1277
                # Fix argument name for the Introspect method itself
1278
                if (if_tag.getAttribute("name")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1279
                    == dbus.INTROSPECTABLE_IFACE):
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1280
                    for cn in if_tag.getElementsByTagName("method"):
1281
                        if cn.getAttribute("name") == "Introspect":
1282
                            for arg in cn.getElementsByTagName("arg"):
1283
                                if (arg.getAttribute("direction")
1284
                                    == "out"):
1285
                                    arg.setAttribute("name",
1286
                                                     "xml_data")
1287
            xmlstring = document.toxml("utf-8")
1288
            document.unlink()
1289
        except (AttributeError, xml.dom.DOMException,
1290
                xml.parsers.expat.ExpatError) as error:
1291
            logger.error("Failed to override Introspection method",
1292
                         exc_info=error)
1293
        return xmlstring
1294
1295
1296
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1297
    """A D-Bus object with properties.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1298
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1299
    Classes inheriting from this can use the dbus_service_property
1300
    decorator to expose methods as D-Bus properties.  It exposes the
1301
    standard Get(), Set(), and GetAll() methods on the D-Bus.
1302
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1303
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1304
    def _get_dbus_property(self, interface_name, property_name):
1305
        """Returns a bound method if one exists which is a D-Bus
1306
        property with the specified name and interface.
1307
        """
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1308
        for cls in self.__class__.__mro__:
1309
            for name, value in inspect.getmembers(
1310
                    cls, self._is_dbus_thing("property")):
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1311
                if (value._dbus_name == property_name
1312
                    and value._dbus_interface == interface_name):
24.1.186 by Björn Påhlsson
transitional stuff actually working
1313
                    return value.__get__(self)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1314
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1315
        # No such property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1316
        raise DBusPropertyNotFound("{}:{}.{}".format(
1317
            self.dbus_object_path, interface_name, property_name))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1318
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1319
    @classmethod
1320
    def _get_all_interface_names(cls):
1321
        """Get a sequence of all interfaces supported by an object"""
1322
        return (name for name in set(getattr(getattr(x, attr),
1323
                                             "_dbus_interface", None)
1324
                                     for x in (inspect.getmro(cls))
1325
                                     for attr in dir(x))
1326
                if name is not None)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1327
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1328
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1329
                         in_signature="ss",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1330
                         out_signature="v")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1331
    def Get(self, interface_name, property_name):
1332
        """Standard D-Bus property Get() method, see D-Bus standard.
1333
        """
1334
        prop = self._get_dbus_property(interface_name, property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1335
        if prop._dbus_access == "write":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1336
            raise DBusPropertyAccessException(property_name)
1337
        value = prop()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1338
        if not hasattr(value, "variant_level"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1339
            return value
1340
        return type(value)(value, variant_level=value.variant_level+1)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1341
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1342
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1343
    def Set(self, interface_name, property_name, value):
1344
        """Standard D-Bus property Set() method, see D-Bus standard.
1345
        """
1346
        prop = self._get_dbus_property(interface_name, property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1347
        if prop._dbus_access == "read":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1348
            raise DBusPropertyAccessException(property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1349
        if prop._dbus_get_args_options["byte_arrays"]:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1350
            # The byte_arrays option is not supported yet on
1351
            # signatures other than "ay".
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1352
            if prop._dbus_signature != "ay":
237.7.197 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1353
                raise ValueError("Byte arrays not supported for non-"
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1354
                                 "'ay' signature {!r}"
237.7.197 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1355
                                 .format(prop._dbus_signature))
237.7.94 by Teddy Hogeborn
* debian/rules (binary-common): Exclude network-hooks.d from
1356
            value = dbus.ByteArray(b''.join(chr(byte)
1357
                                            for byte in value))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1358
        prop(value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1359
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1360
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1361
                         in_signature="s",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1362
                         out_signature="a{sv}")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1363
    def GetAll(self, interface_name):
1364
        """Standard D-Bus property GetAll() method, see D-Bus
1365
        standard.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1366
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1367
        Note: Will not include properties with access="write".
1368
        """
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1369
        properties = {}
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1370
        for name, prop in self._get_all_dbus_things("property"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1371
            if (interface_name
1372
                and interface_name != prop._dbus_interface):
1373
                # Interface non-empty but did not match
1374
                continue
1375
            # Ignore write-only properties
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1376
            if prop._dbus_access == "write":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1377
                continue
1378
            value = prop()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1379
            if not hasattr(value, "variant_level"):
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1380
                properties[name] = value
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1381
                continue
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1382
            properties[name] = type(value)(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1383
                value, variant_level=value.variant_level + 1)
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1384
        return dbus.Dictionary(properties, signature="sv")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1385
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1386
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1387
    def PropertiesChanged(self, interface_name, changed_properties,
1388
                          invalidated_properties):
1389
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
1390
        standard.
1391
        """
1392
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1393
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1394
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1395
                         out_signature="s",
1396
                         path_keyword='object_path',
1397
                         connection_keyword='connection')
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1398
    def Introspect(self, object_path, connection):
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1399
        """Overloading of standard D-Bus method.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1400
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1401
        Inserts property tags and interface annotation tags.
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1402
        """
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1403
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1404
                                                         object_path,
1405
                                                         connection)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1406
        try:
1407
            document = xml.dom.minidom.parseString(xmlstring)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1408
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1409
            def make_tag(document, name, prop):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1410
                e = document.createElement("property")
1411
                e.setAttribute("name", name)
1412
                e.setAttribute("type", prop._dbus_signature)
1413
                e.setAttribute("access", prop._dbus_access)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1414
                return e
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1415
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1416
            for if_tag in document.getElementsByTagName("interface"):
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1417
                # Add property tags
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1418
                for tag in (make_tag(document, name, prop)
1419
                            for name, prop
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1420
                            in self._get_all_dbus_things("property")
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1421
                            if prop._dbus_interface
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1422
                            == if_tag.getAttribute("name")):
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1423
                    if_tag.appendChild(tag)
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1424
                # Add annotation tags for properties
1425
                for tag in if_tag.getElementsByTagName("property"):
1426
                    annots = dict()
1427
                    for name, prop in self._get_all_dbus_things(
1428
                            "property"):
1429
                        if (name == tag.getAttribute("name")
1430
                            and prop._dbus_interface
1431
                            == if_tag.getAttribute("name")):
1432
                            annots.update(getattr(
1433
                                prop, "_dbus_annotations", {}))
1434
                    for name, value in annots.items():
1435
                        ann_tag = document.createElement(
1436
                            "annotation")
1437
                        ann_tag.setAttribute("name", name)
1438
                        ann_tag.setAttribute("value", value)
1439
                        tag.appendChild(ann_tag)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1440
                # Add the names to the return values for the
1441
                # "org.freedesktop.DBus.Properties" methods
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1442
                if (if_tag.getAttribute("name")
1443
                    == "org.freedesktop.DBus.Properties"):
1444
                    for cn in if_tag.getElementsByTagName("method"):
1445
                        if cn.getAttribute("name") == "Get":
1446
                            for arg in cn.getElementsByTagName("arg"):
1447
                                if (arg.getAttribute("direction")
1448
                                    == "out"):
1449
                                    arg.setAttribute("name", "value")
1450
                        elif cn.getAttribute("name") == "GetAll":
1451
                            for arg in cn.getElementsByTagName("arg"):
1452
                                if (arg.getAttribute("direction")
1453
                                    == "out"):
1454
                                    arg.setAttribute("name", "props")
1455
            xmlstring = document.toxml("utf-8")
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1456
            document.unlink()
1457
        except (AttributeError, xml.dom.DOMException,
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1458
                xml.parsers.expat.ExpatError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1459
            logger.error("Failed to override Introspection method",
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
1460
                         exc_info=error)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1461
        return xmlstring
1462
237.7.436 by Teddy Hogeborn
Add more PEP8 compliance (as per the "pycodestyle" tool).
1463
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1464
try:
1465
    dbus.OBJECT_MANAGER_IFACE
1466
except AttributeError:
1467
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1468
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1469
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1470
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1471
    """A D-Bus object with an ObjectManager.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1472
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1473
    Classes inheriting from this exposes the standard
1474
    GetManagedObjects call and the InterfacesAdded and
1475
    InterfacesRemoved signals on the standard
1476
    "org.freedesktop.DBus.ObjectManager" interface.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1477
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1478
    Note: No signals are sent automatically; they must be sent
1479
    manually.
1480
    """
1481
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1482
                         out_signature="a{oa{sa{sv}}}")
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1483
    def GetManagedObjects(self):
1484
        """This function must be overridden"""
1485
        raise NotImplementedError()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1486
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1487
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1488
                         signature="oa{sa{sv}}")
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1489
    def InterfacesAdded(self, object_path, interfaces_and_properties):
1490
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1491
1492
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1493
    def InterfacesRemoved(self, object_path, interfaces):
1494
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1495
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1496
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1497
                         out_signature="s",
1498
                         path_keyword='object_path',
1499
                         connection_keyword='connection')
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1500
    def Introspect(self, object_path, connection):
1501
        """Overloading of standard D-Bus method.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1502
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1503
        Override return argument name of GetManagedObjects to be
1504
        "objpath_interfaces_and_properties"
1505
        """
237.7.334 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1506
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1507
                                                         object_path,
1508
                                                         connection)
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1509
        try:
1510
            document = xml.dom.minidom.parseString(xmlstring)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1511
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1512
            for if_tag in document.getElementsByTagName("interface"):
1513
                # Fix argument name for the GetManagedObjects method
1514
                if (if_tag.getAttribute("name")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1515
                    == dbus.OBJECT_MANAGER_IFACE):
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1516
                    for cn in if_tag.getElementsByTagName("method"):
1517
                        if (cn.getAttribute("name")
1518
                            == "GetManagedObjects"):
1519
                            for arg in cn.getElementsByTagName("arg"):
1520
                                if (arg.getAttribute("direction")
1521
                                    == "out"):
1522
                                    arg.setAttribute(
1523
                                        "name",
1524
                                        "objpath_interfaces"
1525
                                        "_and_properties")
1526
            xmlstring = document.toxml("utf-8")
1527
            document.unlink()
1528
        except (AttributeError, xml.dom.DOMException,
1529
                xml.parsers.expat.ExpatError) as error:
1530
            logger.error("Failed to override Introspection method",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1531
                         exc_info=error)
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1532
        return xmlstring
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1533
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1534
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1535
def datetime_to_dbus(dt, variant_level=0):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1536
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1537
    if dt is None:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1538
        return dbus.String("", variant_level=variant_level)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1539
    return dbus.String(dt.isoformat(), variant_level=variant_level)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1540
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1541
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1542
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1543
    """A class decorator; applied to a subclass of
1544
    dbus.service.Object, it will add alternate D-Bus attributes with
1545
    interface names according to the "alt_interface_names" mapping.
1546
    Usage:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1547
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1548
    @alternate_dbus_interfaces({"org.example.Interface":
1549
                                    "net.example.AlternateInterface"})
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1550
    class SampleDBusObject(dbus.service.Object):
1551
        @dbus.service.method("org.example.Interface")
1552
        def SampleDBusMethod():
1553
            pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1554
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1555
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1556
    reachable via two interfaces: "org.example.Interface" and
1557
    "net.example.AlternateInterface", the latter of which will have
1558
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1559
    "true", unless "deprecate" is passed with a False value.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1560
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1561
    This works for methods and signals, and also for D-Bus properties
1562
    (from DBusObjectWithProperties) and interfaces (from the
1563
    dbus_interface_annotations decorator).
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1564
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1565
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1566
    def wrapper(cls):
1567
        for orig_interface_name, alt_interface_name in (
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1568
                alt_interface_names.items()):
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1569
            attr = {}
1570
            interface_names = set()
1571
            # Go though all attributes of the class
1572
            for attrname, attribute in inspect.getmembers(cls):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1573
                # Ignore non-D-Bus attributes, and D-Bus attributes
1574
                # with the wrong interface name
1575
                if (not hasattr(attribute, "_dbus_interface")
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1576
                    or not attribute._dbus_interface.startswith(
1577
                        orig_interface_name)):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1578
                    continue
1579
                # Create an alternate D-Bus interface name based on
1580
                # the current name
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1581
                alt_interface = attribute._dbus_interface.replace(
1582
                    orig_interface_name, alt_interface_name)
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1583
                interface_names.add(alt_interface)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1584
                # Is this a D-Bus signal?
1585
                if getattr(attribute, "_dbus_is_signal", False):
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1586
                    # Extract the original non-method undecorated
1587
                    # function by black magic
237.7.304 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1588
                    if sys.version_info.major == 2:
237.7.302 by Teddy Hogeborn
mandos: More Python 3 fixes.
1589
                        nonmethod_func = (dict(
1590
                            zip(attribute.func_code.co_freevars,
1591
                                attribute.__closure__))
1592
                                          ["func"].cell_contents)
1593
                    else:
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1594
                        nonmethod_func = (dict(
1595
                            zip(attribute.__code__.co_freevars,
1596
                                attribute.__closure__))
1597
                                          ["func"].cell_contents)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1598
                    # Create a new, but exactly alike, function
1599
                    # object, and decorate it to be a new D-Bus signal
1600
                    # with the alternate D-Bus interface name
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1601
                    new_function = copy_function(nonmethod_func)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1602
                    new_function = (dbus.service.signal(
237.7.302 by Teddy Hogeborn
mandos: More Python 3 fixes.
1603
                        alt_interface,
1604
                        attribute._dbus_signature)(new_function))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1605
                    # Copy annotations, if any
1606
                    try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1607
                        new_function._dbus_annotations = dict(
1608
                            attribute._dbus_annotations)
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1609
                    except AttributeError:
1610
                        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1611
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1612
                    # Define a creator of a function to call both the
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1613
                    # original and alternate functions, so both the
1614
                    # original and alternate signals gets sent when
1615
                    # the function is called
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1616
                    def fixscope(func1, func2):
1617
                        """This function is a scope container to pass
1618
                        func1 and func2 to the "call_both" function
1619
                        outside of its arguments"""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1620
237.7.334 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1621
                        @functools.wraps(func2)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1622
                        def call_both(*args, **kwargs):
1623
                            """This function will emit two D-Bus
1624
                            signals by calling func1 and func2"""
1625
                            func1(*args, **kwargs)
1626
                            func2(*args, **kwargs)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1627
                        # Make wrapper function look like a D-Bus
1628
                        # signal
237.7.334 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1629
                        for name, attr in inspect.getmembers(func2):
1630
                            if name.startswith("_dbus_"):
1631
                                setattr(call_both, name, attr)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1632
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1633
                        return call_both
1634
                    # Create the "call_both" function and add it to
1635
                    # the class
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1636
                    attr[attrname] = fixscope(attribute, new_function)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1637
                # Is this a D-Bus method?
1638
                elif getattr(attribute, "_dbus_is_method", False):
1639
                    # Create a new, but exactly alike, function
1640
                    # object.  Decorate it to be a new D-Bus method
1641
                    # with the alternate D-Bus interface name.  Add it
1642
                    # to the class.
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1643
                    attr[attrname] = (
1644
                        dbus.service.method(
1645
                            alt_interface,
1646
                            attribute._dbus_in_signature,
1647
                            attribute._dbus_out_signature)
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1648
                        (copy_function(attribute)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1649
                    # Copy annotations, if any
1650
                    try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1651
                        attr[attrname]._dbus_annotations = dict(
1652
                            attribute._dbus_annotations)
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1653
                    except AttributeError:
1654
                        pass
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1655
                # Is this a D-Bus property?
1656
                elif getattr(attribute, "_dbus_is_property", False):
1657
                    # Create a new, but exactly alike, function
1658
                    # object, and decorate it to be a new D-Bus
1659
                    # property with the alternate D-Bus interface
1660
                    # name.  Add it to the class.
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1661
                    attr[attrname] = (dbus_service_property(
1662
                        alt_interface, attribute._dbus_signature,
1663
                        attribute._dbus_access,
1664
                        attribute._dbus_get_args_options
1665
                        ["byte_arrays"])
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1666
                                      (copy_function(attribute)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1667
                    # Copy annotations, if any
1668
                    try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1669
                        attr[attrname]._dbus_annotations = dict(
1670
                            attribute._dbus_annotations)
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1671
                    except AttributeError:
1672
                        pass
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1673
                # Is this a D-Bus interface?
1674
                elif getattr(attribute, "_dbus_is_interface", False):
1675
                    # Create a new, but exactly alike, function
1676
                    # object.  Decorate it to be a new D-Bus interface
1677
                    # with the alternate D-Bus interface name.  Add it
1678
                    # to the class.
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1679
                    attr[attrname] = (
1680
                        dbus_interface_annotations(alt_interface)
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1681
                        (copy_function(attribute)))
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1682
            if deprecate:
1683
                # Deprecate all alternate interfaces
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1684
                iname = "_AlternateDBusNames_interface_annotation{}"
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1685
                for interface_name in interface_names:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1686
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1687
                    @dbus_interface_annotations(interface_name)
1688
                    def func(self):
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1689
                        return {"org.freedesktop.DBus.Deprecated":
1690
                                "true"}
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1691
                    # Find an unused name
1692
                    for aname in (iname.format(i)
1693
                                  for i in itertools.count()):
1694
                        if aname not in attr:
1695
                            attr[aname] = func
1696
                            break
1697
            if interface_names:
1698
                # Replace the class with a new subclass of it with
1699
                # methods, signals, etc. as created above.
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1700
                if sys.version_info.major == 2:
1701
                    cls = type(b"{}Alternate".format(cls.__name__),
1702
                               (cls, ), attr)
1703
                else:
1704
                    cls = type("{}Alternate".format(cls.__name__),
1705
                               (cls, ), attr)
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1706
        return cls
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1707
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1708
    return wrapper
1709
1710
1711
@alternate_dbus_interfaces({"se.recompile.Mandos":
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1712
                            "se.bsnet.fukt.Mandos"})
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1713
class ClientDBus(Client, DBusObjectWithProperties):
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1714
    """A Client class using D-Bus
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1715
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1716
    Attributes:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1717
    dbus_object_path: dbus.ObjectPath
1718
    bus: dbus.SystemBus()
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1719
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1720
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1721
    runtime_expansions = (Client.runtime_expansions
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1722
                          + ("dbus_object_path", ))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1723
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1724
    _interface = "se.recompile.Mandos.Client"
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1725
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1726
    # dbus.service.Object doesn't use super(), so we can't either.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1727
1728
    def __init__(self, bus=None, *args, **kwargs):
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1729
        self.bus = bus
1730
        Client.__init__(self, *args, **kwargs)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1731
        # Only now, when this client is initialized, can it show up on
1732
        # the D-Bus
237.7.278 by Teddy Hogeborn
mandos: Replace unicode() with str().
1733
        client_object_name = str(self.name).translate(
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1734
            {ord("."): ord("_"),
1735
             ord("-"): ord("_")})
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1736
        self.dbus_object_path = dbus.ObjectPath(
1737
            "/clients/" + client_object_name)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1738
        DBusObjectWithProperties.__init__(self, self.bus,
1739
                                          self.dbus_object_path)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1740
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1741
    def notifychangeproperty(transform_func, dbus_name,
1742
                             type_func=lambda x: x,
1743
                             variant_level=1,
1744
                             invalidate_only=False,
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1745
                             _interface=_interface):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1746
        """ Modify a variable so that it's a property which announces
1747
        its changes to DBus.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1748
237.11.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1749
        transform_fun: Function that takes a value and a variant_level
1750
                       and transforms it to a D-Bus type.
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1751
        dbus_name: D-Bus name of the variable
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1752
        type_func: Function that transform the value before sending it
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1753
                   to the D-Bus.  Default: no transform
1754
        variant_level: D-Bus variant level.  Default: 1
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1755
        """
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1756
        attrname = "_{}".format(dbus_name)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1757
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1758
        def setter(self, value):
1759
            if hasattr(self, "dbus_object_path"):
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1760
                if (not hasattr(self, attrname) or
1761
                    type_func(getattr(self, attrname, None))
1762
                    != type_func(value)):
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1763
                    if invalidate_only:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1764
                        self.PropertiesChanged(
1765
                            _interface, dbus.Dictionary(),
1766
                            dbus.Array((dbus_name, )))
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1767
                    else:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1768
                        dbus_value = transform_func(
1769
                            type_func(value),
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1770
                            variant_level=variant_level)
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1771
                        self.PropertyChanged(dbus.String(dbus_name),
1772
                                             dbus_value)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1773
                        self.PropertiesChanged(
1774
                            _interface,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1775
                            dbus.Dictionary({dbus.String(dbus_name):
1776
                                             dbus_value}),
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1777
                            dbus.Array())
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1778
            setattr(self, attrname, value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1779
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1780
        return property(lambda self: getattr(self, attrname), setter)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1781
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1782
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1783
    approvals_pending = notifychangeproperty(dbus.Boolean,
1784
                                             "ApprovalPending",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1785
                                             type_func=bool)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1786
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1787
    last_enabled = notifychangeproperty(datetime_to_dbus,
1788
                                        "LastEnabled")
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1789
    checker = notifychangeproperty(
1790
        dbus.Boolean, "CheckerRunning",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1791
        type_func=lambda checker: checker is not None)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1792
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1793
                                           "LastCheckedOK")
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1794
    last_checker_status = notifychangeproperty(dbus.Int16,
1795
                                               "LastCheckerStatus")
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1796
    last_approval_request = notifychangeproperty(
1797
        datetime_to_dbus, "LastApprovalRequest")
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1798
    approved_by_default = notifychangeproperty(dbus.Boolean,
1799
                                               "ApprovedByDefault")
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1800
    approval_delay = notifychangeproperty(
1801
        dbus.UInt64, "ApprovalDelay",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1802
        type_func=lambda td: td.total_seconds() * 1000)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1803
    approval_duration = notifychangeproperty(
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1804
        dbus.UInt64, "ApprovalDuration",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1805
        type_func=lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1806
    host = notifychangeproperty(dbus.String, "Host")
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1807
    timeout = notifychangeproperty(
1808
        dbus.UInt64, "Timeout",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1809
        type_func=lambda td: td.total_seconds() * 1000)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1810
    extended_timeout = notifychangeproperty(
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1811
        dbus.UInt64, "ExtendedTimeout",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1812
        type_func=lambda td: td.total_seconds() * 1000)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1813
    interval = notifychangeproperty(
1814
        dbus.UInt64, "Interval",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1815
        type_func=lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1816
    checker_command = notifychangeproperty(dbus.String, "Checker")
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1817
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1818
                                  invalidate_only=True)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1819
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1820
    del notifychangeproperty
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1821
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1822
    def __del__(self, *args, **kwargs):
1823
        try:
1824
            self.remove_from_connection()
237.2.92 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1825
        except LookupError:
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1826
            pass
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1827
        if hasattr(DBusObjectWithProperties, "__del__"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1828
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1829
        Client.__del__(self, *args, **kwargs)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1830
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1831
    def checker_callback(self, source, condition,
237.7.304 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1832
                         connection, command, *args, **kwargs):
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1833
        ret = Client.checker_callback(self, source, condition,
237.7.304 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1834
                                      connection, command, *args,
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1835
                                      **kwargs)
1836
        exitstatus = self.last_checker_status
1837
        if exitstatus >= 0:
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1838
            # Emit D-Bus signal
1839
            self.CheckerCompleted(dbus.Int16(exitstatus),
237.7.331 by Teddy Hogeborn
Revert change to D-Bus API.
1840
                                  # This is specific to GNU libC
1841
                                  dbus.Int64(exitstatus << 8),
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1842
                                  dbus.String(command))
1843
        else:
1844
            # Emit D-Bus signal
1845
            self.CheckerCompleted(dbus.Int16(-1),
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1846
                                  dbus.Int64(
237.7.331 by Teddy Hogeborn
Revert change to D-Bus API.
1847
                                      # This is specific to GNU libC
1848
                                      (exitstatus << 8)
1849
                                      | self.last_checker_signal),
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1850
                                  dbus.String(command))
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1851
        return ret
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1852
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1853
    def start_checker(self, *args, **kwargs):
237.7.206 by Teddy Hogeborn
* mandos (ClientDBus.start_checker): Removed unused variable
1854
        old_checker_pid = getattr(self.checker, "pid", None)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1855
        r = Client.start_checker(self, *args, **kwargs)
237.2.92 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1856
        # Only if new checker process was started
1857
        if (self.checker is not None
1858
            and old_checker_pid != self.checker.pid):
1859
            # Emit D-Bus signal
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1860
            self.CheckerStarted(self.current_checker_command)
1861
        return r
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1862
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1863
    def _reset_approved(self):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1864
        self.approved = None
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1865
        return False
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1866
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1867
    def approve(self, value=True):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1868
        self.approved = value
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1869
        GLib.timeout_add(int(self.approval_duration.total_seconds()
1870
                             * 1000), self._reset_approved)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1871
        self.send_changedstate()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1872
1873
    #  D-Bus methods, signals & properties
1874
1875
    #  Interfaces
1876
1877
    #  Signals
1878
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1879
    # CheckerCompleted - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1880
    @dbus.service.signal(_interface, signature="nxs")
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1881
    def CheckerCompleted(self, exitcode, waitstatus, command):
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1882
        "D-Bus signal"
1883
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1884
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1885
    # CheckerStarted - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1886
    @dbus.service.signal(_interface, signature="s")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1887
    def CheckerStarted(self, command):
1888
        "D-Bus signal"
1889
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1890
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1891
    # PropertyChanged - signal
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1892
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1893
    @dbus.service.signal(_interface, signature="sv")
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1894
    def PropertyChanged(self, property, value):
1895
        "D-Bus signal"
1896
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1897
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1898
    # GotSecret - signal
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1899
    @dbus.service.signal(_interface)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1900
    def GotSecret(self):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1901
        """D-Bus signal
1902
        Is sent after a successful transfer of secret from the Mandos
1903
        server to mandos-client
1904
        """
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1905
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1906
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1907
    # Rejected - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1908
    @dbus.service.signal(_interface, signature="s")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1909
    def Rejected(self, reason):
1910
        "D-Bus signal"
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1911
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1912
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1913
    # NeedApproval - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1914
    @dbus.service.signal(_interface, signature="tb")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1915
    def NeedApproval(self, timeout, default):
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1916
        "D-Bus signal"
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1917
        return self.need_approval()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1918
1919
    #  Methods
1920
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1921
    # Approve - method
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1922
    @dbus.service.method(_interface, in_signature="b")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1923
    def Approve(self, value):
1924
        self.approve(value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1925
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1926
    # CheckedOK - method
1927
    @dbus.service.method(_interface)
1928
    def CheckedOK(self):
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1929
        self.checked_ok()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1930
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1931
    # Enable - method
237.7.329 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1932
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1933
    @dbus.service.method(_interface)
1934
    def Enable(self):
1935
        "D-Bus method"
1936
        self.enable()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1937
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1938
    # StartChecker - method
237.7.329 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1939
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1940
    @dbus.service.method(_interface)
1941
    def StartChecker(self):
1942
        "D-Bus method"
1943
        self.start_checker()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1944
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1945
    # Disable - method
237.7.329 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1946
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1947
    @dbus.service.method(_interface)
1948
    def Disable(self):
1949
        "D-Bus method"
1950
        self.disable()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1951
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1952
    # StopChecker - method
237.7.329 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1953
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1954
    @dbus.service.method(_interface)
1955
    def StopChecker(self):
1956
        self.stop_checker()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1957
1958
    #  Properties
1959
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1960
    # ApprovalPending - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1961
    @dbus_service_property(_interface, signature="b", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1962
    def ApprovalPending_dbus_property(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1963
        return dbus.Boolean(bool(self.approvals_pending))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1964
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1965
    # ApprovedByDefault - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1966
    @dbus_service_property(_interface,
1967
                           signature="b",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1968
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1969
    def ApprovedByDefault_dbus_property(self, value=None):
1970
        if value is None:       # get
1971
            return dbus.Boolean(self.approved_by_default)
1972
        self.approved_by_default = bool(value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1973
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1974
    # ApprovalDelay - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1975
    @dbus_service_property(_interface,
1976
                           signature="t",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1977
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1978
    def ApprovalDelay_dbus_property(self, value=None):
1979
        if value is None:       # get
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1980
            return dbus.UInt64(self.approval_delay.total_seconds()
1981
                               * 1000)
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1982
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1983
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1984
    # ApprovalDuration - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1985
    @dbus_service_property(_interface,
1986
                           signature="t",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1987
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1988
    def ApprovalDuration_dbus_property(self, value=None):
1989
        if value is None:       # get
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1990
            return dbus.UInt64(self.approval_duration.total_seconds()
1991
                               * 1000)
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1992
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1993
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1994
    # Name - property
237.7.328 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
1995
    @dbus_annotations(
1996
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1997
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1998
    def Name_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1999
        return dbus.String(self.name)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2000
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2001
    # Fingerprint - property
237.7.328 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2002
    @dbus_annotations(
2003
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2004
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2005
    def Fingerprint_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2006
        return dbus.String(self.fingerprint)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2007
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2008
    # Host - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2009
    @dbus_service_property(_interface,
2010
                           signature="s",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2011
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2012
    def Host_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2013
        if value is None:       # get
2014
            return dbus.String(self.host)
237.7.278 by Teddy Hogeborn
mandos: Replace unicode() with str().
2015
        self.host = str(value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2016
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2017
    # Created - property
237.7.328 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2018
    @dbus_annotations(
2019
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2020
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2021
    def Created_dbus_property(self):
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
2022
        return datetime_to_dbus(self.created)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2023
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2024
    # LastEnabled - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2025
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2026
    def LastEnabled_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2027
        return datetime_to_dbus(self.last_enabled)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2028
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2029
    # Enabled - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2030
    @dbus_service_property(_interface,
2031
                           signature="b",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2032
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2033
    def Enabled_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2034
        if value is None:       # get
2035
            return dbus.Boolean(self.enabled)
2036
        if value:
2037
            self.enable()
2038
        else:
2039
            self.disable()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2040
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2041
    # LastCheckedOK - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2042
    @dbus_service_property(_interface,
2043
                           signature="s",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2044
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2045
    def LastCheckedOK_dbus_property(self, value=None):
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2046
        if value is not None:
2047
            self.checked_ok()
2048
            return
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2049
        return datetime_to_dbus(self.last_checked_ok)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2050
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2051
    # LastCheckerStatus - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2052
    @dbus_service_property(_interface, signature="n", access="read")
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2053
    def LastCheckerStatus_dbus_property(self):
2054
        return dbus.Int16(self.last_checker_status)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2055
24.1.179 by Björn Påhlsson
New feature:
2056
    # Expires - property
2057
    @dbus_service_property(_interface, signature="s", access="read")
2058
    def Expires_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2059
        return datetime_to_dbus(self.expires)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2060
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2061
    # LastApprovalRequest - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2062
    @dbus_service_property(_interface, signature="s", access="read")
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2063
    def LastApprovalRequest_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2064
        return datetime_to_dbus(self.last_approval_request)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2065
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2066
    # Timeout - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2067
    @dbus_service_property(_interface,
2068
                           signature="t",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2069
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2070
    def Timeout_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2071
        if value is None:       # get
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2072
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2073
        old_timeout = self.timeout
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2074
        self.timeout = datetime.timedelta(0, 0, 0, value)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2075
        # Reschedule disabling
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2076
        if self.enabled:
2077
            now = datetime.datetime.utcnow()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2078
            self.expires += self.timeout - old_timeout
2079
            if self.expires <= now:
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2080
                # The timeout has passed
2081
                self.disable()
2082
            else:
2083
                if (getattr(self, "disable_initiator_tag", None)
2084
                    is None):
2085
                    return
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2086
                GLib.source_remove(self.disable_initiator_tag)
2087
                self.disable_initiator_tag = GLib.timeout_add(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2088
                    int((self.expires - now).total_seconds() * 1000),
2089
                    self.disable)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2090
24.1.179 by Björn Påhlsson
New feature:
2091
    # ExtendedTimeout - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2092
    @dbus_service_property(_interface,
2093
                           signature="t",
24.1.179 by Björn Påhlsson
New feature:
2094
                           access="readwrite")
2095
    def ExtendedTimeout_dbus_property(self, value=None):
2096
        if value is None:       # get
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2097
            return dbus.UInt64(self.extended_timeout.total_seconds()
2098
                               * 1000)
24.1.179 by Björn Påhlsson
New feature:
2099
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2100
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2101
    # Interval - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2102
    @dbus_service_property(_interface,
2103
                           signature="t",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2104
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2105
    def Interval_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2106
        if value is None:       # get
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2107
            return dbus.UInt64(self.interval.total_seconds() * 1000)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2108
        self.interval = datetime.timedelta(0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2109
        if getattr(self, "checker_initiator_tag", None) is None:
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2110
            return
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
2111
        if self.enabled:
2112
            # Reschedule checker run
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2113
            GLib.source_remove(self.checker_initiator_tag)
2114
            self.checker_initiator_tag = GLib.timeout_add(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2115
                value, self.start_checker)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2116
            self.start_checker()  # Start one now, too
2117
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2118
    # Checker - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2119
    @dbus_service_property(_interface,
2120
                           signature="s",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2121
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2122
    def Checker_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2123
        if value is None:       # get
2124
            return dbus.String(self.checker_command)
237.7.278 by Teddy Hogeborn
mandos: Replace unicode() with str().
2125
        self.checker_command = str(value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2126
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2127
    # CheckerRunning - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2128
    @dbus_service_property(_interface,
2129
                           signature="b",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2130
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2131
    def CheckerRunning_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2132
        if value is None:       # get
2133
            return dbus.Boolean(self.checker is not None)
2134
        if value:
2135
            self.start_checker()
2136
        else:
2137
            self.stop_checker()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2138
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2139
    # ObjectPath - property
237.7.328 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2140
    @dbus_annotations(
237.7.330 by Teddy Hogeborn
Deprecate the D-Bus property "se.recompile.Mandos.Client.ObjectPath".
2141
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2142
         "org.freedesktop.DBus.Deprecated": "true"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2143
    @dbus_service_property(_interface, signature="o", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2144
    def ObjectPath_dbus_property(self):
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2145
        return self.dbus_object_path  # is already a dbus.ObjectPath
2146
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2147
    # Secret = property
237.7.328 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2148
    @dbus_annotations(
2149
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
2150
         "invalidates"})
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2151
    @dbus_service_property(_interface,
2152
                           signature="ay",
2153
                           access="write",
2154
                           byte_arrays=True)
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2155
    def Secret_dbus_property(self, value):
237.7.277 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2156
        self.secret = bytes(value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2157
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2158
    del _interface
3 by Björn Påhlsson
Python based server
2159
2160
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2161
class ProxyClient(object):
2162
    def __init__(self, child_pipe, fpr, address):
2163
        self._pipe = child_pipe
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2164
        self._pipe.send(('init', fpr, address))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2165
        if not self._pipe.recv():
237.7.300 by Teddy Hogeborn
mandos: Generate better messages in exceptions.
2166
            raise KeyError(fpr)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2167
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2168
    def __getattribute__(self, name):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2169
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2170
            return super(ProxyClient, self).__getattribute__(name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2171
        self._pipe.send(('getattr', name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2172
        data = self._pipe.recv()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2173
        if data[0] == 'data':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2174
            return data[1]
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2175
        if data[0] == 'function':
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2176
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2177
            def func(*args, **kwargs):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2178
                self._pipe.send(('funcall', name, args, kwargs))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2179
                return self._pipe.recv()[1]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2180
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2181
            return func
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2182
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2183
    def __setattr__(self, name, value):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2184
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2185
            return super(ProxyClient, self).__setattr__(name, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2186
        self._pipe.send(('setattr', name, value))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2187
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2188
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2189
class ClientHandler(socketserver.BaseRequestHandler, object):
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2190
    """A class to handle client connections.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2191
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2192
    Instantiated once for each connection to handle it.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2193
    Note: This will run in its own forked process."""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2194
3 by Björn Påhlsson
Python based server
2195
    def handle(self):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2196
        with contextlib.closing(self.server.child_pipe) as child_pipe:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2197
            logger.info("TCP connection from: %s",
237.7.278 by Teddy Hogeborn
mandos: Replace unicode() with str().
2198
                        str(self.client_address))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2199
            logger.debug("Pipe FD: %d",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2200
                         self.server.child_pipe.fileno())
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2201
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2202
            session = gnutls.ClientSession(self.request)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2203
2204
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
2205
            #                       "+AES-256-CBC", "+SHA1",
2206
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2207
            #                       "+DHE-DSS"))
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2208
            # Use a fallback default, since this MUST be set.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2209
            priority = self.server.gnutls_priority
2210
            if priority is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2211
                priority = "NORMAL"
237.7.399 by Teddy Hogeborn
mandos: Minor bug fix for Python 3
2212
            gnutls.priority_set_direct(session._c_object,
2213
                                       priority.encode("utf-8"),
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2214
                                       None)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2215
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2216
            # Start communication using the Mandos protocol
2217
            # Get protocol number
2218
            line = self.request.makefile().readline()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2219
            logger.debug("Protocol version: %r", line)
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2220
            try:
2221
                if int(line.strip().split()[0]) > 1:
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2222
                    raise RuntimeError(line)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2223
            except (ValueError, IndexError, RuntimeError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2224
                logger.error("Unknown protocol version: %s", error)
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2225
                return
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2226
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2227
            # Start GnuTLS connection
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2228
            try:
2229
                session.handshake()
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2230
            except gnutls.Error as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2231
                logger.warning("Handshake failed: %s", error)
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2232
                # Do not run session.bye() here: the session is not
2233
                # established.  Just abandon the request.
2234
                return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2235
            logger.debug("Handshake succeeded")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2236
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2237
            approval_required = False
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2238
            try:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2239
                try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2240
                    fpr = self.fingerprint(
2241
                        self.peer_certificate(session))
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2242
                except (TypeError, gnutls.Error) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2243
                    logger.warning("Bad certificate: %s", error)
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2244
                    return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2245
                logger.debug("Fingerprint: %s", fpr)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2246
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2247
                try:
2248
                    client = ProxyClient(child_pipe, fpr,
2249
                                         self.client_address)
2250
                except KeyError:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2251
                    return
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2252
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2253
                if client.approval_delay:
2254
                    delay = client.approval_delay
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2255
                    client.approvals_pending += 1
2256
                    approval_required = True
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2257
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2258
                while True:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2259
                    if not client.enabled:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
2260
                        logger.info("Client %s is disabled",
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2261
                                    client.name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2262
                        if self.server.use_dbus:
2263
                            # Emit D-Bus signal
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2264
                            client.Rejected("Disabled")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2265
                        return
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2266
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2267
                    if client.approved or not client.approval_delay:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2268
                        # We are approved or approval is disabled
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2269
                        break
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2270
                    elif client.approved is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2271
                        logger.info("Client %s needs approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2272
                                    client.name)
2273
                        if self.server.use_dbus:
2274
                            # Emit D-Bus signal
2275
                            client.NeedApproval(
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2276
                                client.approval_delay.total_seconds()
2277
                                * 1000, client.approved_by_default)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2278
                    else:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2279
                        logger.warning("Client %s was not approved",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2280
                                       client.name)
2281
                        if self.server.use_dbus:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2282
                            # Emit D-Bus signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2283
                            client.Rejected("Denied")
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2284
                        return
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2285
2286
                    # wait until timeout or approved
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2287
                    time = datetime.datetime.now()
2288
                    client.changedstate.acquire()
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2289
                    client.changedstate.wait(delay.total_seconds())
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2290
                    client.changedstate.release()
2291
                    time2 = datetime.datetime.now()
2292
                    if (time2 - time) >= delay:
2293
                        if not client.approved_by_default:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2294
                            logger.warning("Client %s timed out while"
2295
                                           " waiting for approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2296
                                           client.name)
2297
                            if self.server.use_dbus:
2298
                                # Emit D-Bus signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2299
                                client.Rejected("Approval timed out")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2300
                            return
2301
                        else:
2302
                            break
2303
                    else:
2304
                        delay -= time2 - time
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2305
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2306
                try:
2307
                    session.send(client.secret)
2308
                except gnutls.Error as error:
2309
                    logger.warning("gnutls send failed",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2310
                                   exc_info=error)
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2311
                    return
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2312
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2313
                logger.info("Sending secret to %s", client.name)
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2314
                # bump the timeout using extended_timeout
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2315
                client.bump_timeout(client.extended_timeout)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2316
                if self.server.use_dbus:
2317
                    # Emit D-Bus signal
2318
                    client.GotSecret()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2319
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2320
            finally:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2321
                if approval_required:
2322
                    client.approvals_pending -= 1
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2323
                try:
2324
                    session.bye()
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2325
                except gnutls.Error as error:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2326
                    logger.warning("GnuTLS bye failed",
2327
                                   exc_info=error)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2328
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2329
    @staticmethod
2330
    def peer_certificate(session):
2331
        "Return the peer's OpenPGP certificate as a bytestring"
2332
        # If not an OpenPGP certificate...
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2333
        if (gnutls.certificate_type_get(session._c_object)
2334
            != gnutls.CRT_OPENPGP):
2335
            # ...return invalid data
2336
            return b""
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2337
        list_size = ctypes.c_uint(1)
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2338
        cert_list = (gnutls.certificate_get_peers
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2339
                     (session._c_object, ctypes.byref(list_size)))
2340
        if not bool(cert_list) and list_size.value != 0:
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2341
            raise gnutls.Error("error getting peer certificate")
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2342
        if list_size.value == 0:
2343
            return None
2344
        cert = cert_list[0]
2345
        return ctypes.string_at(cert.data, cert.size)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2346
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2347
    @staticmethod
2348
    def fingerprint(openpgp):
2349
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
2350
        # New GnuTLS "datum" with the OpenPGP public key
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2351
        datum = gnutls.datum_t(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2352
            ctypes.cast(ctypes.c_char_p(openpgp),
2353
                        ctypes.POINTER(ctypes.c_ubyte)),
2354
            ctypes.c_uint(len(openpgp)))
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2355
        # New empty GnuTLS certificate
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2356
        crt = gnutls.openpgp_crt_t()
2357
        gnutls.openpgp_crt_init(ctypes.byref(crt))
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2358
        # Import the OpenPGP public key into the certificate
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2359
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2360
                                  gnutls.OPENPGP_FMT_RAW)
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2361
        # Verify the self signature in the key
2362
        crtverify = ctypes.c_uint()
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2363
        gnutls.openpgp_crt_verify_self(crt, 0,
2364
                                       ctypes.byref(crtverify))
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2365
        if crtverify.value != 0:
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2366
            gnutls.openpgp_crt_deinit(crt)
2367
            raise gnutls.CertificateSecurityError("Verify failed")
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2368
        # New buffer for the fingerprint
2369
        buf = ctypes.create_string_buffer(20)
2370
        buf_len = ctypes.c_size_t()
2371
        # Get the fingerprint from the certificate into the buffer
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2372
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2373
                                           ctypes.byref(buf_len))
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2374
        # Deinit the certificate
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2375
        gnutls.openpgp_crt_deinit(crt)
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2376
        # Convert the buffer to a Python bytestring
2377
        fpr = ctypes.string_at(buf, buf_len.value)
2378
        # Convert the bytestring to hexadecimal notation
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2379
        hex_fpr = binascii.hexlify(fpr).upper()
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2380
        return hex_fpr
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2381
2382
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2383
class MultiprocessingMixIn(object):
2384
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2385
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2386
    def sub_process_main(self, request, address):
2387
        try:
2388
            self.finish_request(request, address)
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2389
        except Exception:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2390
            self.handle_error(request, address)
2391
        self.close_request(request)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2392
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2393
    def process_request(self, request, address):
2394
        """Start a new process to process the request."""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2395
        proc = multiprocessing.Process(target=self.sub_process_main,
2396
                                       args=(request, address))
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2397
        proc.start()
2398
        return proc
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2399
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2400
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2401
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2402
    """ adds a pipe to the MixIn """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2403
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2404
    def process_request(self, request, client_address):
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2405
        """Overrides and wraps the original process_request().
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2406
237.2.118 by Teddy Hogeborn
* mandos: White-space fixes only.
2407
        This function creates a new pipe in self.pipe
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2408
        """
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2409
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2410
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2411
        proc = MultiprocessingMixIn.process_request(self, request,
2412
                                                    client_address)
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2413
        self.child_pipe.close()
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2414
        self.add_pipe(parent_pipe, proc)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2415
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2416
    def add_pipe(self, parent_pipe, proc):
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2417
        """Dummy function; override as necessary"""
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2418
        raise NotImplementedError()
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2419
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2420
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2421
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2422
                     socketserver.TCPServer, object):
250 by Teddy Hogeborn
Merge from trunk. Notable changes:
2423
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2424
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2425
    Attributes:
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2426
        enabled:        Boolean; whether this server is activated yet
2427
        interface:      None or a network interface name (string)
2428
        use_ipv6:       Boolean; to use IPv6 or not
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2429
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2430
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2431
    def __init__(self, server_address, RequestHandlerClass,
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2432
                 interface=None,
2433
                 use_ipv6=True,
2434
                 socketfd=None):
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2435
        """If socketfd is set, use that file descriptor instead of
2436
        creating a new one with socket.socket().
2437
        """
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2438
        self.interface = interface
2439
        if use_ipv6:
2440
            self.address_family = socket.AF_INET6
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2441
        if socketfd is not None:
2442
            # Save the file descriptor
2443
            self.socketfd = socketfd
2444
            # Save the original socket.socket() function
2445
            self.socket_socket = socket.socket
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2446
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2447
            # To implement --socket, we monkey patch socket.socket.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2448
            #
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2449
            # (When socketserver.TCPServer is a new-style class, we
2450
            # could make self.socket into a property instead of monkey
2451
            # patching socket.socket.)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2452
            #
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2453
            # Create a one-time-only replacement for socket.socket()
2454
            @functools.wraps(socket.socket)
2455
            def socket_wrapper(*args, **kwargs):
2456
                # Restore original function so subsequent calls are
2457
                # not affected.
2458
                socket.socket = self.socket_socket
2459
                del self.socket_socket
2460
                # This time only, return a new socket object from the
2461
                # saved file descriptor.
2462
                return socket.fromfd(self.socketfd, *args, **kwargs)
2463
            # Replace socket.socket() function with wrapper
2464
            socket.socket = socket_wrapper
2465
        # The socketserver.TCPServer.__init__ will call
2466
        # socket.socket(), which might be our replacement,
2467
        # socket_wrapper(), if socketfd was set.
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2468
        socketserver.TCPServer.__init__(self, server_address,
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2469
                                        RequestHandlerClass)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2470
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2471
    def server_bind(self):
2472
        """This overrides the normal server_bind() function
2473
        to bind to an interface if one was specified, and also NOT to
2474
        bind to an address or port if they were not specified."""
237.7.406 by Teddy Hogeborn
Server: Fix bug with --interface flag when "cc" is not installed.
2475
        global SO_BINDTODEVICE
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2476
        if self.interface is not None:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
2477
            if SO_BINDTODEVICE is None:
237.7.400 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
2478
                # Fall back to a hard-coded value which seems to be
2479
                # common enough.
2480
                logger.warning("SO_BINDTODEVICE not found, trying 25")
2481
                SO_BINDTODEVICE = 25
2482
            try:
2483
                self.socket.setsockopt(
2484
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
2485
                    (self.interface + "\0").encode("utf-8"))
2486
            except socket.error as error:
2487
                if error.errno == errno.EPERM:
2488
                    logger.error("No permission to bind to"
2489
                                 " interface %s", self.interface)
2490
                elif error.errno == errno.ENOPROTOOPT:
2491
                    logger.error("SO_BINDTODEVICE not available;"
2492
                                 " cannot bind to interface %s",
2493
                                 self.interface)
2494
                elif error.errno == errno.ENODEV:
2495
                    logger.error("Interface %s does not exist,"
2496
                                 " cannot bind", self.interface)
2497
                else:
2498
                    raise
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2499
        # Only bind(2) the socket if we really need to.
2500
        if self.server_address[0] or self.server_address[1]:
2501
            if not self.server_address[0]:
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2502
                if self.address_family == socket.AF_INET6:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2503
                    any_address = "::"  # in6addr_any
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2504
                else:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2505
                    any_address = "0.0.0.0"  # INADDR_ANY
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2506
                self.server_address = (any_address,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2507
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2508
            elif not self.server_address[1]:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2509
                self.server_address = (self.server_address[0], 0)
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2510
#                 if self.interface:
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2511
#                     self.server_address = (self.server_address[0],
2512
#                                            0, # port
2513
#                                            0, # flowinfo
2514
#                                            if_nametoindex
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2515
#                                            (self.interface))
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2516
            return socketserver.TCPServer.server_bind(self)
237.2.102 by Teddy Hogeborn
Code cleanup.
2517
2518
2519
class MandosServer(IPv6_TCPServer):
2520
    """Mandos server.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2521
237.2.102 by Teddy Hogeborn
Code cleanup.
2522
    Attributes:
2523
        clients:        set of Client objects
2524
        gnutls_priority GnuTLS priority string
2525
        use_dbus:       Boolean; to emit D-Bus signals or not
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2526
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2527
    Assumes a GLib.MainLoop event loop.
237.2.102 by Teddy Hogeborn
Code cleanup.
2528
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2529
237.2.102 by Teddy Hogeborn
Code cleanup.
2530
    def __init__(self, server_address, RequestHandlerClass,
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2531
                 interface=None,
2532
                 use_ipv6=True,
2533
                 clients=None,
2534
                 gnutls_priority=None,
2535
                 use_dbus=True,
2536
                 socketfd=None):
237.2.102 by Teddy Hogeborn
Code cleanup.
2537
        self.enabled = False
2538
        self.clients = clients
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
2539
        if self.clients is None:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2540
            self.clients = {}
237.2.102 by Teddy Hogeborn
Code cleanup.
2541
        self.use_dbus = use_dbus
2542
        self.gnutls_priority = gnutls_priority
2543
        IPv6_TCPServer.__init__(self, server_address,
2544
                                RequestHandlerClass,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2545
                                interface=interface,
2546
                                use_ipv6=use_ipv6,
2547
                                socketfd=socketfd)
2548
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2549
    def server_activate(self):
2550
        if self.enabled:
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2551
            return socketserver.TCPServer.server_activate(self)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2552
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2553
    def enable(self):
2554
        self.enabled = True
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2555
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2556
    def add_pipe(self, parent_pipe, proc):
237.2.103 by Teddy Hogeborn
Code cleanup.
2557
        # Call "handle_ipc" for both data and EOF events
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2558
        GLib.io_add_watch(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2559
            parent_pipe.fileno(),
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2560
            GLib.IO_IN | GLib.IO_HUP,
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2561
            functools.partial(self.handle_ipc,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2562
                              parent_pipe=parent_pipe,
2563
                              proc=proc))
2564
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2565
    def handle_ipc(self, source, condition,
2566
                   parent_pipe=None,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2567
                   proc=None,
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2568
                   client_object=None):
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2569
        # error, or the other end of multiprocessing.Pipe has closed
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2570
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2571
            # Wait for other process to exit
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2572
            proc.join()
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2573
            return False
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2574
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2575
        # Read a request from the child
2576
        request = parent_pipe.recv()
2577
        command = request[0]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2578
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2579
        if command == 'init':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2580
            fpr = request[1]
2581
            address = request[2]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2582
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
2583
            for c in self.clients.values():
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2584
                if c.fingerprint == fpr:
2585
                    client = c
2586
                    break
2587
            else:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
2588
                logger.info("Client not found for fingerprint: %s, ad"
2589
                            "dress: %s", fpr, address)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2590
                if self.use_dbus:
2591
                    # Emit D-Bus signal
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2592
                    mandos_dbus_service.ClientNotFound(fpr,
2593
                                                       address[0])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2594
                parent_pipe.send(False)
2595
                return False
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2596
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2597
            GLib.io_add_watch(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2598
                parent_pipe.fileno(),
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2599
                GLib.IO_IN | GLib.IO_HUP,
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2600
                functools.partial(self.handle_ipc,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2601
                                  parent_pipe=parent_pipe,
2602
                                  proc=proc,
2603
                                  client_object=client))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2604
            parent_pipe.send(True)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2605
            # remove the old hook in favor of the new above hook on
2606
            # same fileno
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2607
            return False
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2608
        if command == 'funcall':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2609
            funcname = request[1]
2610
            args = request[2]
2611
            kwargs = request[3]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2612
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2613
            parent_pipe.send(('data', getattr(client_object,
2614
                                              funcname)(*args,
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2615
                                                        **kwargs)))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2616
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2617
        if command == 'getattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2618
            attrname = request[1]
237.7.303 by Teddy Hogeborn
mandos: More Python 3 fixes.
2619
            if isinstance(client_object.__getattribute__(attrname),
2620
                          collections.Callable):
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2621
                parent_pipe.send(('function', ))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2622
            else:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2623
                parent_pipe.send((
2624
                    'data', client_object.__getattribute__(attrname)))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2625
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2626
        if command == 'setattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2627
            attrname = request[1]
2628
            value = request[2]
2629
            setattr(client_object, attrname, value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2630
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2631
        return True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
2632
3 by Björn Påhlsson
Python based server
2633
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2634
def rfc3339_duration_to_delta(duration):
2635
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2636
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2637
    >>> rfc3339_duration_to_delta("P7D")
2638
    datetime.timedelta(7)
2639
    >>> rfc3339_duration_to_delta("PT60S")
2640
    datetime.timedelta(0, 60)
2641
    >>> rfc3339_duration_to_delta("PT60M")
2642
    datetime.timedelta(0, 3600)
2643
    >>> rfc3339_duration_to_delta("PT24H")
2644
    datetime.timedelta(1)
2645
    >>> rfc3339_duration_to_delta("P1W")
2646
    datetime.timedelta(7)
2647
    >>> rfc3339_duration_to_delta("PT5M30S")
2648
    datetime.timedelta(0, 330)
2649
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2650
    datetime.timedelta(1, 200)
2651
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2652
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2653
    # Parsing an RFC 3339 duration with regular expressions is not
2654
    # possible - there would have to be multiple places for the same
2655
    # values, like seconds.  The current code, while more esoteric, is
2656
    # cleaner without depending on a parsing library.  If Python had a
2657
    # built-in library for parsing we would use it, but we'd like to
2658
    # avoid excessive use of external libraries.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2659
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2660
    # New type for defining tokens, syntax, and semantics all-in-one
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2661
    Token = collections.namedtuple("Token", (
2662
        "regexp",  # To match token; if "value" is not None, must have
2663
                   # a "group" containing digits
2664
        "value",   # datetime.timedelta or None
2665
        "followers"))           # Tokens valid after this token
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2666
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2667
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2668
    token_end = Token(re.compile(r"$"), None, frozenset())
2669
    token_second = Token(re.compile(r"(\d+)S"),
2670
                         datetime.timedelta(seconds=1),
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2671
                         frozenset((token_end, )))
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2672
    token_minute = Token(re.compile(r"(\d+)M"),
2673
                         datetime.timedelta(minutes=1),
2674
                         frozenset((token_second, token_end)))
2675
    token_hour = Token(re.compile(r"(\d+)H"),
2676
                       datetime.timedelta(hours=1),
2677
                       frozenset((token_minute, token_end)))
2678
    token_time = Token(re.compile(r"T"),
2679
                       None,
2680
                       frozenset((token_hour, token_minute,
2681
                                  token_second)))
2682
    token_day = Token(re.compile(r"(\d+)D"),
2683
                      datetime.timedelta(days=1),
2684
                      frozenset((token_time, token_end)))
2685
    token_month = Token(re.compile(r"(\d+)M"),
2686
                        datetime.timedelta(weeks=4),
2687
                        frozenset((token_day, token_end)))
2688
    token_year = Token(re.compile(r"(\d+)Y"),
2689
                       datetime.timedelta(weeks=52),
2690
                       frozenset((token_month, token_end)))
2691
    token_week = Token(re.compile(r"(\d+)W"),
2692
                       datetime.timedelta(weeks=1),
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2693
                       frozenset((token_end, )))
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2694
    token_duration = Token(re.compile(r"P"), None,
2695
                           frozenset((token_year, token_month,
2696
                                      token_day, token_time,
237.7.269 by Teddy Hogeborn
Fix two mutually cancelling bugs.
2697
                                      token_week)))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2698
    # Define starting values:
2699
    # Value so far
2700
    value = datetime.timedelta()
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2701
    found_token = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2702
    # Following valid tokens
2703
    followers = frozenset((token_duration, ))
2704
    # String left to parse
2705
    s = duration
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2706
    # Loop until end token is found
2707
    while found_token is not token_end:
2708
        # Search for any currently valid tokens
2709
        for token in followers:
2710
            match = token.regexp.match(s)
2711
            if match is not None:
2712
                # Token found
2713
                if token.value is not None:
2714
                    # Value found, parse digits
2715
                    factor = int(match.group(1), 10)
2716
                    # Add to value so far
2717
                    value += factor * token.value
2718
                # Strip token from string
2719
                s = token.regexp.sub("", s, 1)
2720
                # Go to found token
2721
                found_token = token
2722
                # Set valid next tokens
2723
                followers = found_token.followers
2724
                break
2725
        else:
2726
            # No currently valid tokens were found
237.7.300 by Teddy Hogeborn
mandos: Generate better messages in exceptions.
2727
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2728
                             .format(duration))
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2729
    # End token found
2730
    return value
2731
2732
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2733
def string_to_delta(interval):
2734
    """Parse a string and return a datetime.timedelta
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2735
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2736
    >>> string_to_delta('7d')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2737
    datetime.timedelta(7)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2738
    >>> string_to_delta('60s')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2739
    datetime.timedelta(0, 60)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2740
    >>> string_to_delta('60m')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2741
    datetime.timedelta(0, 3600)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2742
    >>> string_to_delta('24h')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2743
    datetime.timedelta(1)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2744
    >>> string_to_delta('1w')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2745
    datetime.timedelta(7)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2746
    >>> string_to_delta('5m 30s')
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2747
    datetime.timedelta(0, 330)
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2748
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2749
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2750
    try:
2751
        return rfc3339_duration_to_delta(interval)
2752
    except ValueError:
2753
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2754
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2755
    timevalue = datetime.timedelta(0)
2756
    for s in interval.split():
2757
        try:
237.7.277 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2758
            suffix = s[-1]
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
2759
            value = int(s[:-1])
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2760
            if suffix == "d":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2761
                delta = datetime.timedelta(value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2762
            elif suffix == "s":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2763
                delta = datetime.timedelta(0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2764
            elif suffix == "m":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2765
                delta = datetime.timedelta(0, 0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2766
            elif suffix == "h":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2767
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2768
            elif suffix == "w":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2769
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2770
            else:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2771
                raise ValueError("Unknown suffix {!r}".format(suffix))
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2772
        except IndexError as e:
237.7.12 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
2773
            raise ValueError(*(e.args))
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2774
        timevalue += delta
2775
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2776
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
2777
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2778
def daemon(nochdir=False, noclose=False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2779
    """See daemon(3).  Standard BSD Unix function.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2780
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2781
    This should really exist as os.daemon, but it doesn't (yet)."""
2782
    if os.fork():
2783
        sys.exit()
2784
    os.setsid()
2785
    if not nochdir:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2786
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
2787
    if os.fork():
2788
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2789
    if not noclose:
2790
        # Close all standard open file descriptors
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2791
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2792
        if not stat.S_ISCHR(os.fstat(null).st_mode):
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2793
            raise OSError(errno.ENODEV,
2794
                          "{} not a character device"
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2795
                          .format(os.devnull))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2796
        os.dup2(null, sys.stdin.fileno())
2797
        os.dup2(null, sys.stdout.fileno())
2798
        os.dup2(null, sys.stderr.fileno())
2799
        if null > 2:
2800
            os.close(null)
2801
2802
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2803
def main():
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2804
237.2.142 by Teddy Hogeborn
* mandos: Fix line lengths.
2805
    ##################################################################
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2806
    # Parsing of options, both command line and config file
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2807
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2808
    parser = argparse.ArgumentParser()
2809
    parser.add_argument("-v", "--version", action="version",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2810
                        version="%(prog)s {}".format(version),
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2811
                        help="show version number and exit")
2812
    parser.add_argument("-i", "--interface", metavar="IF",
2813
                        help="Bind to interface IF")
2814
    parser.add_argument("-a", "--address",
2815
                        help="Address to listen for requests on")
2816
    parser.add_argument("-p", "--port", type=int,
2817
                        help="Port number to receive requests on")
2818
    parser.add_argument("--check", action="store_true",
2819
                        help="Run self-test")
2820
    parser.add_argument("--debug", action="store_true",
2821
                        help="Debug mode; run in foreground and log"
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2822
                        " to terminal", default=None)
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2823
    parser.add_argument("--debuglevel", metavar="LEVEL",
2824
                        help="Debug level for stdout output")
2825
    parser.add_argument("--priority", help="GnuTLS"
2826
                        " priority string (see GnuTLS documentation)")
2827
    parser.add_argument("--servicename",
2828
                        metavar="NAME", help="Zeroconf service name")
2829
    parser.add_argument("--configdir",
2830
                        default="/etc/mandos", metavar="DIR",
2831
                        help="Directory to search for configuration"
2832
                        " files")
2833
    parser.add_argument("--no-dbus", action="store_false",
2834
                        dest="use_dbus", help="Do not provide D-Bus"
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2835
                        " system bus interface", default=None)
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2836
    parser.add_argument("--no-ipv6", action="store_false",
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2837
                        dest="use_ipv6", help="Do not use IPv6",
2838
                        default=None)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2839
    parser.add_argument("--no-restore", action="store_false",
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2840
                        dest="restore", help="Do not restore stored"
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2841
                        " state", default=None)
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2842
    parser.add_argument("--socket", type=int,
2843
                        help="Specify a file descriptor to a network"
2844
                        " socket to use instead of creating one")
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2845
    parser.add_argument("--statedir", metavar="DIR",
2846
                        help="Directory to save/restore state in")
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2847
    parser.add_argument("--foreground", action="store_true",
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2848
                        help="Run in foreground", default=None)
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2849
    parser.add_argument("--no-zeroconf", action="store_false",
2850
                        dest="zeroconf", help="Do not use Zeroconf",
2851
                        default=None)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2852
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2853
    options = parser.parse_args()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2854
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2855
    if options.check:
2856
        import doctest
237.7.202 by Teddy Hogeborn
Fix running of self-tests.
2857
        fail_count, test_count = doctest.testmod()
2858
        sys.exit(os.EX_OK if fail_count == 0 else 1)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2859
28 by Teddy Hogeborn
* server.conf: New file.
2860
    # Default values for config file for server-global settings
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2861
    server_defaults = {"interface": "",
2862
                       "address": "",
2863
                       "port": "",
2864
                       "debug": "False",
2865
                       "priority":
2866
                       "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
                       ":+SIGN-DSA-SHA256",
2868
                       "servicename": "Mandos",
2869
                       "use_dbus": "True",
2870
                       "use_ipv6": "True",
2871
                       "debuglevel": "",
2872
                       "restore": "True",
2873
                       "socket": "",
2874
                       "statedir": "/var/lib/mandos",
2875
                       "foreground": "False",
2876
                       "zeroconf": "True",
2877
                       }
2878
28 by Teddy Hogeborn
* server.conf: New file.
2879
    # Parse config file for server-global settings
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2880
    server_config = configparser.SafeConfigParser(server_defaults)
28 by Teddy Hogeborn
* server.conf: New file.
2881
    del server_defaults
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2882
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
28 by Teddy Hogeborn
* server.conf: New file.
2883
    # Convert the SafeConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
2884
    server_settings = server_config.defaults()
237.2.45 by Teddy Hogeborn
* mandos (main): Bug fix: use "getint" on the "port" config file
2885
    # Use the appropriate methods on the non-string config options
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2886
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2887
        server_settings[option] = server_config.getboolean("DEFAULT",
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2888
                                                           option)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2889
    if server_settings["port"]:
2890
        server_settings["port"] = server_config.getint("DEFAULT",
2891
                                                       "port")
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2892
    if server_settings["socket"]:
2893
        server_settings["socket"] = server_config.getint("DEFAULT",
2894
                                                         "socket")
237.7.139 by Teddy Hogeborn
Merge "--socket" option for server.
2895
        # Later, stdin will, and stdout and stderr might, be dup'ed
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2896
        # over with an opened os.devnull.  But we don't want this to
2897
        # happen with a supplied network socket.
2898
        if 0 <= server_settings["socket"] <= 2:
2899
            server_settings["socket"] = os.dup(server_settings
2900
                                               ["socket"])
28 by Teddy Hogeborn
* server.conf: New file.
2901
    del server_config
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2902
28 by Teddy Hogeborn
* server.conf: New file.
2903
    # Override the settings from the config file with command line
2904
    # options, if set.
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2905
    for option in ("interface", "address", "port", "debug",
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2906
                   "priority", "servicename", "configdir", "use_dbus",
2907
                   "use_ipv6", "debuglevel", "restore", "statedir",
2908
                   "socket", "foreground", "zeroconf"):
28 by Teddy Hogeborn
* server.conf: New file.
2909
        value = getattr(options, option)
2910
        if value is not None:
2911
            server_settings[option] = value
2912
    del options
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2913
    # Force all strings to be unicode
2914
    for option in server_settings.keys():
237.7.277 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2915
        if isinstance(server_settings[option], bytes):
2916
            server_settings[option] = (server_settings[option]
2917
                                       .decode("utf-8"))
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2918
    # Force all boolean options to be boolean
2919
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2920
                   "foreground", "zeroconf"):
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2921
        server_settings[option] = bool(server_settings[option])
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2922
    # Debug implies foreground
2923
    if server_settings["debug"]:
2924
        server_settings["foreground"] = True
28 by Teddy Hogeborn
* server.conf: New file.
2925
    # Now we have our good server settings in "server_settings"
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2926
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2927
    ##################################################################
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2928
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2929
    if (not server_settings["zeroconf"]
2930
        and not (server_settings["port"]
2931
                 or server_settings["socket"] != "")):
2932
        parser.error("Needs port or socket to work without Zeroconf")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2933
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2934
    # For convenience
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2935
    debug = server_settings["debug"]
2936
    debuglevel = server_settings["debuglevel"]
2937
    use_dbus = server_settings["use_dbus"]
2938
    use_ipv6 = server_settings["use_ipv6"]
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2939
    stored_state_path = os.path.join(server_settings["statedir"],
2940
                                     stored_state_file)
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2941
    foreground = server_settings["foreground"]
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2942
    zeroconf = server_settings["zeroconf"]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2943
237.12.4 by Björn Påhlsson
restructured logger
2944
    if debug:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2945
        initlogger(debug, logging.DEBUG)
237.12.4 by Björn Påhlsson
restructured logger
2946
    else:
2947
        if not debuglevel:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2948
            initlogger(debug)
237.12.4 by Björn Påhlsson
restructured logger
2949
        else:
2950
            level = getattr(logging, debuglevel.upper())
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2951
            initlogger(debug, level)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2952
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2953
    if server_settings["servicename"] != "Mandos":
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2954
        syslogger.setFormatter(
2955
            logging.Formatter('Mandos ({}) [%(process)d]:'
2956
                              ' %(levelname)s: %(message)s'.format(
2957
                                  server_settings["servicename"])))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2958
28 by Teddy Hogeborn
* server.conf: New file.
2959
    # Parse config file with clients
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2960
    client_config = configparser.SafeConfigParser(Client
2961
                                                  .client_defaults)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2962
    client_config.read(os.path.join(server_settings["configdir"],
2963
                                    "clients.conf"))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2964
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2965
    global mandos_dbus_service
2966
    mandos_dbus_service = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2967
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2968
    socketfd = None
2969
    if server_settings["socket"] != "":
2970
        socketfd = server_settings["socket"]
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2971
    tcp_server = MandosServer(
2972
        (server_settings["address"], server_settings["port"]),
2973
        ClientHandler,
2974
        interface=(server_settings["interface"] or None),
2975
        use_ipv6=use_ipv6,
2976
        gnutls_priority=server_settings["priority"],
2977
        use_dbus=use_dbus,
2978
        socketfd=socketfd)
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2979
    if not foreground:
237.7.174 by Teddy Hogeborn
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
2980
        pidfilename = "/run/mandos.pid"
237.7.184 by Teddy Hogeborn
Fall back to /var/run for pidfile if /run is not a directory.
2981
        if not os.path.isdir("/run/."):
2982
            pidfilename = "/var/run/mandos.pid"
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2983
        pidfile = None
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2984
        try:
237.7.299 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
2985
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2986
        except IOError as e:
2987
            logger.error("Could not open file %r", pidfilename,
2988
                         exc_info=e)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2989
237.7.364 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
2990
    for name, group in (("_mandos", "_mandos"),
2991
                        ("mandos", "mandos"),
2992
                        ("nobody", "nogroup")):
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2993
        try:
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2994
            uid = pwd.getpwnam(name).pw_uid
237.7.364 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
2995
            gid = pwd.getpwnam(group).pw_gid
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2996
            break
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2997
        except KeyError:
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2998
            continue
2999
    else:
3000
        uid = 65534
3001
        gid = 65534
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3002
    try:
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3003
        os.setgid(gid)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3004
        os.setuid(uid)
237.7.373 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
3005
        if debug:
3006
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
3007
                                                             gid))
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3008
    except OSError as error:
237.7.373 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
3009
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
3010
                       .format(uid, gid, os.strerror(error.errno)))
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
3011
        if error.errno != errno.EPERM:
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3012
            raise
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3013
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3014
    if debug:
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
3015
        # Enable all possible GnuTLS debugging
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3016
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3017
        # "Use a log level over 10 to enable all debugging options."
3018
        # - GnuTLS manual
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3019
        gnutls.global_set_log_level(11)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3020
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3021
        @gnutls.log_func
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3022
        def debug_gnutls(level, string):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3023
            logger.debug("GnuTLS: %s", string[:-1])
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3024
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3025
        gnutls.global_set_log_function(debug_gnutls)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3026
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
3027
        # Redirect stdin so all checkers get /dev/null
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3028
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
3029
        os.dup2(null, sys.stdin.fileno())
3030
        if null > 2:
3031
            os.close(null)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3032
237.7.6 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3033
    # Need to fork before connecting to D-Bus
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
3034
    if not foreground:
237.7.6 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3035
        # Close all input and output, do double fork, etc.
3036
        daemon()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3037
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3038
    # multiprocessing will use threads, so before we use GLib we need
3039
    # to inform GLib that threads will be used.
3040
    GLib.threads_init()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3041
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3042
    global main_loop
3043
    # From the Avahi example code
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3044
    DBusGMainLoop(set_as_default=True)
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3045
    main_loop = GLib.MainLoop()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3046
    bus = dbus.SystemBus()
3047
    # End of Avahi example code
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3048
    if use_dbus:
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3049
        try:
237.7.53 by Björn Påhlsson
The domain name has changed, so the D-Bus bus and interface names must
3050
            bus_name = dbus.service.BusName("se.recompile.Mandos",
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3051
                                            bus,
3052
                                            do_not_queue=True)
3053
            old_bus_name = dbus.service.BusName(
3054
                "se.bsnet.fukt.Mandos", bus,
3055
                do_not_queue=True)
237.7.298 by Teddy Hogeborn
mandos: Disable D-Bus if any DBusException is raised when connecting.
3056
        except dbus.exceptions.DBusException as e:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3057
            logger.error("Disabling D-Bus:", exc_info=e)
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3058
            use_dbus = False
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3059
            server_settings["use_dbus"] = False
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3060
            tcp_server.use_dbus = False
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3061
    if zeroconf:
3062
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3063
        service = AvahiServiceToSyslog(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3064
            name=server_settings["servicename"],
3065
            servicetype="_mandos._tcp",
3066
            protocol=protocol,
3067
            bus=bus)
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3068
        if server_settings["interface"]:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3069
            service.interface = if_nametoindex(
3070
                server_settings["interface"].encode("utf-8"))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3071
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
3072
    global multiprocessing_manager
3073
    multiprocessing_manager = multiprocessing.Manager()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3074
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3075
    client_class = Client
3076
    if use_dbus:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3077
        client_class = functools.partial(ClientDBus, bus=bus)
3078
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3079
    client_settings = Client.config_parser(client_config)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3080
    old_client_settings = {}
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3081
    clients_data = {}
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3082
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3083
    # This is used to redirect stdout and stderr for checker processes
3084
    global wnull
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3085
    wnull = open(os.devnull, "w")  # A writable /dev/null
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3086
    # Only used if server is running in foreground but not in debug
3087
    # mode
3088
    if debug or not foreground:
3089
        wnull.close()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3090
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
3091
    # Get client data and settings from last running state.
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3092
    if server_settings["restore"]:
3093
        try:
3094
            with open(stored_state_path, "rb") as stored_state:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3095
                if sys.version_info.major == 2:
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3096
                    clients_data, old_client_settings = pickle.load(
3097
                        stored_state)
3098
                else:
3099
                    bytes_clients_data, bytes_old_client_settings = (
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3100
                        pickle.load(stored_state, encoding="bytes"))
3101
                    #   Fix bytes to strings
3102
                    #  clients_data
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3103
                    # .keys()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3104
                    clients_data = {(key.decode("utf-8")
3105
                                     if isinstance(key, bytes)
3106
                                     else key): value
3107
                                    for key, value in
3108
                                    bytes_clients_data.items()}
237.7.377 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3109
                    del bytes_clients_data
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3110
                    for key in clients_data:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3111
                        value = {(k.decode("utf-8")
3112
                                  if isinstance(k, bytes) else k): v
3113
                                 for k, v in
3114
                                 clients_data[key].items()}
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3115
                        clients_data[key] = value
3116
                        # .client_structure
3117
                        value["client_structure"] = [
3118
                            (s.decode("utf-8")
3119
                             if isinstance(s, bytes)
3120
                             else s) for s in
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3121
                            value["client_structure"]]
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3122
                        # .name & .host
3123
                        for k in ("name", "host"):
3124
                            if isinstance(value[k], bytes):
3125
                                value[k] = value[k].decode("utf-8")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3126
                    #  old_client_settings
237.7.377 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3127
                    # .keys()
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3128
                    old_client_settings = {
3129
                        (key.decode("utf-8")
3130
                         if isinstance(key, bytes)
3131
                         else key): value
3132
                        for key, value in
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3133
                        bytes_old_client_settings.items()}
237.7.377 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3134
                    del bytes_old_client_settings
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3135
                    # .host
3136
                    for value in old_client_settings.values():
237.7.377 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3137
                        if isinstance(value["host"], bytes):
3138
                            value["host"] = (value["host"]
3139
                                             .decode("utf-8"))
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3140
            os.remove(stored_state_path)
3141
        except IOError as e:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3142
            if e.errno == errno.ENOENT:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3143
                logger.warning("Could not load persistent state:"
3144
                               " {}".format(os.strerror(e.errno)))
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3145
            else:
3146
                logger.critical("Could not load persistent state:",
3147
                                exc_info=e)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3148
                raise
237.11.23 by Teddy Hogeborn
* mandos (main): Handle EOFError when reading state file.
3149
        except EOFError as e:
3150
            logger.warning("Could not load persistent state: "
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3151
                           "EOFError:",
3152
                           exc_info=e)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3153
237.12.9 by Björn Påhlsson
renamed variables
3154
    with PGPEngine() as pgp:
237.23.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3155
        for client_name, client in clients_data.items():
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3156
            # Skip removed clients
3157
            if client_name not in client_settings:
3158
                continue
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3159
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3160
            # Decide which value to use after restoring saved state.
3161
            # We have three different values: Old config file,
3162
            # new config file, and saved state.
3163
            # New config value takes precedence if it differs from old
3164
            # config value, otherwise use saved state.
3165
            for name, value in client_settings[client_name].items():
3166
                try:
3167
                    # For each value in new config, check if it
3168
                    # differs from the old config value (Except for
3169
                    # the "secret" attribute)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3170
                    if (name != "secret"
3171
                        and (value !=
3172
                             old_client_settings[client_name][name])):
237.14.10 by Teddy Hogeborn
* mandos (main): Bug fix: Syntax fix when restoring settings.
3173
                        client[name] = value
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3174
                except KeyError:
3175
                    pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3176
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3177
            # Clients who has passed its expire date can still be
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
3178
            # enabled if its last checker was successful.  A Client
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3179
            # whose checker succeeded before we stored its state is
3180
            # assumed to have successfully run all checkers during
3181
            # downtime.
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
3182
            if client["enabled"]:
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3183
                if datetime.datetime.utcnow() >= client["expires"]:
3184
                    if not client["last_checked_ok"]:
3185
                        logger.warning(
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3186
                            "disabling client {} - Client never "
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3187
                            "performed a successful checker".format(
3188
                                client_name))
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3189
                        client["enabled"] = False
3190
                    elif client["last_checker_status"] != 0:
3191
                        logger.warning(
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3192
                            "disabling client {} - Client last"
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3193
                            " checker failed with error code"
3194
                            " {}".format(
3195
                                client_name,
3196
                                client["last_checker_status"]))
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3197
                        client["enabled"] = False
3198
                    else:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3199
                        client["expires"] = (
3200
                            datetime.datetime.utcnow()
3201
                            + client["timeout"])
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
3202
                        logger.debug("Last checker succeeded,"
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3203
                                     " keeping {} enabled".format(
3204
                                         client_name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
3205
            try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3206
                client["secret"] = pgp.decrypt(
3207
                    client["encrypted_secret"],
3208
                    client_settings[client_name]["secret"])
237.12.9 by Björn Påhlsson
renamed variables
3209
            except PGPError:
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3210
                # If decryption fails, we use secret from new settings
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3211
                logger.debug("Failed to decrypt {} old secret".format(
3212
                    client_name))
3213
                client["secret"] = (client_settings[client_name]
3214
                                    ["secret"])
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3215
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3216
    # Add/remove clients based on new changes made to config
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
3217
    for client_name in (set(old_client_settings)
3218
                        - set(client_settings)):
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3219
        del clients_data[client_name]
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
3220
    for client_name in (set(client_settings)
3221
                        - set(old_client_settings)):
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3222
        clients_data[client_name] = client_settings[client_name]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3223
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3224
    # Create all client objects
237.23.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3225
    for client_name, client in clients_data.items():
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3226
        tcp_server.clients[client_name] = client_class(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3227
            name=client_name,
3228
            settings=client,
3229
            server_settings=server_settings)
3230
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
3231
    if not tcp_server.clients:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3232
        logger.warning("No clients defined")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3233
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
3234
    if not foreground:
3235
        if pidfile is not None:
237.7.299 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3236
            pid = os.getpid()
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
3237
            try:
3238
                with pidfile:
237.7.299 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3239
                    print(pid, file=pidfile)
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
3240
            except IOError:
3241
                logger.error("Could not write to file %r with PID %d",
3242
                             pidfilename, pid)
3243
        del pidfile
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
3244
        del pidfilename
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3245
237.7.379 by Teddy Hogeborn
Server: Fix bug where it did not exit timely on signals
3246
    for termsig in (signal.SIGHUP, signal.SIGTERM):
3247
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3248
                             lambda: main_loop.quit() and False)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3249
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3250
    if use_dbus:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3251
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3252
        @alternate_dbus_interfaces(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3253
            {"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3254
        class MandosDBusService(DBusObjectWithObjectManager):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3255
            """A D-Bus proxy object"""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3256
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3257
            def __init__(self):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3258
                dbus.service.Object.__init__(self, bus, "/")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3259
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
3260
            _interface = "se.recompile.Mandos"
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3261
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3262
            @dbus.service.signal(_interface, signature="o")
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
3263
            def ClientAdded(self, objpath):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3264
                "D-Bus signal"
3265
                pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3266
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3267
            @dbus.service.signal(_interface, signature="ss")
237.2.172 by Teddy Hogeborn
* mandos (MandosServer.handle_ipc): Better log message.
3268
            def ClientNotFound(self, fingerprint, address):
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
3269
                "D-Bus signal"
3270
                pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3271
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3272
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3273
                               "true"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3274
            @dbus.service.signal(_interface, signature="os")
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3275
            def ClientRemoved(self, objpath, name):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3276
                "D-Bus signal"
3277
                pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3278
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3279
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3280
                               "true"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3281
            @dbus.service.method(_interface, out_signature="ao")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3282
            def GetAllClients(self):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3283
                "D-Bus method"
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3284
                return dbus.Array(c.dbus_object_path for c in
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3285
                                  tcp_server.clients.values())
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3286
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3287
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3288
                               "true"})
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3289
            @dbus.service.method(_interface,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3290
                                 out_signature="a{oa{sv}}")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3291
            def GetAllClientsWithProperties(self):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3292
                "D-Bus method"
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3293
                return dbus.Dictionary(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3294
                    {c.dbus_object_path: c.GetAll(
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3295
                        "se.recompile.Mandos.Client")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3296
                     for c in tcp_server.clients.values()},
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3297
                    signature="oa{sv}")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3298
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3299
            @dbus.service.method(_interface, in_signature="o")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3300
            def RemoveClient(self, object_path):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3301
                "D-Bus method"
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3302
                for c in tcp_server.clients.values():
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3303
                    if c.dbus_object_path == object_path:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3304
                        del tcp_server.clients[c.name]
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3305
                        c.remove_from_connection()
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3306
                        # Don't signal the disabling
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3307
                        c.disable(quiet=True)
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3308
                        # Emit D-Bus signal for removal
3309
                        self.client_removed_signal(c)
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3310
                        return
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3311
                raise KeyError(object_path)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3312
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3313
            del _interface
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3314
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3315
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3316
                                 out_signature="a{oa{sa{sv}}}")
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3317
            def GetManagedObjects(self):
3318
                """D-Bus method"""
3319
                return dbus.Dictionary(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3320
                    {client.dbus_object_path:
3321
                     dbus.Dictionary(
3322
                         {interface: client.GetAll(interface)
3323
                          for interface in
3324
                          client._get_all_interface_names()})
3325
                     for client in tcp_server.clients.values()})
3326
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3327
            def client_added_signal(self, client):
3328
                """Send the new standard signal and the old signal"""
3329
                if use_dbus:
3330
                    # New standard signal
3331
                    self.InterfacesAdded(
3332
                        client.dbus_object_path,
3333
                        dbus.Dictionary(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3334
                            {interface: client.GetAll(interface)
3335
                             for interface in
3336
                             client._get_all_interface_names()}))
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3337
                    # Old signal
3338
                    self.ClientAdded(client.dbus_object_path)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3339
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3340
            def client_removed_signal(self, client):
3341
                """Send the new standard signal and the old signal"""
3342
                if use_dbus:
3343
                    # New standard signal
3344
                    self.InterfacesRemoved(
3345
                        client.dbus_object_path,
3346
                        client._get_all_interface_names())
3347
                    # Old signal
3348
                    self.ClientRemoved(client.dbus_object_path,
3349
                                       client.name)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3350
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
3351
        mandos_dbus_service = MandosDBusService()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3352
237.7.398 by Teddy Hogeborn
mandos: Bug fix: Do multiprocessing cleanup correctly on exit
3353
    # Save modules to variables to exempt the modules from being
3354
    # unloaded before the function registered with atexit() is run.
3355
    mp = multiprocessing
3356
    wn = wnull
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3357
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3358
    def cleanup():
3359
        "Cleanup function; run on exit"
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3360
        if zeroconf:
3361
            service.cleanup()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3362
237.7.398 by Teddy Hogeborn
mandos: Bug fix: Do multiprocessing cleanup correctly on exit
3363
        mp.active_children()
3364
        wn.close()
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3365
        if not (tcp_server.clients or client_settings):
3366
            return
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3367
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
3368
        # Store client before exiting. Secrets are encrypted with key
3369
        # based on what config file has. If config file is
3370
        # removed/edited, old secret will thus be unrecovable.
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3371
        clients = {}
237.12.9 by Björn Påhlsson
renamed variables
3372
        with PGPEngine() as pgp:
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3373
            for client in tcp_server.clients.values():
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3374
                key = client_settings[client.name]["secret"]
237.12.9 by Björn Påhlsson
renamed variables
3375
                client.encrypted_secret = pgp.encrypt(client.secret,
3376
                                                      key)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3377
                client_dict = {}
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3378
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3379
                # A list of attributes that can not be pickled
3380
                # + secret.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3381
                exclude = {"bus", "changedstate", "secret",
3382
                           "checker", "server_settings"}
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3383
                for name, typ in inspect.getmembers(dbus.service
3384
                                                    .Object):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3385
                    exclude.add(name)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3386
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3387
                client_dict["encrypted_secret"] = (client
3388
                                                   .encrypted_secret)
3389
                for attr in client.client_structure:
3390
                    if attr not in exclude:
3391
                        client_dict[attr] = getattr(client, attr)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3392
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3393
                clients[client.name] = client_dict
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3394
                del client_settings[client.name]["secret"]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3395
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3396
        try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3397
            with tempfile.NamedTemporaryFile(
3398
                    mode='wb',
3399
                    suffix=".pickle",
3400
                    prefix='clients-',
3401
                    dir=os.path.dirname(stored_state_path),
3402
                    delete=False) as stored_state:
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3403
                pickle.dump((clients, client_settings), stored_state,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3404
                            protocol=2)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3405
                tempname = stored_state.name
237.11.26 by teddy at bsnet
* mandos (main/cleanup): Write new file, then rename. Use
3406
            os.rename(tempname, stored_state_path)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3407
        except (IOError, OSError) as e:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3408
            if not debug:
3409
                try:
3410
                    os.remove(tempname)
3411
                except NameError:
3412
                    pass
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3413
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3414
                logger.warning("Could not save persistent state: {}"
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3415
                               .format(os.strerror(e.errno)))
3416
            else:
3417
                logger.warning("Could not save persistent state:",
3418
                               exc_info=e)
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3419
                raise
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3420
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3421
        # Delete all clients, and settings from config
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3422
        while tcp_server.clients:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3423
            name, client = tcp_server.clients.popitem()
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3424
            if use_dbus:
3425
                client.remove_from_connection()
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3426
            # Don't signal the disabling
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3427
            client.disable(quiet=True)
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3428
            # Emit D-Bus signal for removal
237.7.344 by Teddy Hogeborn
On cleanup, Signal ClientRemoved only if using D-Bus.
3429
            if use_dbus:
3430
                mandos_dbus_service.client_removed_signal(client)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3431
        client_settings.clear()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3432
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3433
    atexit.register(cleanup)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3434
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3435
    for client in tcp_server.clients.values():
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3436
        if use_dbus:
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3437
            # Emit D-Bus signal for adding
3438
            mandos_dbus_service.client_added_signal(client)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3439
        # Need to initiate checking of clients
3440
        if client.enabled:
3441
            client.init_checker()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3442
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3443
    tcp_server.enable()
3444
    tcp_server.server_activate()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3445
28 by Teddy Hogeborn
* server.conf: New file.
3446
    # Find out what port we got
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3447
    if zeroconf:
3448
        service.port = tcp_server.socket.getsockname()[1]
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
3449
    if use_ipv6:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3450
        logger.info("Now listening on address %r, port %d,"
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
3451
                    " flowinfo %d, scope_id %d",
3452
                    *tcp_server.socket.getsockname())
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
3453
    else:                       # IPv4
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
3454
        logger.info("Now listening on address %r, port %d",
3455
                    *tcp_server.socket.getsockname())
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3456
3457
    # service.interface = tcp_server.socket.getsockname()[3]
3458
28 by Teddy Hogeborn
* server.conf: New file.
3459
    try:
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3460
        if zeroconf:
3461
            # From the Avahi example code
3462
            try:
3463
                service.activate()
3464
            except dbus.exceptions.DBusException as error:
3465
                logger.critical("D-Bus Exception", exc_info=error)
3466
                cleanup()
3467
                sys.exit(1)
3468
            # End of Avahi example code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3469
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3470
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3471
                          lambda *args, **kwargs:
3472
                          (tcp_server.handle_request
3473
                           (*args[2:], **kwargs) or True))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3474
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3475
        logger.debug("Starting main loop")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3476
        main_loop.run()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3477
    except AvahiError as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
3478
        logger.critical("Avahi Error", exc_info=error)
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
3479
        cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
3480
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3481
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
3482
        if debug:
237.8.5 by teddy at bsnet
* mandos: Use unicode string literals.
3483
            print("", file=sys.stderr)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3484
        logger.debug("Server received KeyboardInterrupt")
3485
    logger.debug("Server exiting")
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
3486
    # Must run before the D-Bus bus name gets deregistered
3487
    cleanup()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3488
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3489
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3490
if __name__ == '__main__':
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3491
    main()