/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Björn Påhlsson
  • Date: 2010-09-07 18:48:56 UTC
  • mto: (237.7.1 mandos)
  • mto: This revision was merged to the branch mainline in revision 270.
  • Revision ID: belorn@fukt.bsnet.se-20100907184856-waz6cvxbm7ranha2
added the actually plugin file for plymouth

Show diffs side-by-side

added added

removed removed

Lines of Context:
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# methods "add" and "remove" in the "AvahiService" class, the
10
 
# "server_state_changed" and "entry_group_state_changed" functions,
11
 
# and some lines in "main".
 
9
# methods "add", "remove", "server_state_changed",
 
10
# "entry_group_state_changed", "cleanup", and "activate" in the
 
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
 
34
34
from __future__ import division, with_statement, absolute_import
35
35
 
36
 
import SocketServer
 
36
import SocketServer as socketserver
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
 
import ConfigParser
 
47
import ConfigParser as configparser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
 
from sets import Set
53
52
import subprocess
54
53
import atexit
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
 
from contextlib import closing
 
58
import contextlib
 
59
import struct
 
60
import fcntl
 
61
import functools
 
62
import cPickle as pickle
 
63
import multiprocessing
60
64
 
61
65
import dbus
62
66
import dbus.service
65
69
from dbus.mainloop.glib import DBusGMainLoop
66
70
import ctypes
67
71
import ctypes.util
68
 
 
69
 
version = "1.0.5"
70
 
 
71
 
logger = logging.Logger('mandos')
 
72
import xml.dom.minidom
 
73
import inspect
 
74
 
 
75
try:
 
76
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
 
77
except AttributeError:
 
78
    try:
 
79
        from IN import SO_BINDTODEVICE
 
80
    except ImportError:
 
81
        SO_BINDTODEVICE = None
 
82
 
 
83
 
 
84
version = "1.0.14"
 
85
 
 
86
#logger = logging.getLogger(u'mandos')
 
87
logger = logging.Logger(u'mandos')
72
88
syslogger = (logging.handlers.SysLogHandler
73
89
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
90
              address = "/dev/log"))
75
91
syslogger.setFormatter(logging.Formatter
76
 
                       ('Mandos [%(process)d]: %(levelname)s:'
77
 
                        ' %(message)s'))
 
92
                       (u'Mandos [%(process)d]: %(levelname)s:'
 
93
                        u' %(message)s'))
78
94
logger.addHandler(syslogger)
79
95
 
80
96
console = logging.StreamHandler()
81
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
 
                                       ' %(levelname)s: %(message)s'))
 
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
 
98
                                       u' %(levelname)s:'
 
99
                                       u' %(message)s'))
83
100
logger.addHandler(console)
84
101
 
85
102
class AvahiError(Exception):
98
115
 
99
116
class AvahiService(object):
100
117
    """An Avahi (Zeroconf) service.
 
118
    
101
119
    Attributes:
102
120
    interface: integer; avahi.IF_UNSPEC or an interface index.
103
121
               Used to optionally bind to the specified interface.
104
 
    name: string; Example: 'Mandos'
105
 
    type: string; Example: '_mandos._tcp'.
 
122
    name: string; Example: u'Mandos'
 
123
    type: string; Example: u'_mandos._tcp'.
106
124
                  See <http://www.dns-sd.org/ServiceTypes.html>
107
125
    port: integer; what port to announce
108
126
    TXT: list of strings; TXT record for the service
111
129
    max_renames: integer; maximum number of renames
112
130
    rename_count: integer; counter so we only rename after collisions
113
131
                  a sensible number of times
 
132
    group: D-Bus Entry Group
 
133
    server: D-Bus Server
 
134
    bus: dbus.SystemBus()
114
135
    """
115
136
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
137
                 servicetype = None, port = None, TXT = None,
117
 
                 domain = "", host = "", max_renames = 32768):
 
138
                 domain = u"", host = u"", max_renames = 32768,
 
139
                 protocol = avahi.PROTO_UNSPEC, bus = None):
118
140
        self.interface = interface
119
141
        self.name = name
120
142
        self.type = servicetype
124
146
        self.host = host
125
147
        self.rename_count = 0
126
148
        self.max_renames = max_renames
 
149
        self.protocol = protocol
 
150
        self.group = None       # our entry group
 
151
        self.server = None
 
152
        self.bus = bus
127
153
    def rename(self):
128
154
        """Derived from the Avahi example code"""
129
155
        if self.rename_count >= self.max_renames:
131
157
                            u" after %i retries, exiting.",
132
158
                            self.rename_count)
133
159
            raise AvahiServiceError(u"Too many renames")
134
 
        self.name = server.GetAlternativeServiceName(self.name)
 
160
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
135
161
        logger.info(u"Changing Zeroconf service name to %r ...",
136
 
                    str(self.name))
 
162
                    self.name)
137
163
        syslogger.setFormatter(logging.Formatter
138
 
                               ('Mandos (%s): %%(levelname)s:'
139
 
                                ' %%(message)s' % self.name))
 
164
                               (u'Mandos (%s) [%%(process)d]:'
 
165
                                u' %%(levelname)s: %%(message)s'
 
166
                                % self.name))
140
167
        self.remove()
141
168
        self.add()
142
169
        self.rename_count += 1
143
170
    def remove(self):
144
171
        """Derived from the Avahi example code"""
145
 
        if group is not None:
146
 
            group.Reset()
 
172
        if self.group is not None:
 
173
            self.group.Reset()
147
174
    def add(self):
148
175
        """Derived from the Avahi example code"""
149
 
        global group
150
 
        if group is None:
151
 
            group = dbus.Interface(bus.get_object
152
 
                                   (avahi.DBUS_NAME,
153
 
                                    server.EntryGroupNew()),
154
 
                                   avahi.DBUS_INTERFACE_ENTRY_GROUP)
155
 
            group.connect_to_signal('StateChanged',
156
 
                                    entry_group_state_changed)
 
176
        if self.group is None:
 
177
            self.group = dbus.Interface(
 
178
                self.bus.get_object(avahi.DBUS_NAME,
 
179
                                    self.server.EntryGroupNew()),
 
180
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
181
            self.group.connect_to_signal('StateChanged',
 
182
                                         self
 
183
                                         .entry_group_state_changed)
157
184
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
158
 
                     service.name, service.type)
159
 
        group.AddService(
160
 
                self.interface,         # interface
161
 
                avahi.PROTO_INET6,      # protocol
162
 
                dbus.UInt32(0),         # flags
163
 
                self.name, self.type,
164
 
                self.domain, self.host,
165
 
                dbus.UInt16(self.port),
166
 
                avahi.string_array_to_txt_array(self.TXT))
167
 
        group.Commit()
168
 
 
169
 
# From the Avahi example code:
170
 
group = None                            # our entry group
171
 
# End of Avahi example code
172
 
 
173
 
 
174
 
def _datetime_to_dbus(dt, variant_level=0):
175
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
176
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
177
 
 
178
 
 
179
 
class Client(dbus.service.Object):
 
185
                     self.name, self.type)
 
186
        self.group.AddService(
 
187
            self.interface,
 
188
            self.protocol,
 
189
            dbus.UInt32(0),     # flags
 
190
            self.name, self.type,
 
191
            self.domain, self.host,
 
192
            dbus.UInt16(self.port),
 
193
            avahi.string_array_to_txt_array(self.TXT))
 
194
        self.group.Commit()
 
195
    def entry_group_state_changed(self, state, error):
 
196
        """Derived from the Avahi example code"""
 
197
        logger.debug(u"Avahi entry group state change: %i", state)
 
198
        
 
199
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
200
            logger.debug(u"Zeroconf service established.")
 
201
        elif state == avahi.ENTRY_GROUP_COLLISION:
 
202
            logger.warning(u"Zeroconf service name collision.")
 
203
            self.rename()
 
204
        elif state == avahi.ENTRY_GROUP_FAILURE:
 
205
            logger.critical(u"Avahi: Error in group state changed %s",
 
206
                            unicode(error))
 
207
            raise AvahiGroupError(u"State changed: %s"
 
208
                                  % unicode(error))
 
209
    def cleanup(self):
 
210
        """Derived from the Avahi example code"""
 
211
        if self.group is not None:
 
212
            self.group.Free()
 
213
            self.group = None
 
214
    def server_state_changed(self, state):
 
215
        """Derived from the Avahi example code"""
 
216
        logger.debug(u"Avahi server state change: %i", state)
 
217
        if state == avahi.SERVER_COLLISION:
 
218
            logger.error(u"Zeroconf server name collision")
 
219
            self.remove()
 
220
        elif state == avahi.SERVER_RUNNING:
 
221
            self.add()
 
222
    def activate(self):
 
223
        """Derived from the Avahi example code"""
 
224
        if self.server is None:
 
225
            self.server = dbus.Interface(
 
226
                self.bus.get_object(avahi.DBUS_NAME,
 
227
                                    avahi.DBUS_PATH_SERVER),
 
228
                avahi.DBUS_INTERFACE_SERVER)
 
229
        self.server.connect_to_signal(u"StateChanged",
 
230
                                 self.server_state_changed)
 
231
        self.server_state_changed(self.server.GetState())
 
232
 
 
233
 
 
234
class Client(object):
180
235
    """A representation of a client host served by this server.
 
236
    
181
237
    Attributes:
182
238
    name:       string; from the config file, used in log messages and
183
239
                        D-Bus identifiers
190
246
    enabled:    bool()
191
247
    last_checked_ok: datetime.datetime(); (UTC) or None
192
248
    timeout:    datetime.timedelta(); How long from last_checked_ok
193
 
                                      until this client is invalid
 
249
                                      until this client is disabled
194
250
    interval:   datetime.timedelta(); How often to start a new checker
195
251
    disable_hook:  If set, called by disable() as disable_hook(self)
196
252
    checker:    subprocess.Popen(); a running checker process used
197
253
                                    to see if the client lives.
198
254
                                    'None' if no process is running.
199
255
    checker_initiator_tag: a gobject event source tag, or None
200
 
    disable_initiator_tag:    - '' -
 
256
    disable_initiator_tag: - '' -
201
257
    checker_callback_tag:  - '' -
202
258
    checker_command: string; External command which is run to check if
203
259
                     client lives.  %() expansions are done at
204
260
                     runtime with vars(self) as dict, so that for
205
261
                     instance %(name)s can be used in the command.
206
 
    use_dbus: bool(); Whether to provide D-Bus interface and signals
207
 
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
 
262
    current_checker_command: string; current running checker_command
 
263
    approved_delay: datetime.timedelta(); Time to wait for approval
 
264
    _approved:   bool(); 'None' if not yet approved/disapproved
 
265
    approved_duration: datetime.timedelta(); Duration of one approval
208
266
    """
 
267
    
 
268
    @staticmethod
 
269
    def _timedelta_to_milliseconds(td):
 
270
        "Convert a datetime.timedelta() to milliseconds"
 
271
        return ((td.days * 24 * 60 * 60 * 1000)
 
272
                + (td.seconds * 1000)
 
273
                + (td.microseconds // 1000))
 
274
    
209
275
    def timeout_milliseconds(self):
210
276
        "Return the 'timeout' attribute in milliseconds"
211
 
        return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
 
                + (self.timeout.seconds * 1000)
213
 
                + (self.timeout.microseconds // 1000))
 
277
        return self._timedelta_to_milliseconds(self.timeout)
214
278
    
215
279
    def interval_milliseconds(self):
216
280
        "Return the 'interval' attribute in milliseconds"
217
 
        return ((self.interval.days * 24 * 60 * 60 * 1000)
218
 
                + (self.interval.seconds * 1000)
219
 
                + (self.interval.microseconds // 1000))
 
281
        return self._timedelta_to_milliseconds(self.interval)
 
282
 
 
283
    def approved_delay_milliseconds(self):
 
284
        return self._timedelta_to_milliseconds(self.approved_delay)
220
285
    
221
 
    def __init__(self, name = None, disable_hook=None, config=None,
222
 
                 use_dbus=True):
 
286
    def __init__(self, name = None, disable_hook=None, config=None):
223
287
        """Note: the 'checker' key in 'config' sets the
224
288
        'checker_command' attribute and *not* the 'checker'
225
289
        attribute."""
227
291
        if config is None:
228
292
            config = {}
229
293
        logger.debug(u"Creating client %r", self.name)
230
 
        self.use_dbus = False   # During __init__
231
294
        # Uppercase and remove spaces from fingerprint for later
232
295
        # comparison purposes with return value from the fingerprint()
233
296
        # function
234
 
        self.fingerprint = (config["fingerprint"].upper()
 
297
        self.fingerprint = (config[u"fingerprint"].upper()
235
298
                            .replace(u" ", u""))
236
299
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
237
 
        if "secret" in config:
238
 
            self.secret = config["secret"].decode(u"base64")
239
 
        elif "secfile" in config:
240
 
            with closing(open(os.path.expanduser
241
 
                              (os.path.expandvars
242
 
                               (config["secfile"])))) as secfile:
 
300
        if u"secret" in config:
 
301
            self.secret = config[u"secret"].decode(u"base64")
 
302
        elif u"secfile" in config:
 
303
            with open(os.path.expanduser(os.path.expandvars
 
304
                                         (config[u"secfile"])),
 
305
                      "rb") as secfile:
243
306
                self.secret = secfile.read()
244
307
        else:
245
308
            raise TypeError(u"No secret or secfile for client %s"
246
309
                            % self.name)
247
 
        self.host = config.get("host", "")
 
310
        self.host = config.get(u"host", u"")
248
311
        self.created = datetime.datetime.utcnow()
249
312
        self.enabled = False
250
313
        self.last_enabled = None
251
314
        self.last_checked_ok = None
252
 
        self.timeout = string_to_delta(config["timeout"])
253
 
        self.interval = string_to_delta(config["interval"])
 
315
        self.timeout = string_to_delta(config[u"timeout"])
 
316
        self.interval = string_to_delta(config[u"interval"])
254
317
        self.disable_hook = disable_hook
255
318
        self.checker = None
256
319
        self.checker_initiator_tag = None
257
320
        self.disable_initiator_tag = None
258
321
        self.checker_callback_tag = None
259
 
        self.checker_command = config["checker"]
 
322
        self.checker_command = config[u"checker"]
 
323
        self.current_checker_command = None
260
324
        self.last_connect = None
261
 
        # Only now, when this client is initialized, can it show up on
262
 
        # the D-Bus
263
 
        self.use_dbus = use_dbus
264
 
        if self.use_dbus:
265
 
            self.dbus_object_path = (dbus.ObjectPath
266
 
                                     ("/clients/"
267
 
                                      + self.name.replace(".", "_")))
268
 
            dbus.service.Object.__init__(self, bus,
269
 
                                         self.dbus_object_path)
 
325
        self._approved = None
 
326
        self.approved_by_default = config.get(u"approved_by_default",
 
327
                                              True)
 
328
        self.approvals_pending = 0
 
329
        self.approved_delay = string_to_delta(
 
330
            config[u"approved_delay"])
 
331
        self.approved_duration = string_to_delta(
 
332
            config[u"approved_duration"])
 
333
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
270
334
    
 
335
    def send_changedstate(self):
 
336
        self.changedstate.acquire()
 
337
        self.changedstate.notify_all()
 
338
        self.changedstate.release()
 
339
        
271
340
    def enable(self):
272
341
        """Start this client's checker and timeout hooks"""
 
342
        if getattr(self, u"enabled", False):
 
343
            # Already enabled
 
344
            return
 
345
        self.send_changedstate()
273
346
        self.last_enabled = datetime.datetime.utcnow()
274
347
        # Schedule a new checker to be started an 'interval' from now,
275
348
        # and every interval from then on.
276
349
        self.checker_initiator_tag = (gobject.timeout_add
277
350
                                      (self.interval_milliseconds(),
278
351
                                       self.start_checker))
279
 
        # Also start a new checker *right now*.
280
 
        self.start_checker()
281
352
        # Schedule a disable() when 'timeout' has passed
282
353
        self.disable_initiator_tag = (gobject.timeout_add
283
354
                                   (self.timeout_milliseconds(),
284
355
                                    self.disable))
285
356
        self.enabled = True
286
 
        if self.use_dbus:
287
 
            # Emit D-Bus signals
288
 
            self.PropertyChanged(dbus.String(u"enabled"),
289
 
                                 dbus.Boolean(True, variant_level=1))
290
 
            self.PropertyChanged(dbus.String(u"last_enabled"),
291
 
                                 (_datetime_to_dbus(self.last_enabled,
292
 
                                                    variant_level=1)))
 
357
        # Also start a new checker *right now*.
 
358
        self.start_checker()
293
359
    
294
 
    def disable(self):
 
360
    def disable(self, quiet=True):
295
361
        """Disable this client."""
296
362
        if not getattr(self, "enabled", False):
297
363
            return False
298
 
        logger.info(u"Disabling client %s", self.name)
299
 
        if getattr(self, "disable_initiator_tag", False):
 
364
        if not quiet:
 
365
            self.send_changedstate()
 
366
        if not quiet:
 
367
            logger.info(u"Disabling client %s", self.name)
 
368
        if getattr(self, u"disable_initiator_tag", False):
300
369
            gobject.source_remove(self.disable_initiator_tag)
301
370
            self.disable_initiator_tag = None
302
 
        if getattr(self, "checker_initiator_tag", False):
 
371
        if getattr(self, u"checker_initiator_tag", False):
303
372
            gobject.source_remove(self.checker_initiator_tag)
304
373
            self.checker_initiator_tag = None
305
374
        self.stop_checker()
306
375
        if self.disable_hook:
307
376
            self.disable_hook(self)
308
377
        self.enabled = False
309
 
        if self.use_dbus:
310
 
            # Emit D-Bus signal
311
 
            self.PropertyChanged(dbus.String(u"enabled"),
312
 
                                 dbus.Boolean(False, variant_level=1))
313
378
        # Do not run this again if called by a gobject.timeout_add
314
379
        return False
315
380
    
321
386
        """The checker has completed, so take appropriate actions."""
322
387
        self.checker_callback_tag = None
323
388
        self.checker = None
324
 
        if self.use_dbus:
325
 
            # Emit D-Bus signal
326
 
            self.PropertyChanged(dbus.String(u"checker_running"),
327
 
                                 dbus.Boolean(False, variant_level=1))
328
389
        if os.WIFEXITED(condition):
329
390
            exitstatus = os.WEXITSTATUS(condition)
330
391
            if exitstatus == 0:
334
395
            else:
335
396
                logger.info(u"Checker for %(name)s failed",
336
397
                            vars(self))
337
 
            if self.use_dbus:
338
 
                # Emit D-Bus signal
339
 
                self.CheckerCompleted(dbus.Int16(exitstatus),
340
 
                                      dbus.Int64(condition),
341
 
                                      dbus.String(command))
342
398
        else:
343
399
            logger.warning(u"Checker for %(name)s crashed?",
344
400
                           vars(self))
345
 
            if self.use_dbus:
346
 
                # Emit D-Bus signal
347
 
                self.CheckerCompleted(dbus.Int16(-1),
348
 
                                      dbus.Int64(condition),
349
 
                                      dbus.String(command))
350
401
    
351
402
    def checked_ok(self):
352
403
        """Bump up the timeout for this client.
 
404
        
353
405
        This should only be called when the client has been seen,
354
406
        alive and well.
355
407
        """
358
410
        self.disable_initiator_tag = (gobject.timeout_add
359
411
                                      (self.timeout_milliseconds(),
360
412
                                       self.disable))
361
 
        if self.use_dbus:
362
 
            # Emit D-Bus signal
363
 
            self.PropertyChanged(
364
 
                dbus.String(u"last_checked_ok"),
365
 
                (_datetime_to_dbus(self.last_checked_ok,
366
 
                                   variant_level=1)))
367
413
    
368
414
    def start_checker(self):
369
415
        """Start a new checker subprocess if one is not running.
 
416
        
370
417
        If a checker already exists, leave it running and do
371
418
        nothing."""
372
419
        # The reason for not killing a running checker is that if we
375
422
        # client would inevitably timeout, since no checker would get
376
423
        # a chance to run to completion.  If we instead leave running
377
424
        # checkers alone, the checker would have to take more time
378
 
        # than 'timeout' for the client to be declared invalid, which
379
 
        # is as it should be.
 
425
        # than 'timeout' for the client to be disabled, which is as it
 
426
        # should be.
 
427
        
 
428
        # If a checker exists, make sure it is not a zombie
 
429
        try:
 
430
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
431
        except (AttributeError, OSError), error:
 
432
            if (isinstance(error, OSError)
 
433
                and error.errno != errno.ECHILD):
 
434
                raise error
 
435
        else:
 
436
            if pid:
 
437
                logger.warning(u"Checker was a zombie")
 
438
                gobject.source_remove(self.checker_callback_tag)
 
439
                self.checker_callback(pid, status,
 
440
                                      self.current_checker_command)
 
441
        # Start a new checker if needed
380
442
        if self.checker is None:
381
443
            try:
382
444
                # In case checker_command has exactly one % operator
383
445
                command = self.checker_command % self.host
384
446
            except TypeError:
385
447
                # Escape attributes for the shell
386
 
                escaped_attrs = dict((key, re.escape(str(val)))
 
448
                escaped_attrs = dict((key,
 
449
                                      re.escape(unicode(str(val),
 
450
                                                        errors=
 
451
                                                        u'replace')))
387
452
                                     for key, val in
388
453
                                     vars(self).iteritems())
389
454
                try:
392
457
                    logger.error(u'Could not format string "%s":'
393
458
                                 u' %s', self.checker_command, error)
394
459
                    return True # Try again later
 
460
            self.current_checker_command = command
395
461
            try:
396
462
                logger.info(u"Starting checker %r for %s",
397
463
                            command, self.name)
401
467
                # always replaced by /dev/null.)
402
468
                self.checker = subprocess.Popen(command,
403
469
                                                close_fds=True,
404
 
                                                shell=True, cwd="/")
405
 
                if self.use_dbus:
406
 
                    # Emit D-Bus signal
407
 
                    self.CheckerStarted(command)
408
 
                    self.PropertyChanged(
409
 
                        dbus.String("checker_running"),
410
 
                        dbus.Boolean(True, variant_level=1))
 
470
                                                shell=True, cwd=u"/")
411
471
                self.checker_callback_tag = (gobject.child_watch_add
412
472
                                             (self.checker.pid,
413
473
                                              self.checker_callback,
429
489
        if self.checker_callback_tag:
430
490
            gobject.source_remove(self.checker_callback_tag)
431
491
            self.checker_callback_tag = None
432
 
        if getattr(self, "checker", None) is None:
 
492
        if getattr(self, u"checker", None) is None:
433
493
            return
434
494
        logger.debug(u"Stopping checker for %(name)s", vars(self))
435
495
        try:
436
496
            os.kill(self.checker.pid, signal.SIGTERM)
437
 
            #os.sleep(0.5)
 
497
            #time.sleep(0.5)
438
498
            #if self.checker.poll() is None:
439
499
            #    os.kill(self.checker.pid, signal.SIGKILL)
440
500
        except OSError, error:
441
501
            if error.errno != errno.ESRCH: # No such process
442
502
                raise
443
503
        self.checker = None
444
 
        if self.use_dbus:
 
504
 
 
505
def dbus_service_property(dbus_interface, signature=u"v",
 
506
                          access=u"readwrite", byte_arrays=False):
 
507
    """Decorators for marking methods of a DBusObjectWithProperties to
 
508
    become properties on the D-Bus.
 
509
    
 
510
    The decorated method will be called with no arguments by "Get"
 
511
    and with one argument by "Set".
 
512
    
 
513
    The parameters, where they are supported, are the same as
 
514
    dbus.service.method, except there is only "signature", since the
 
515
    type from Get() and the type sent to Set() is the same.
 
516
    """
 
517
    # Encoding deeply encoded byte arrays is not supported yet by the
 
518
    # "Set" method, so we fail early here:
 
519
    if byte_arrays and signature != u"ay":
 
520
        raise ValueError(u"Byte arrays not supported for non-'ay'"
 
521
                         u" signature %r" % signature)
 
522
    def decorator(func):
 
523
        func._dbus_is_property = True
 
524
        func._dbus_interface = dbus_interface
 
525
        func._dbus_signature = signature
 
526
        func._dbus_access = access
 
527
        func._dbus_name = func.__name__
 
528
        if func._dbus_name.endswith(u"_dbus_property"):
 
529
            func._dbus_name = func._dbus_name[:-14]
 
530
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
 
531
        return func
 
532
    return decorator
 
533
 
 
534
 
 
535
class DBusPropertyException(dbus.exceptions.DBusException):
 
536
    """A base class for D-Bus property-related exceptions
 
537
    """
 
538
    def __unicode__(self):
 
539
        return unicode(str(self))
 
540
 
 
541
 
 
542
class DBusPropertyAccessException(DBusPropertyException):
 
543
    """A property's access permissions disallows an operation.
 
544
    """
 
545
    pass
 
546
 
 
547
 
 
548
class DBusPropertyNotFound(DBusPropertyException):
 
549
    """An attempt was made to access a non-existing property.
 
550
    """
 
551
    pass
 
552
 
 
553
 
 
554
class DBusObjectWithProperties(dbus.service.Object):
 
555
    """A D-Bus object with properties.
 
556
 
 
557
    Classes inheriting from this can use the dbus_service_property
 
558
    decorator to expose methods as D-Bus properties.  It exposes the
 
559
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
560
    """
 
561
    
 
562
    @staticmethod
 
563
    def _is_dbus_property(obj):
 
564
        return getattr(obj, u"_dbus_is_property", False)
 
565
    
 
566
    def _get_all_dbus_properties(self):
 
567
        """Returns a generator of (name, attribute) pairs
 
568
        """
 
569
        return ((prop._dbus_name, prop)
 
570
                for name, prop in
 
571
                inspect.getmembers(self, self._is_dbus_property))
 
572
    
 
573
    def _get_dbus_property(self, interface_name, property_name):
 
574
        """Returns a bound method if one exists which is a D-Bus
 
575
        property with the specified name and interface.
 
576
        """
 
577
        for name in (property_name,
 
578
                     property_name + u"_dbus_property"):
 
579
            prop = getattr(self, name, None)
 
580
            if (prop is None
 
581
                or not self._is_dbus_property(prop)
 
582
                or prop._dbus_name != property_name
 
583
                or (interface_name and prop._dbus_interface
 
584
                    and interface_name != prop._dbus_interface)):
 
585
                continue
 
586
            return prop
 
587
        # No such property
 
588
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
 
589
                                   + interface_name + u"."
 
590
                                   + property_name)
 
591
    
 
592
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
 
593
                         out_signature=u"v")
 
594
    def Get(self, interface_name, property_name):
 
595
        """Standard D-Bus property Get() method, see D-Bus standard.
 
596
        """
 
597
        prop = self._get_dbus_property(interface_name, property_name)
 
598
        if prop._dbus_access == u"write":
 
599
            raise DBusPropertyAccessException(property_name)
 
600
        value = prop()
 
601
        if not hasattr(value, u"variant_level"):
 
602
            return value
 
603
        return type(value)(value, variant_level=value.variant_level+1)
 
604
    
 
605
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
 
606
    def Set(self, interface_name, property_name, value):
 
607
        """Standard D-Bus property Set() method, see D-Bus standard.
 
608
        """
 
609
        prop = self._get_dbus_property(interface_name, property_name)
 
610
        if prop._dbus_access == u"read":
 
611
            raise DBusPropertyAccessException(property_name)
 
612
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
613
            # The byte_arrays option is not supported yet on
 
614
            # signatures other than "ay".
 
615
            if prop._dbus_signature != u"ay":
 
616
                raise ValueError
 
617
            value = dbus.ByteArray(''.join(unichr(byte)
 
618
                                           for byte in value))
 
619
        prop(value)
 
620
    
 
621
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
 
622
                         out_signature=u"a{sv}")
 
623
    def GetAll(self, interface_name):
 
624
        """Standard D-Bus property GetAll() method, see D-Bus
 
625
        standard.
 
626
 
 
627
        Note: Will not include properties with access="write".
 
628
        """
 
629
        all = {}
 
630
        for name, prop in self._get_all_dbus_properties():
 
631
            if (interface_name
 
632
                and interface_name != prop._dbus_interface):
 
633
                # Interface non-empty but did not match
 
634
                continue
 
635
            # Ignore write-only properties
 
636
            if prop._dbus_access == u"write":
 
637
                continue
 
638
            value = prop()
 
639
            if not hasattr(value, u"variant_level"):
 
640
                all[name] = value
 
641
                continue
 
642
            all[name] = type(value)(value, variant_level=
 
643
                                    value.variant_level+1)
 
644
        return dbus.Dictionary(all, signature=u"sv")
 
645
    
 
646
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
647
                         out_signature=u"s",
 
648
                         path_keyword='object_path',
 
649
                         connection_keyword='connection')
 
650
    def Introspect(self, object_path, connection):
 
651
        """Standard D-Bus method, overloaded to insert property tags.
 
652
        """
 
653
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
654
                                                   connection)
 
655
        try:
 
656
            document = xml.dom.minidom.parseString(xmlstring)
 
657
            def make_tag(document, name, prop):
 
658
                e = document.createElement(u"property")
 
659
                e.setAttribute(u"name", name)
 
660
                e.setAttribute(u"type", prop._dbus_signature)
 
661
                e.setAttribute(u"access", prop._dbus_access)
 
662
                return e
 
663
            for if_tag in document.getElementsByTagName(u"interface"):
 
664
                for tag in (make_tag(document, name, prop)
 
665
                            for name, prop
 
666
                            in self._get_all_dbus_properties()
 
667
                            if prop._dbus_interface
 
668
                            == if_tag.getAttribute(u"name")):
 
669
                    if_tag.appendChild(tag)
 
670
                # Add the names to the return values for the
 
671
                # "org.freedesktop.DBus.Properties" methods
 
672
                if (if_tag.getAttribute(u"name")
 
673
                    == u"org.freedesktop.DBus.Properties"):
 
674
                    for cn in if_tag.getElementsByTagName(u"method"):
 
675
                        if cn.getAttribute(u"name") == u"Get":
 
676
                            for arg in cn.getElementsByTagName(u"arg"):
 
677
                                if (arg.getAttribute(u"direction")
 
678
                                    == u"out"):
 
679
                                    arg.setAttribute(u"name", u"value")
 
680
                        elif cn.getAttribute(u"name") == u"GetAll":
 
681
                            for arg in cn.getElementsByTagName(u"arg"):
 
682
                                if (arg.getAttribute(u"direction")
 
683
                                    == u"out"):
 
684
                                    arg.setAttribute(u"name", u"props")
 
685
            xmlstring = document.toxml(u"utf-8")
 
686
            document.unlink()
 
687
        except (AttributeError, xml.dom.DOMException,
 
688
                xml.parsers.expat.ExpatError), error:
 
689
            logger.error(u"Failed to override Introspection method",
 
690
                         error)
 
691
        return xmlstring
 
692
 
 
693
 
 
694
class ClientDBus(Client, DBusObjectWithProperties):
 
695
    """A Client class using D-Bus
 
696
    
 
697
    Attributes:
 
698
    dbus_object_path: dbus.ObjectPath
 
699
    bus: dbus.SystemBus()
 
700
    """
 
701
    # dbus.service.Object doesn't use super(), so we can't either.
 
702
    
 
703
    def __init__(self, bus = None, *args, **kwargs):
 
704
        self._approvals_pending = 0
 
705
        self.bus = bus
 
706
        Client.__init__(self, *args, **kwargs)
 
707
        # Only now, when this client is initialized, can it show up on
 
708
        # the D-Bus
 
709
        self.dbus_object_path = (dbus.ObjectPath
 
710
                                 (u"/clients/"
 
711
                                  + self.name.replace(u".", u"_")))
 
712
        DBusObjectWithProperties.__init__(self, self.bus,
 
713
                                          self.dbus_object_path)
 
714
 
 
715
    def _get_approvals_pending(self):
 
716
        return self._approvals_pending
 
717
    def _set_approvals_pending(self, value):
 
718
        old_value = self._approvals_pending
 
719
        self._approvals_pending = value
 
720
        bval = bool(value)
 
721
        if (hasattr(self, "dbus_object_path")
 
722
            and bval is not bool(old_value)):
 
723
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
724
            self.PropertyChanged(dbus.String(u"approved_pending"),
 
725
                                 dbus_bool)
 
726
 
 
727
    approvals_pending = property(_get_approvals_pending,
 
728
                                 _set_approvals_pending)
 
729
    del _get_approvals_pending, _set_approvals_pending
 
730
    
 
731
    @staticmethod
 
732
    def _datetime_to_dbus(dt, variant_level=0):
 
733
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
734
        return dbus.String(dt.isoformat(),
 
735
                           variant_level=variant_level)
 
736
    
 
737
    def enable(self):
 
738
        oldstate = getattr(self, u"enabled", False)
 
739
        r = Client.enable(self)
 
740
        if oldstate != self.enabled:
 
741
            # Emit D-Bus signals
 
742
            self.PropertyChanged(dbus.String(u"enabled"),
 
743
                                 dbus.Boolean(True, variant_level=1))
 
744
            self.PropertyChanged(
 
745
                dbus.String(u"last_enabled"),
 
746
                self._datetime_to_dbus(self.last_enabled,
 
747
                                       variant_level=1))
 
748
        return r
 
749
    
 
750
    def disable(self, quiet = False):
 
751
        oldstate = getattr(self, u"enabled", False)
 
752
        r = Client.disable(self, quiet=quiet)
 
753
        if not quiet and oldstate != self.enabled:
 
754
            # Emit D-Bus signal
 
755
            self.PropertyChanged(dbus.String(u"enabled"),
 
756
                                 dbus.Boolean(False, variant_level=1))
 
757
        return r
 
758
    
 
759
    def __del__(self, *args, **kwargs):
 
760
        try:
 
761
            self.remove_from_connection()
 
762
        except LookupError:
 
763
            pass
 
764
        if hasattr(DBusObjectWithProperties, u"__del__"):
 
765
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
 
766
        Client.__del__(self, *args, **kwargs)
 
767
    
 
768
    def checker_callback(self, pid, condition, command,
 
769
                         *args, **kwargs):
 
770
        self.checker_callback_tag = None
 
771
        self.checker = None
 
772
        # Emit D-Bus signal
 
773
        self.PropertyChanged(dbus.String(u"checker_running"),
 
774
                             dbus.Boolean(False, variant_level=1))
 
775
        if os.WIFEXITED(condition):
 
776
            exitstatus = os.WEXITSTATUS(condition)
 
777
            # Emit D-Bus signal
 
778
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
779
                                  dbus.Int64(condition),
 
780
                                  dbus.String(command))
 
781
        else:
 
782
            # Emit D-Bus signal
 
783
            self.CheckerCompleted(dbus.Int16(-1),
 
784
                                  dbus.Int64(condition),
 
785
                                  dbus.String(command))
 
786
        
 
787
        return Client.checker_callback(self, pid, condition, command,
 
788
                                       *args, **kwargs)
 
789
    
 
790
    def checked_ok(self, *args, **kwargs):
 
791
        r = Client.checked_ok(self, *args, **kwargs)
 
792
        # Emit D-Bus signal
 
793
        self.PropertyChanged(
 
794
            dbus.String(u"last_checked_ok"),
 
795
            (self._datetime_to_dbus(self.last_checked_ok,
 
796
                                    variant_level=1)))
 
797
        return r
 
798
    
 
799
    def start_checker(self, *args, **kwargs):
 
800
        old_checker = self.checker
 
801
        if self.checker is not None:
 
802
            old_checker_pid = self.checker.pid
 
803
        else:
 
804
            old_checker_pid = None
 
805
        r = Client.start_checker(self, *args, **kwargs)
 
806
        # Only if new checker process was started
 
807
        if (self.checker is not None
 
808
            and old_checker_pid != self.checker.pid):
 
809
            # Emit D-Bus signal
 
810
            self.CheckerStarted(self.current_checker_command)
 
811
            self.PropertyChanged(
 
812
                dbus.String(u"checker_running"),
 
813
                dbus.Boolean(True, variant_level=1))
 
814
        return r
 
815
    
 
816
    def stop_checker(self, *args, **kwargs):
 
817
        old_checker = getattr(self, u"checker", None)
 
818
        r = Client.stop_checker(self, *args, **kwargs)
 
819
        if (old_checker is not None
 
820
            and getattr(self, u"checker", None) is None):
445
821
            self.PropertyChanged(dbus.String(u"checker_running"),
446
822
                                 dbus.Boolean(False, variant_level=1))
447
 
    
448
 
    def still_valid(self):
449
 
        """Has the timeout not yet passed for this client?"""
450
 
        if not getattr(self, "enabled", False):
451
 
            return False
452
 
        now = datetime.datetime.utcnow()
453
 
        if self.last_checked_ok is None:
454
 
            return now < (self.created + self.timeout)
455
 
        else:
456
 
            return now < (self.last_checked_ok + self.timeout)
457
 
    
458
 
    ## D-Bus methods & signals
 
823
        return r
 
824
 
 
825
    def _reset_approved(self):
 
826
        self._approved = None
 
827
        return False
 
828
    
 
829
    def approve(self, value=True):
 
830
        self.send_changedstate()
 
831
        self._approved = value
 
832
        gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
 
833
                            self._reset_approved)
 
834
    
 
835
    
 
836
    ## D-Bus methods, signals & properties
459
837
    _interface = u"se.bsnet.fukt.Mandos.Client"
460
838
    
461
 
    # CheckedOK - method
462
 
    CheckedOK = dbus.service.method(_interface)(checked_ok)
463
 
    CheckedOK.__name__ = "CheckedOK"
 
839
    ## Signals
464
840
    
465
841
    # CheckerCompleted - signal
466
 
    @dbus.service.signal(_interface, signature="nxs")
 
842
    @dbus.service.signal(_interface, signature=u"nxs")
467
843
    def CheckerCompleted(self, exitcode, waitstatus, command):
468
844
        "D-Bus signal"
469
845
        pass
470
846
    
471
847
    # CheckerStarted - signal
472
 
    @dbus.service.signal(_interface, signature="s")
 
848
    @dbus.service.signal(_interface, signature=u"s")
473
849
    def CheckerStarted(self, command):
474
850
        "D-Bus signal"
475
851
        pass
476
852
    
477
 
    # GetAllProperties - method
478
 
    @dbus.service.method(_interface, out_signature="a{sv}")
479
 
    def GetAllProperties(self):
480
 
        "D-Bus method"
481
 
        return dbus.Dictionary({
482
 
                dbus.String("name"):
483
 
                    dbus.String(self.name, variant_level=1),
484
 
                dbus.String("fingerprint"):
485
 
                    dbus.String(self.fingerprint, variant_level=1),
486
 
                dbus.String("host"):
487
 
                    dbus.String(self.host, variant_level=1),
488
 
                dbus.String("created"):
489
 
                    _datetime_to_dbus(self.created, variant_level=1),
490
 
                dbus.String("last_enabled"):
491
 
                    (_datetime_to_dbus(self.last_enabled,
492
 
                                       variant_level=1)
493
 
                     if self.last_enabled is not None
494
 
                     else dbus.Boolean(False, variant_level=1)),
495
 
                dbus.String("enabled"):
496
 
                    dbus.Boolean(self.enabled, variant_level=1),
497
 
                dbus.String("last_checked_ok"):
498
 
                    (_datetime_to_dbus(self.last_checked_ok,
499
 
                                       variant_level=1)
500
 
                     if self.last_checked_ok is not None
501
 
                     else dbus.Boolean (False, variant_level=1)),
502
 
                dbus.String("timeout"):
503
 
                    dbus.UInt64(self.timeout_milliseconds(),
504
 
                                variant_level=1),
505
 
                dbus.String("interval"):
506
 
                    dbus.UInt64(self.interval_milliseconds(),
507
 
                                variant_level=1),
508
 
                dbus.String("checker"):
509
 
                    dbus.String(self.checker_command,
510
 
                                variant_level=1),
511
 
                dbus.String("checker_running"):
512
 
                    dbus.Boolean(self.checker is not None,
513
 
                                 variant_level=1),
514
 
                dbus.String("object_path"):
515
 
                    dbus.ObjectPath(self.dbus_object_path,
516
 
                                    variant_level=1)
517
 
                }, signature="sv")
518
 
    
519
 
    # IsStillValid - method
520
 
    IsStillValid = (dbus.service.method(_interface, out_signature="b")
521
 
                    (still_valid))
522
 
    IsStillValid.__name__ = "IsStillValid"
523
 
    
524
853
    # PropertyChanged - signal
525
 
    @dbus.service.signal(_interface, signature="sv")
 
854
    @dbus.service.signal(_interface, signature=u"sv")
526
855
    def PropertyChanged(self, property, value):
527
856
        "D-Bus signal"
528
857
        pass
529
858
    
530
 
    # SetChecker - method
531
 
    @dbus.service.method(_interface, in_signature="s")
532
 
    def SetChecker(self, checker):
533
 
        "D-Bus setter method"
534
 
        self.checker_command = checker
535
 
        # Emit D-Bus signal
536
 
        self.PropertyChanged(dbus.String(u"checker"),
537
 
                             dbus.String(self.checker_command,
538
 
                                         variant_level=1))
539
 
    
540
 
    # SetHost - method
541
 
    @dbus.service.method(_interface, in_signature="s")
542
 
    def SetHost(self, host):
543
 
        "D-Bus setter method"
544
 
        self.host = host
545
 
        # Emit D-Bus signal
546
 
        self.PropertyChanged(dbus.String(u"host"),
547
 
                             dbus.String(self.host, variant_level=1))
548
 
    
549
 
    # SetInterval - method
550
 
    @dbus.service.method(_interface, in_signature="t")
551
 
    def SetInterval(self, milliseconds):
552
 
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
553
 
        # Emit D-Bus signal
554
 
        self.PropertyChanged(dbus.String(u"interval"),
555
 
                             (dbus.UInt64(self.interval_milliseconds(),
556
 
                                          variant_level=1)))
557
 
    
558
 
    # SetSecret - method
559
 
    @dbus.service.method(_interface, in_signature="ay",
560
 
                         byte_arrays=True)
561
 
    def SetSecret(self, secret):
562
 
        "D-Bus setter method"
563
 
        self.secret = str(secret)
564
 
    
565
 
    # SetTimeout - method
566
 
    @dbus.service.method(_interface, in_signature="t")
567
 
    def SetTimeout(self, milliseconds):
568
 
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
569
 
        # Emit D-Bus signal
570
 
        self.PropertyChanged(dbus.String(u"timeout"),
571
 
                             (dbus.UInt64(self.timeout_milliseconds(),
572
 
                                          variant_level=1)))
 
859
    # GotSecret - signal
 
860
    @dbus.service.signal(_interface)
 
861
    def GotSecret(self):
 
862
        """D-Bus signal
 
863
        Is sent after a successful transfer of secret from the Mandos
 
864
        server to mandos-client
 
865
        """
 
866
        pass
 
867
    
 
868
    # Rejected - signal
 
869
    @dbus.service.signal(_interface, signature=u"s")
 
870
    def Rejected(self, reason):
 
871
        "D-Bus signal"
 
872
        pass
 
873
    
 
874
    # NeedApproval - signal
 
875
    @dbus.service.signal(_interface, signature=u"db")
 
876
    def NeedApproval(self, timeout, default):
 
877
        "D-Bus signal"
 
878
        pass
 
879
    
 
880
    ## Methods
 
881
 
 
882
    # Approve - method
 
883
    @dbus.service.method(_interface, in_signature=u"b")
 
884
    def Approve(self, value):
 
885
        self.approve(value)
 
886
 
 
887
    # CheckedOK - method
 
888
    @dbus.service.method(_interface)
 
889
    def CheckedOK(self):
 
890
        return self.checked_ok()
573
891
    
574
892
    # Enable - method
575
 
    Enable = dbus.service.method(_interface)(enable)
576
 
    Enable.__name__ = "Enable"
 
893
    @dbus.service.method(_interface)
 
894
    def Enable(self):
 
895
        "D-Bus method"
 
896
        self.enable()
577
897
    
578
898
    # StartChecker - method
579
899
    @dbus.service.method(_interface)
588
908
        self.disable()
589
909
    
590
910
    # StopChecker - method
591
 
    StopChecker = dbus.service.method(_interface)(stop_checker)
592
 
    StopChecker.__name__ = "StopChecker"
 
911
    @dbus.service.method(_interface)
 
912
    def StopChecker(self):
 
913
        self.stop_checker()
 
914
    
 
915
    ## Properties
 
916
    
 
917
    # approved_pending - property
 
918
    @dbus_service_property(_interface, signature=u"b", access=u"read")
 
919
    def approved_pending_dbus_property(self):
 
920
        return dbus.Boolean(bool(self.approvals_pending))
 
921
    
 
922
    # approved_by_default - property
 
923
    @dbus_service_property(_interface, signature=u"b",
 
924
                           access=u"readwrite")
 
925
    def approved_by_default_dbus_property(self):
 
926
        return dbus.Boolean(self.approved_by_default)
 
927
    
 
928
    # approved_delay - property
 
929
    @dbus_service_property(_interface, signature=u"t",
 
930
                           access=u"readwrite")
 
931
    def approved_delay_dbus_property(self):
 
932
        return dbus.UInt64(self.approved_delay_milliseconds())
 
933
    
 
934
    # approved_duration - property
 
935
    @dbus_service_property(_interface, signature=u"t",
 
936
                           access=u"readwrite")
 
937
    def approved_duration_dbus_property(self):
 
938
        return dbus.UInt64(self._timedelta_to_milliseconds(
 
939
                self.approved_duration))
 
940
    
 
941
    # name - property
 
942
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
943
    def name_dbus_property(self):
 
944
        return dbus.String(self.name)
 
945
    
 
946
    # fingerprint - property
 
947
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
948
    def fingerprint_dbus_property(self):
 
949
        return dbus.String(self.fingerprint)
 
950
    
 
951
    # host - property
 
952
    @dbus_service_property(_interface, signature=u"s",
 
953
                           access=u"readwrite")
 
954
    def host_dbus_property(self, value=None):
 
955
        if value is None:       # get
 
956
            return dbus.String(self.host)
 
957
        self.host = value
 
958
        # Emit D-Bus signal
 
959
        self.PropertyChanged(dbus.String(u"host"),
 
960
                             dbus.String(value, variant_level=1))
 
961
    
 
962
    # created - property
 
963
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
964
    def created_dbus_property(self):
 
965
        return dbus.String(self._datetime_to_dbus(self.created))
 
966
    
 
967
    # last_enabled - property
 
968
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
969
    def last_enabled_dbus_property(self):
 
970
        if self.last_enabled is None:
 
971
            return dbus.String(u"")
 
972
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
973
    
 
974
    # enabled - property
 
975
    @dbus_service_property(_interface, signature=u"b",
 
976
                           access=u"readwrite")
 
977
    def enabled_dbus_property(self, value=None):
 
978
        if value is None:       # get
 
979
            return dbus.Boolean(self.enabled)
 
980
        if value:
 
981
            self.enable()
 
982
        else:
 
983
            self.disable()
 
984
    
 
985
    # last_checked_ok - property
 
986
    @dbus_service_property(_interface, signature=u"s",
 
987
                           access=u"readwrite")
 
988
    def last_checked_ok_dbus_property(self, value=None):
 
989
        if value is not None:
 
990
            self.checked_ok()
 
991
            return
 
992
        if self.last_checked_ok is None:
 
993
            return dbus.String(u"")
 
994
        return dbus.String(self._datetime_to_dbus(self
 
995
                                                  .last_checked_ok))
 
996
    
 
997
    # timeout - property
 
998
    @dbus_service_property(_interface, signature=u"t",
 
999
                           access=u"readwrite")
 
1000
    def timeout_dbus_property(self, value=None):
 
1001
        if value is None:       # get
 
1002
            return dbus.UInt64(self.timeout_milliseconds())
 
1003
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1004
        # Emit D-Bus signal
 
1005
        self.PropertyChanged(dbus.String(u"timeout"),
 
1006
                             dbus.UInt64(value, variant_level=1))
 
1007
        if getattr(self, u"disable_initiator_tag", None) is None:
 
1008
            return
 
1009
        # Reschedule timeout
 
1010
        gobject.source_remove(self.disable_initiator_tag)
 
1011
        self.disable_initiator_tag = None
 
1012
        time_to_die = (self.
 
1013
                       _timedelta_to_milliseconds((self
 
1014
                                                   .last_checked_ok
 
1015
                                                   + self.timeout)
 
1016
                                                  - datetime.datetime
 
1017
                                                  .utcnow()))
 
1018
        if time_to_die <= 0:
 
1019
            # The timeout has passed
 
1020
            self.disable()
 
1021
        else:
 
1022
            self.disable_initiator_tag = (gobject.timeout_add
 
1023
                                          (time_to_die, self.disable))
 
1024
    
 
1025
    # interval - property
 
1026
    @dbus_service_property(_interface, signature=u"t",
 
1027
                           access=u"readwrite")
 
1028
    def interval_dbus_property(self, value=None):
 
1029
        if value is None:       # get
 
1030
            return dbus.UInt64(self.interval_milliseconds())
 
1031
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1032
        # Emit D-Bus signal
 
1033
        self.PropertyChanged(dbus.String(u"interval"),
 
1034
                             dbus.UInt64(value, variant_level=1))
 
1035
        if getattr(self, u"checker_initiator_tag", None) is None:
 
1036
            return
 
1037
        # Reschedule checker run
 
1038
        gobject.source_remove(self.checker_initiator_tag)
 
1039
        self.checker_initiator_tag = (gobject.timeout_add
 
1040
                                      (value, self.start_checker))
 
1041
        self.start_checker()    # Start one now, too
 
1042
 
 
1043
    # checker - property
 
1044
    @dbus_service_property(_interface, signature=u"s",
 
1045
                           access=u"readwrite")
 
1046
    def checker_dbus_property(self, value=None):
 
1047
        if value is None:       # get
 
1048
            return dbus.String(self.checker_command)
 
1049
        self.checker_command = value
 
1050
        # Emit D-Bus signal
 
1051
        self.PropertyChanged(dbus.String(u"checker"),
 
1052
                             dbus.String(self.checker_command,
 
1053
                                         variant_level=1))
 
1054
    
 
1055
    # checker_running - property
 
1056
    @dbus_service_property(_interface, signature=u"b",
 
1057
                           access=u"readwrite")
 
1058
    def checker_running_dbus_property(self, value=None):
 
1059
        if value is None:       # get
 
1060
            return dbus.Boolean(self.checker is not None)
 
1061
        if value:
 
1062
            self.start_checker()
 
1063
        else:
 
1064
            self.stop_checker()
 
1065
    
 
1066
    # object_path - property
 
1067
    @dbus_service_property(_interface, signature=u"o", access=u"read")
 
1068
    def object_path_dbus_property(self):
 
1069
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1070
    
 
1071
    # secret = property
 
1072
    @dbus_service_property(_interface, signature=u"ay",
 
1073
                           access=u"write", byte_arrays=True)
 
1074
    def secret_dbus_property(self, value):
 
1075
        self.secret = str(value)
593
1076
    
594
1077
    del _interface
595
1078
 
596
1079
 
597
 
def peer_certificate(session):
598
 
    "Return the peer's OpenPGP certificate as a bytestring"
599
 
    # If not an OpenPGP certificate...
600
 
    if (gnutls.library.functions
601
 
        .gnutls_certificate_type_get(session._c_object)
602
 
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
603
 
        # ...do the normal thing
604
 
        return session.peer_certificate
605
 
    list_size = ctypes.c_uint(1)
606
 
    cert_list = (gnutls.library.functions
607
 
                 .gnutls_certificate_get_peers
608
 
                 (session._c_object, ctypes.byref(list_size)))
609
 
    if not bool(cert_list) and list_size.value != 0:
610
 
        raise gnutls.errors.GNUTLSError("error getting peer"
611
 
                                        " certificate")
612
 
    if list_size.value == 0:
613
 
        return None
614
 
    cert = cert_list[0]
615
 
    return ctypes.string_at(cert.data, cert.size)
616
 
 
617
 
 
618
 
def fingerprint(openpgp):
619
 
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
620
 
    # New GnuTLS "datum" with the OpenPGP public key
621
 
    datum = (gnutls.library.types
622
 
             .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
623
 
                                         ctypes.POINTER
624
 
                                         (ctypes.c_ubyte)),
625
 
                             ctypes.c_uint(len(openpgp))))
626
 
    # New empty GnuTLS certificate
627
 
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
628
 
    (gnutls.library.functions
629
 
     .gnutls_openpgp_crt_init(ctypes.byref(crt)))
630
 
    # Import the OpenPGP public key into the certificate
631
 
    (gnutls.library.functions
632
 
     .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
633
 
                                gnutls.library.constants
634
 
                                .GNUTLS_OPENPGP_FMT_RAW))
635
 
    # Verify the self signature in the key
636
 
    crtverify = ctypes.c_uint()
637
 
    (gnutls.library.functions
638
 
     .gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
639
 
    if crtverify.value != 0:
640
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
641
 
        raise gnutls.errors.CertificateSecurityError("Verify failed")
642
 
    # New buffer for the fingerprint
643
 
    buf = ctypes.create_string_buffer(20)
644
 
    buf_len = ctypes.c_size_t()
645
 
    # Get the fingerprint from the certificate into the buffer
646
 
    (gnutls.library.functions
647
 
     .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
648
 
                                         ctypes.byref(buf_len)))
649
 
    # Deinit the certificate
650
 
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
651
 
    # Convert the buffer to a Python bytestring
652
 
    fpr = ctypes.string_at(buf, buf_len.value)
653
 
    # Convert the bytestring to hexadecimal notation
654
 
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
655
 
    return hex_fpr
656
 
 
657
 
 
658
 
class TCP_handler(SocketServer.BaseRequestHandler, object):
659
 
    """A TCP request handler class.
660
 
    Instantiated by IPv6_TCPServer for each request to handle it.
 
1080
class ProxyClient(object):
 
1081
    def __init__(self, child_pipe, fpr, address):
 
1082
        self._pipe = child_pipe
 
1083
        self._pipe.send(('init', fpr, address))
 
1084
        if not self._pipe.recv():
 
1085
            raise KeyError()
 
1086
 
 
1087
    def __getattribute__(self, name):
 
1088
        if(name == '_pipe'):
 
1089
            return super(ProxyClient, self).__getattribute__(name)
 
1090
        self._pipe.send(('getattr', name))
 
1091
        data = self._pipe.recv()
 
1092
        if data[0] == 'data':
 
1093
            return data[1]
 
1094
        if data[0] == 'function':
 
1095
            def func(*args, **kwargs):
 
1096
                self._pipe.send(('funcall', name, args, kwargs))
 
1097
                return self._pipe.recv()[1]
 
1098
            return func
 
1099
 
 
1100
    def __setattr__(self, name, value):
 
1101
        if(name == '_pipe'):
 
1102
            return super(ProxyClient, self).__setattr__(name, value)
 
1103
        self._pipe.send(('setattr', name, value))
 
1104
 
 
1105
 
 
1106
class ClientHandler(socketserver.BaseRequestHandler, object):
 
1107
    """A class to handle client connections.
 
1108
    
 
1109
    Instantiated once for each connection to handle it.
661
1110
    Note: This will run in its own forked process."""
662
1111
    
663
1112
    def handle(self):
664
 
        logger.info(u"TCP connection from: %s",
665
 
                    unicode(self.client_address))
666
 
        session = (gnutls.connection
667
 
                   .ClientSession(self.request,
668
 
                                  gnutls.connection
669
 
                                  .X509Credentials()))
670
 
        
671
 
        line = self.request.makefile().readline()
672
 
        logger.debug(u"Protocol version: %r", line)
673
 
        try:
674
 
            if int(line.strip().split()[0]) > 1:
675
 
                raise RuntimeError
676
 
        except (ValueError, IndexError, RuntimeError), error:
677
 
            logger.error(u"Unknown protocol version: %s", error)
678
 
            return
679
 
        
680
 
        # Note: gnutls.connection.X509Credentials is really a generic
681
 
        # GnuTLS certificate credentials object so long as no X.509
682
 
        # keys are added to it.  Therefore, we can use it here despite
683
 
        # using OpenPGP certificates.
684
 
        
685
 
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
686
 
        #                     "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
687
 
        #                     "+DHE-DSS"))
688
 
        # Use a fallback default, since this MUST be set.
689
 
        priority = self.server.settings.get("priority", "NORMAL")
690
 
        (gnutls.library.functions
691
 
         .gnutls_priority_set_direct(session._c_object,
692
 
                                     priority, None))
693
 
        
694
 
        try:
695
 
            session.handshake()
696
 
        except gnutls.errors.GNUTLSError, error:
697
 
            logger.warning(u"Handshake failed: %s", error)
698
 
            # Do not run session.bye() here: the session is not
699
 
            # established.  Just abandon the request.
700
 
            return
701
 
        logger.debug(u"Handshake succeeded")
702
 
        try:
703
 
            fpr = fingerprint(peer_certificate(session))
704
 
        except (TypeError, gnutls.errors.GNUTLSError), error:
705
 
            logger.warning(u"Bad certificate: %s", error)
706
 
            session.bye()
707
 
            return
708
 
        logger.debug(u"Fingerprint: %s", fpr)
709
 
        
710
 
        for c in self.server.clients:
711
 
            if c.fingerprint == fpr:
712
 
                client = c
713
 
                break
714
 
        else:
715
 
            logger.warning(u"Client not found for fingerprint: %s",
716
 
                           fpr)
717
 
            session.bye()
718
 
            return
719
 
        # Have to check if client.still_valid(), since it is possible
720
 
        # that the client timed out while establishing the GnuTLS
721
 
        # session.
722
 
        if not client.still_valid():
723
 
            logger.warning(u"Client %(name)s is invalid",
724
 
                           vars(client))
725
 
            session.bye()
726
 
            return
727
 
        ## This won't work here, since we're in a fork.
728
 
        # client.checked_ok()
729
 
        sent_size = 0
730
 
        while sent_size < len(client.secret):
731
 
            sent = session.send(client.secret[sent_size:])
732
 
            logger.debug(u"Sent: %d, remaining: %d",
733
 
                         sent, len(client.secret)
734
 
                         - (sent_size + sent))
735
 
            sent_size += sent
736
 
        session.bye()
737
 
 
738
 
 
739
 
class IPv6_TCPServer(SocketServer.ForkingMixIn,
740
 
                     SocketServer.TCPServer, object):
741
 
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
 
1113
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1114
            logger.info(u"TCP connection from: %s",
 
1115
                        unicode(self.client_address))
 
1116
            logger.debug(u"Pipe FD: %d",
 
1117
                         self.server.child_pipe.fileno())
 
1118
 
 
1119
            session = (gnutls.connection
 
1120
                       .ClientSession(self.request,
 
1121
                                      gnutls.connection
 
1122
                                      .X509Credentials()))
 
1123
 
 
1124
            # Note: gnutls.connection.X509Credentials is really a
 
1125
            # generic GnuTLS certificate credentials object so long as
 
1126
            # no X.509 keys are added to it.  Therefore, we can use it
 
1127
            # here despite using OpenPGP certificates.
 
1128
 
 
1129
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
 
1130
            #                      u"+AES-256-CBC", u"+SHA1",
 
1131
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
 
1132
            #                      u"+DHE-DSS"))
 
1133
            # Use a fallback default, since this MUST be set.
 
1134
            priority = self.server.gnutls_priority
 
1135
            if priority is None:
 
1136
                priority = u"NORMAL"
 
1137
            (gnutls.library.functions
 
1138
             .gnutls_priority_set_direct(session._c_object,
 
1139
                                         priority, None))
 
1140
 
 
1141
            # Start communication using the Mandos protocol
 
1142
            # Get protocol number
 
1143
            line = self.request.makefile().readline()
 
1144
            logger.debug(u"Protocol version: %r", line)
 
1145
            try:
 
1146
                if int(line.strip().split()[0]) > 1:
 
1147
                    raise RuntimeError
 
1148
            except (ValueError, IndexError, RuntimeError), error:
 
1149
                logger.error(u"Unknown protocol version: %s", error)
 
1150
                return
 
1151
 
 
1152
            # Start GnuTLS connection
 
1153
            try:
 
1154
                session.handshake()
 
1155
            except gnutls.errors.GNUTLSError, error:
 
1156
                logger.warning(u"Handshake failed: %s", error)
 
1157
                # Do not run session.bye() here: the session is not
 
1158
                # established.  Just abandon the request.
 
1159
                return
 
1160
            logger.debug(u"Handshake succeeded")
 
1161
 
 
1162
            approval_required = False
 
1163
            try:
 
1164
                try:
 
1165
                    fpr = self.fingerprint(self.peer_certificate
 
1166
                                           (session))
 
1167
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1168
                    logger.warning(u"Bad certificate: %s", error)
 
1169
                    return
 
1170
                logger.debug(u"Fingerprint: %s", fpr)
 
1171
 
 
1172
                try:
 
1173
                    client = ProxyClient(child_pipe, fpr,
 
1174
                                         self.client_address)
 
1175
                except KeyError:
 
1176
                    return
 
1177
                
 
1178
                if client.approved_delay:
 
1179
                    delay = client.approved_delay
 
1180
                    client.approvals_pending += 1
 
1181
                    approval_required = True
 
1182
                
 
1183
                while True:
 
1184
                    if not client.enabled:
 
1185
                        logger.warning(u"Client %s is disabled",
 
1186
                                       client.name)
 
1187
                        if self.server.use_dbus:
 
1188
                            # Emit D-Bus signal
 
1189
                            client.Rejected("Disabled")                    
 
1190
                        return
 
1191
                    
 
1192
                    if client._approved or not client.approved_delay:
 
1193
                        #We are approved or approval is disabled
 
1194
                        break
 
1195
                    elif client._approved is None:
 
1196
                        logger.info(u"Client %s need approval",
 
1197
                                    client.name)
 
1198
                        if self.server.use_dbus:
 
1199
                            # Emit D-Bus signal
 
1200
                            client.NeedApproval(
 
1201
                                client.approved_delay_milliseconds(),
 
1202
                                client.approved_by_default)
 
1203
                    else:
 
1204
                        logger.warning(u"Client %s was not approved",
 
1205
                                       client.name)
 
1206
                        if self.server.use_dbus:
 
1207
                            # Emit D-Bus signal
 
1208
                            client.Rejected("Disapproved")
 
1209
                        return
 
1210
                    
 
1211
                    #wait until timeout or approved
 
1212
                    #x = float(client._timedelta_to_milliseconds(delay))
 
1213
                    time = datetime.datetime.now()
 
1214
                    client.changedstate.acquire()
 
1215
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1216
                    client.changedstate.release()
 
1217
                    time2 = datetime.datetime.now()
 
1218
                    if (time2 - time) >= delay:
 
1219
                        if not client.approved_by_default:
 
1220
                            logger.warning("Client %s timed out while"
 
1221
                                           " waiting for approval",
 
1222
                                           client.name)
 
1223
                            if self.server.use_dbus:
 
1224
                                # Emit D-Bus signal
 
1225
                                client.Rejected("Time out")
 
1226
                            return
 
1227
                        else:
 
1228
                            break
 
1229
                    else:
 
1230
                        delay -= time2 - time
 
1231
                
 
1232
                sent_size = 0
 
1233
                while sent_size < len(client.secret):
 
1234
                    try:
 
1235
                        sent = session.send(client.secret[sent_size:])
 
1236
                    except (gnutls.errors.GNUTLSError), error:
 
1237
                        logger.warning("gnutls send failed")
 
1238
                        return
 
1239
                    logger.debug(u"Sent: %d, remaining: %d",
 
1240
                                 sent, len(client.secret)
 
1241
                                 - (sent_size + sent))
 
1242
                    sent_size += sent
 
1243
 
 
1244
                logger.info(u"Sending secret to %s", client.name)
 
1245
                # bump the timeout as if seen
 
1246
                client.checked_ok()
 
1247
                if self.server.use_dbus:
 
1248
                    # Emit D-Bus signal
 
1249
                    client.GotSecret()
 
1250
            
 
1251
            finally:
 
1252
                if approval_required:
 
1253
                    client.approvals_pending -= 1
 
1254
                try:
 
1255
                    session.bye()
 
1256
                except (gnutls.errors.GNUTLSError), error:
 
1257
                    logger.warning("gnutls bye failed")
 
1258
    
 
1259
    @staticmethod
 
1260
    def peer_certificate(session):
 
1261
        "Return the peer's OpenPGP certificate as a bytestring"
 
1262
        # If not an OpenPGP certificate...
 
1263
        if (gnutls.library.functions
 
1264
            .gnutls_certificate_type_get(session._c_object)
 
1265
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1266
            # ...do the normal thing
 
1267
            return session.peer_certificate
 
1268
        list_size = ctypes.c_uint(1)
 
1269
        cert_list = (gnutls.library.functions
 
1270
                     .gnutls_certificate_get_peers
 
1271
                     (session._c_object, ctypes.byref(list_size)))
 
1272
        if not bool(cert_list) and list_size.value != 0:
 
1273
            raise gnutls.errors.GNUTLSError(u"error getting peer"
 
1274
                                            u" certificate")
 
1275
        if list_size.value == 0:
 
1276
            return None
 
1277
        cert = cert_list[0]
 
1278
        return ctypes.string_at(cert.data, cert.size)
 
1279
    
 
1280
    @staticmethod
 
1281
    def fingerprint(openpgp):
 
1282
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
 
1283
        # New GnuTLS "datum" with the OpenPGP public key
 
1284
        datum = (gnutls.library.types
 
1285
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1286
                                             ctypes.POINTER
 
1287
                                             (ctypes.c_ubyte)),
 
1288
                                 ctypes.c_uint(len(openpgp))))
 
1289
        # New empty GnuTLS certificate
 
1290
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1291
        (gnutls.library.functions
 
1292
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1293
        # Import the OpenPGP public key into the certificate
 
1294
        (gnutls.library.functions
 
1295
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1296
                                    gnutls.library.constants
 
1297
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1298
        # Verify the self signature in the key
 
1299
        crtverify = ctypes.c_uint()
 
1300
        (gnutls.library.functions
 
1301
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1302
                                         ctypes.byref(crtverify)))
 
1303
        if crtverify.value != 0:
 
1304
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1305
            raise (gnutls.errors.CertificateSecurityError
 
1306
                   (u"Verify failed"))
 
1307
        # New buffer for the fingerprint
 
1308
        buf = ctypes.create_string_buffer(20)
 
1309
        buf_len = ctypes.c_size_t()
 
1310
        # Get the fingerprint from the certificate into the buffer
 
1311
        (gnutls.library.functions
 
1312
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1313
                                             ctypes.byref(buf_len)))
 
1314
        # Deinit the certificate
 
1315
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1316
        # Convert the buffer to a Python bytestring
 
1317
        fpr = ctypes.string_at(buf, buf_len.value)
 
1318
        # Convert the bytestring to hexadecimal notation
 
1319
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1320
        return hex_fpr
 
1321
 
 
1322
 
 
1323
class MultiprocessingMixIn(object):
 
1324
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1325
    def sub_process_main(self, request, address):
 
1326
        try:
 
1327
            self.finish_request(request, address)
 
1328
        except:
 
1329
            self.handle_error(request, address)
 
1330
        self.close_request(request)
 
1331
            
 
1332
    def process_request(self, request, address):
 
1333
        """Start a new process to process the request."""
 
1334
        multiprocessing.Process(target = self.sub_process_main,
 
1335
                                args = (request, address)).start()
 
1336
 
 
1337
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1338
    """ adds a pipe to the MixIn """
 
1339
    def process_request(self, request, client_address):
 
1340
        """Overrides and wraps the original process_request().
 
1341
        
 
1342
        This function creates a new pipe in self.pipe
 
1343
        """
 
1344
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1345
 
 
1346
        super(MultiprocessingMixInWithPipe,
 
1347
              self).process_request(request, client_address)
 
1348
        self.child_pipe.close()
 
1349
        self.add_pipe(parent_pipe)
 
1350
 
 
1351
    def add_pipe(self, parent_pipe):
 
1352
        """Dummy function; override as necessary"""
 
1353
        pass
 
1354
 
 
1355
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
 
1356
                     socketserver.TCPServer, object):
 
1357
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
1358
    
742
1359
    Attributes:
743
 
        settings:       Server settings
744
 
        clients:        Set() of Client objects
745
1360
        enabled:        Boolean; whether this server is activated yet
 
1361
        interface:      None or a network interface name (string)
 
1362
        use_ipv6:       Boolean; to use IPv6 or not
746
1363
    """
747
 
    address_family = socket.AF_INET6
748
 
    def __init__(self, *args, **kwargs):
749
 
        if "settings" in kwargs:
750
 
            self.settings = kwargs["settings"]
751
 
            del kwargs["settings"]
752
 
        if "clients" in kwargs:
753
 
            self.clients = kwargs["clients"]
754
 
            del kwargs["clients"]
755
 
        self.enabled = False
756
 
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
 
1364
    def __init__(self, server_address, RequestHandlerClass,
 
1365
                 interface=None, use_ipv6=True):
 
1366
        self.interface = interface
 
1367
        if use_ipv6:
 
1368
            self.address_family = socket.AF_INET6
 
1369
        socketserver.TCPServer.__init__(self, server_address,
 
1370
                                        RequestHandlerClass)
757
1371
    def server_bind(self):
758
1372
        """This overrides the normal server_bind() function
759
1373
        to bind to an interface if one was specified, and also NOT to
760
1374
        bind to an address or port if they were not specified."""
761
 
        if self.settings["interface"]:
762
 
            # 25 is from /usr/include/asm-i486/socket.h
763
 
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
764
 
            try:
765
 
                self.socket.setsockopt(socket.SOL_SOCKET,
766
 
                                       SO_BINDTODEVICE,
767
 
                                       self.settings["interface"])
768
 
            except socket.error, error:
769
 
                if error[0] == errno.EPERM:
770
 
                    logger.error(u"No permission to"
771
 
                                 u" bind to interface %s",
772
 
                                 self.settings["interface"])
773
 
                else:
774
 
                    raise
 
1375
        if self.interface is not None:
 
1376
            if SO_BINDTODEVICE is None:
 
1377
                logger.error(u"SO_BINDTODEVICE does not exist;"
 
1378
                             u" cannot bind to interface %s",
 
1379
                             self.interface)
 
1380
            else:
 
1381
                try:
 
1382
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1383
                                           SO_BINDTODEVICE,
 
1384
                                           str(self.interface
 
1385
                                               + u'\0'))
 
1386
                except socket.error, error:
 
1387
                    if error[0] == errno.EPERM:
 
1388
                        logger.error(u"No permission to"
 
1389
                                     u" bind to interface %s",
 
1390
                                     self.interface)
 
1391
                    elif error[0] == errno.ENOPROTOOPT:
 
1392
                        logger.error(u"SO_BINDTODEVICE not available;"
 
1393
                                     u" cannot bind to interface %s",
 
1394
                                     self.interface)
 
1395
                    else:
 
1396
                        raise
775
1397
        # Only bind(2) the socket if we really need to.
776
1398
        if self.server_address[0] or self.server_address[1]:
777
1399
            if not self.server_address[0]:
778
 
                in6addr_any = "::"
779
 
                self.server_address = (in6addr_any,
 
1400
                if self.address_family == socket.AF_INET6:
 
1401
                    any_address = u"::" # in6addr_any
 
1402
                else:
 
1403
                    any_address = socket.INADDR_ANY
 
1404
                self.server_address = (any_address,
780
1405
                                       self.server_address[1])
781
1406
            elif not self.server_address[1]:
782
1407
                self.server_address = (self.server_address[0],
783
1408
                                       0)
784
 
#                 if self.settings["interface"]:
 
1409
#                 if self.interface:
785
1410
#                     self.server_address = (self.server_address[0],
786
1411
#                                            0, # port
787
1412
#                                            0, # flowinfo
788
1413
#                                            if_nametoindex
789
 
#                                            (self.settings
790
 
#                                             ["interface"]))
791
 
            return super(IPv6_TCPServer, self).server_bind()
 
1414
#                                            (self.interface))
 
1415
            return socketserver.TCPServer.server_bind(self)
 
1416
 
 
1417
 
 
1418
class MandosServer(IPv6_TCPServer):
 
1419
    """Mandos server.
 
1420
    
 
1421
    Attributes:
 
1422
        clients:        set of Client objects
 
1423
        gnutls_priority GnuTLS priority string
 
1424
        use_dbus:       Boolean; to emit D-Bus signals or not
 
1425
    
 
1426
    Assumes a gobject.MainLoop event loop.
 
1427
    """
 
1428
    def __init__(self, server_address, RequestHandlerClass,
 
1429
                 interface=None, use_ipv6=True, clients=None,
 
1430
                 gnutls_priority=None, use_dbus=True):
 
1431
        self.enabled = False
 
1432
        self.clients = clients
 
1433
        if self.clients is None:
 
1434
            self.clients = set()
 
1435
        self.use_dbus = use_dbus
 
1436
        self.gnutls_priority = gnutls_priority
 
1437
        IPv6_TCPServer.__init__(self, server_address,
 
1438
                                RequestHandlerClass,
 
1439
                                interface = interface,
 
1440
                                use_ipv6 = use_ipv6)
792
1441
    def server_activate(self):
793
1442
        if self.enabled:
794
 
            return super(IPv6_TCPServer, self).server_activate()
 
1443
            return socketserver.TCPServer.server_activate(self)
795
1444
    def enable(self):
796
1445
        self.enabled = True
 
1446
    def add_pipe(self, parent_pipe):
 
1447
        # Call "handle_ipc" for both data and EOF events
 
1448
        gobject.io_add_watch(parent_pipe.fileno(),
 
1449
                             gobject.IO_IN | gobject.IO_HUP,
 
1450
                             functools.partial(self.handle_ipc,
 
1451
                                               parent_pipe = parent_pipe))
 
1452
        
 
1453
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1454
                   client_object=None):
 
1455
        condition_names = {
 
1456
            gobject.IO_IN: u"IN",   # There is data to read.
 
1457
            gobject.IO_OUT: u"OUT", # Data can be written (without
 
1458
                                    # blocking).
 
1459
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
 
1460
            gobject.IO_ERR: u"ERR", # Error condition.
 
1461
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
 
1462
                                    # broken, usually for pipes and
 
1463
                                    # sockets).
 
1464
            }
 
1465
        conditions_string = ' | '.join(name
 
1466
                                       for cond, name in
 
1467
                                       condition_names.iteritems()
 
1468
                                       if cond & condition)
 
1469
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
 
1470
                     conditions_string)
 
1471
 
 
1472
        # error or the other end of multiprocessing.Pipe has closed
 
1473
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1474
            return False
 
1475
        
 
1476
        # Read a request from the child
 
1477
        request = parent_pipe.recv()
 
1478
        logger.debug(u"IPC request: %s", repr(request))
 
1479
        command = request[0]
 
1480
        
 
1481
        if command == 'init':
 
1482
            fpr = request[1]
 
1483
            address = request[2]
 
1484
            
 
1485
            for c in self.clients:
 
1486
                if c.fingerprint == fpr:
 
1487
                    client = c
 
1488
                    break
 
1489
            else:
 
1490
                logger.warning(u"Client not found for fingerprint: %s, ad"
 
1491
                               u"dress: %s", fpr, address)
 
1492
                if self.use_dbus:
 
1493
                    # Emit D-Bus signal
 
1494
                    mandos_dbus_service.ClientNotFound(fpr, address)
 
1495
                parent_pipe.send(False)
 
1496
                return False
 
1497
            
 
1498
            gobject.io_add_watch(parent_pipe.fileno(),
 
1499
                                 gobject.IO_IN | gobject.IO_HUP,
 
1500
                                 functools.partial(self.handle_ipc,
 
1501
                                                   parent_pipe = parent_pipe,
 
1502
                                                   client_object = client))
 
1503
            parent_pipe.send(True)
 
1504
            # remove the old hook in favor of the new above hook on same fileno
 
1505
            return False
 
1506
        if command == 'funcall':
 
1507
            funcname = request[1]
 
1508
            args = request[2]
 
1509
            kwargs = request[3]
 
1510
            
 
1511
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1512
 
 
1513
        if command == 'getattr':
 
1514
            attrname = request[1]
 
1515
            if callable(client_object.__getattribute__(attrname)):
 
1516
                parent_pipe.send(('function',))
 
1517
            else:
 
1518
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
1519
        
 
1520
        if command == 'setattr':
 
1521
            attrname = request[1]
 
1522
            value = request[2]
 
1523
            setattr(client_object, attrname, value)
 
1524
 
 
1525
        return True
797
1526
 
798
1527
 
799
1528
def string_to_delta(interval):
800
1529
    """Parse a string and return a datetime.timedelta
801
1530
    
802
 
    >>> string_to_delta('7d')
 
1531
    >>> string_to_delta(u'7d')
803
1532
    datetime.timedelta(7)
804
 
    >>> string_to_delta('60s')
 
1533
    >>> string_to_delta(u'60s')
805
1534
    datetime.timedelta(0, 60)
806
 
    >>> string_to_delta('60m')
 
1535
    >>> string_to_delta(u'60m')
807
1536
    datetime.timedelta(0, 3600)
808
 
    >>> string_to_delta('24h')
 
1537
    >>> string_to_delta(u'24h')
809
1538
    datetime.timedelta(1)
810
1539
    >>> string_to_delta(u'1w')
811
1540
    datetime.timedelta(7)
812
 
    >>> string_to_delta('5m 30s')
 
1541
    >>> string_to_delta(u'5m 30s')
813
1542
    datetime.timedelta(0, 330)
814
1543
    """
815
1544
    timevalue = datetime.timedelta(0)
828
1557
            elif suffix == u"w":
829
1558
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
830
1559
            else:
831
 
                raise ValueError
832
 
        except (ValueError, IndexError):
833
 
            raise ValueError
 
1560
                raise ValueError(u"Unknown suffix %r" % suffix)
 
1561
        except (ValueError, IndexError), e:
 
1562
            raise ValueError(e.message)
834
1563
        timevalue += delta
835
1564
    return timevalue
836
1565
 
837
1566
 
838
 
def server_state_changed(state):
839
 
    """Derived from the Avahi example code"""
840
 
    if state == avahi.SERVER_COLLISION:
841
 
        logger.error(u"Zeroconf server name collision")
842
 
        service.remove()
843
 
    elif state == avahi.SERVER_RUNNING:
844
 
        service.add()
845
 
 
846
 
 
847
 
def entry_group_state_changed(state, error):
848
 
    """Derived from the Avahi example code"""
849
 
    logger.debug(u"Avahi state change: %i", state)
850
 
    
851
 
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
852
 
        logger.debug(u"Zeroconf service established.")
853
 
    elif state == avahi.ENTRY_GROUP_COLLISION:
854
 
        logger.warning(u"Zeroconf service name collision.")
855
 
        service.rename()
856
 
    elif state == avahi.ENTRY_GROUP_FAILURE:
857
 
        logger.critical(u"Avahi: Error in group state changed %s",
858
 
                        unicode(error))
859
 
        raise AvahiGroupError(u"State changed: %s" % unicode(error))
860
 
 
861
1567
def if_nametoindex(interface):
862
 
    """Call the C function if_nametoindex(), or equivalent"""
 
1568
    """Call the C function if_nametoindex(), or equivalent
 
1569
    
 
1570
    Note: This function cannot accept a unicode string."""
863
1571
    global if_nametoindex
864
1572
    try:
865
1573
        if_nametoindex = (ctypes.cdll.LoadLibrary
866
 
                          (ctypes.util.find_library("c"))
 
1574
                          (ctypes.util.find_library(u"c"))
867
1575
                          .if_nametoindex)
868
1576
    except (OSError, AttributeError):
869
 
        if "struct" not in sys.modules:
870
 
            import struct
871
 
        if "fcntl" not in sys.modules:
872
 
            import fcntl
 
1577
        logger.warning(u"Doing if_nametoindex the hard way")
873
1578
        def if_nametoindex(interface):
874
1579
            "Get an interface index the hard way, i.e. using fcntl()"
875
1580
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
876
 
            with closing(socket.socket()) as s:
 
1581
            with contextlib.closing(socket.socket()) as s:
877
1582
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
878
 
                                    struct.pack("16s16x", interface))
879
 
            interface_index = struct.unpack("I", ifreq[16:20])[0]
 
1583
                                    struct.pack(str(u"16s16x"),
 
1584
                                                interface))
 
1585
            interface_index = struct.unpack(str(u"I"),
 
1586
                                            ifreq[16:20])[0]
880
1587
            return interface_index
881
1588
    return if_nametoindex(interface)
882
1589
 
883
1590
 
884
1591
def daemon(nochdir = False, noclose = False):
885
1592
    """See daemon(3).  Standard BSD Unix function.
 
1593
    
886
1594
    This should really exist as os.daemon, but it doesn't (yet)."""
887
1595
    if os.fork():
888
1596
        sys.exit()
889
1597
    os.setsid()
890
1598
    if not nochdir:
891
 
        os.chdir("/")
 
1599
        os.chdir(u"/")
892
1600
    if os.fork():
893
1601
        sys.exit()
894
1602
    if not noclose:
896
1604
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
897
1605
        if not stat.S_ISCHR(os.fstat(null).st_mode):
898
1606
            raise OSError(errno.ENODEV,
899
 
                          "/dev/null not a character device")
 
1607
                          u"%s not a character device"
 
1608
                          % os.path.devnull)
900
1609
        os.dup2(null, sys.stdin.fileno())
901
1610
        os.dup2(null, sys.stdout.fileno())
902
1611
        os.dup2(null, sys.stderr.fileno())
905
1614
 
906
1615
 
907
1616
def main():
 
1617
    
 
1618
    ##################################################################
 
1619
    # Parsing of options, both command line and config file
 
1620
    
908
1621
    parser = optparse.OptionParser(version = "%%prog %s" % version)
909
 
    parser.add_option("-i", "--interface", type="string",
910
 
                      metavar="IF", help="Bind to interface IF")
911
 
    parser.add_option("-a", "--address", type="string",
912
 
                      help="Address to listen for requests on")
913
 
    parser.add_option("-p", "--port", type="int",
914
 
                      help="Port number to receive requests on")
915
 
    parser.add_option("--check", action="store_true",
916
 
                      help="Run self-test")
917
 
    parser.add_option("--debug", action="store_true",
918
 
                      help="Debug mode; run in foreground and log to"
919
 
                      " terminal")
920
 
    parser.add_option("--priority", type="string", help="GnuTLS"
921
 
                      " priority string (see GnuTLS documentation)")
922
 
    parser.add_option("--servicename", type="string", metavar="NAME",
923
 
                      help="Zeroconf service name")
924
 
    parser.add_option("--configdir", type="string",
925
 
                      default="/etc/mandos", metavar="DIR",
926
 
                      help="Directory to search for configuration"
927
 
                      " files")
928
 
    parser.add_option("--no-dbus", action="store_false",
929
 
                      dest="use_dbus",
930
 
                      help="Do not provide D-Bus system bus"
931
 
                      " interface")
 
1622
    parser.add_option("-i", u"--interface", type=u"string",
 
1623
                      metavar="IF", help=u"Bind to interface IF")
 
1624
    parser.add_option("-a", u"--address", type=u"string",
 
1625
                      help=u"Address to listen for requests on")
 
1626
    parser.add_option("-p", u"--port", type=u"int",
 
1627
                      help=u"Port number to receive requests on")
 
1628
    parser.add_option("--check", action=u"store_true",
 
1629
                      help=u"Run self-test")
 
1630
    parser.add_option("--debug", action=u"store_true",
 
1631
                      help=u"Debug mode; run in foreground and log to"
 
1632
                      u" terminal")
 
1633
    parser.add_option("--debuglevel", type=u"string", metavar="Level",
 
1634
                      help=u"Debug level for stdout output")
 
1635
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
 
1636
                      u" priority string (see GnuTLS documentation)")
 
1637
    parser.add_option("--servicename", type=u"string",
 
1638
                      metavar=u"NAME", help=u"Zeroconf service name")
 
1639
    parser.add_option("--configdir", type=u"string",
 
1640
                      default=u"/etc/mandos", metavar=u"DIR",
 
1641
                      help=u"Directory to search for configuration"
 
1642
                      u" files")
 
1643
    parser.add_option("--no-dbus", action=u"store_false",
 
1644
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
 
1645
                      u" system bus interface")
 
1646
    parser.add_option("--no-ipv6", action=u"store_false",
 
1647
                      dest=u"use_ipv6", help=u"Do not use IPv6")
932
1648
    options = parser.parse_args()[0]
933
1649
    
934
1650
    if options.check:
937
1653
        sys.exit()
938
1654
    
939
1655
    # Default values for config file for server-global settings
940
 
    server_defaults = { "interface": "",
941
 
                        "address": "",
942
 
                        "port": "",
943
 
                        "debug": "False",
944
 
                        "priority":
945
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
946
 
                        "servicename": "Mandos",
947
 
                        "use_dbus": "True",
 
1656
    server_defaults = { u"interface": u"",
 
1657
                        u"address": u"",
 
1658
                        u"port": u"",
 
1659
                        u"debug": u"False",
 
1660
                        u"priority":
 
1661
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1662
                        u"servicename": u"Mandos",
 
1663
                        u"use_dbus": u"True",
 
1664
                        u"use_ipv6": u"True",
 
1665
                        u"debuglevel": u"",
948
1666
                        }
949
1667
    
950
1668
    # Parse config file for server-global settings
951
 
    server_config = ConfigParser.SafeConfigParser(server_defaults)
 
1669
    server_config = configparser.SafeConfigParser(server_defaults)
952
1670
    del server_defaults
953
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
1671
    server_config.read(os.path.join(options.configdir,
 
1672
                                    u"mandos.conf"))
954
1673
    # Convert the SafeConfigParser object to a dict
955
1674
    server_settings = server_config.defaults()
956
1675
    # Use the appropriate methods on the non-string config options
957
 
    server_settings["debug"] = server_config.getboolean("DEFAULT",
958
 
                                                        "debug")
959
 
    server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
960
 
                                                           "use_dbus")
 
1676
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
 
1677
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
1678
                                                           option)
961
1679
    if server_settings["port"]:
962
 
        server_settings["port"] = server_config.getint("DEFAULT",
963
 
                                                       "port")
 
1680
        server_settings["port"] = server_config.getint(u"DEFAULT",
 
1681
                                                       u"port")
964
1682
    del server_config
965
1683
    
966
1684
    # Override the settings from the config file with command line
967
1685
    # options, if set.
968
 
    for option in ("interface", "address", "port", "debug",
969
 
                   "priority", "servicename", "configdir",
970
 
                   "use_dbus"):
 
1686
    for option in (u"interface", u"address", u"port", u"debug",
 
1687
                   u"priority", u"servicename", u"configdir",
 
1688
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
971
1689
        value = getattr(options, option)
972
1690
        if value is not None:
973
1691
            server_settings[option] = value
974
1692
    del options
 
1693
    # Force all strings to be unicode
 
1694
    for option in server_settings.keys():
 
1695
        if type(server_settings[option]) is str:
 
1696
            server_settings[option] = unicode(server_settings[option])
975
1697
    # Now we have our good server settings in "server_settings"
976
1698
    
 
1699
    ##################################################################
 
1700
    
977
1701
    # For convenience
978
 
    debug = server_settings["debug"]
979
 
    use_dbus = server_settings["use_dbus"]
980
 
    
981
 
    if not debug:
982
 
        syslogger.setLevel(logging.WARNING)
983
 
        console.setLevel(logging.WARNING)
984
 
    
985
 
    if server_settings["servicename"] != "Mandos":
 
1702
    debug = server_settings[u"debug"]
 
1703
    debuglevel = server_settings[u"debuglevel"]
 
1704
    use_dbus = server_settings[u"use_dbus"]
 
1705
    use_ipv6 = server_settings[u"use_ipv6"]
 
1706
 
 
1707
    if server_settings[u"servicename"] != u"Mandos":
986
1708
        syslogger.setFormatter(logging.Formatter
987
 
                               ('Mandos (%s): %%(levelname)s:'
988
 
                                ' %%(message)s'
989
 
                                % server_settings["servicename"]))
 
1709
                               (u'Mandos (%s) [%%(process)d]:'
 
1710
                                u' %%(levelname)s: %%(message)s'
 
1711
                                % server_settings[u"servicename"]))
990
1712
    
991
1713
    # Parse config file with clients
992
 
    client_defaults = { "timeout": "1h",
993
 
                        "interval": "5m",
994
 
                        "checker": "fping -q -- %%(host)s",
995
 
                        "host": "",
 
1714
    client_defaults = { u"timeout": u"1h",
 
1715
                        u"interval": u"5m",
 
1716
                        u"checker": u"fping -q -- %%(host)s",
 
1717
                        u"host": u"",
 
1718
                        u"approved_delay": u"0s",
 
1719
                        u"approved_duration": u"1s",
996
1720
                        }
997
 
    client_config = ConfigParser.SafeConfigParser(client_defaults)
998
 
    client_config.read(os.path.join(server_settings["configdir"],
999
 
                                    "clients.conf"))
1000
 
    
1001
 
    clients = Set()
1002
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
1003
 
                                 server_settings["port"]),
1004
 
                                TCP_handler,
1005
 
                                settings=server_settings,
1006
 
                                clients=clients)
1007
 
    pidfilename = "/var/run/mandos.pid"
 
1721
    client_config = configparser.SafeConfigParser(client_defaults)
 
1722
    client_config.read(os.path.join(server_settings[u"configdir"],
 
1723
                                    u"clients.conf"))
 
1724
    
 
1725
    global mandos_dbus_service
 
1726
    mandos_dbus_service = None
 
1727
    
 
1728
    tcp_server = MandosServer((server_settings[u"address"],
 
1729
                               server_settings[u"port"]),
 
1730
                              ClientHandler,
 
1731
                              interface=server_settings[u"interface"],
 
1732
                              use_ipv6=use_ipv6,
 
1733
                              gnutls_priority=
 
1734
                              server_settings[u"priority"],
 
1735
                              use_dbus=use_dbus)
 
1736
    pidfilename = u"/var/run/mandos.pid"
1008
1737
    try:
1009
 
        pidfile = open(pidfilename, "w")
 
1738
        pidfile = open(pidfilename, u"w")
1010
1739
    except IOError:
1011
 
        logger.error("Could not open file %r", pidfilename)
 
1740
        logger.error(u"Could not open file %r", pidfilename)
1012
1741
    
1013
1742
    try:
1014
 
        uid = pwd.getpwnam("_mandos").pw_uid
1015
 
        gid = pwd.getpwnam("_mandos").pw_gid
 
1743
        uid = pwd.getpwnam(u"_mandos").pw_uid
 
1744
        gid = pwd.getpwnam(u"_mandos").pw_gid
1016
1745
    except KeyError:
1017
1746
        try:
1018
 
            uid = pwd.getpwnam("mandos").pw_uid
1019
 
            gid = pwd.getpwnam("mandos").pw_gid
 
1747
            uid = pwd.getpwnam(u"mandos").pw_uid
 
1748
            gid = pwd.getpwnam(u"mandos").pw_gid
1020
1749
        except KeyError:
1021
1750
            try:
1022
 
                uid = pwd.getpwnam("nobody").pw_uid
1023
 
                gid = pwd.getpwnam("nogroup").pw_gid
 
1751
                uid = pwd.getpwnam(u"nobody").pw_uid
 
1752
                gid = pwd.getpwnam(u"nobody").pw_gid
1024
1753
            except KeyError:
1025
1754
                uid = 65534
1026
1755
                gid = 65534
1032
1761
            raise error
1033
1762
    
1034
1763
    # Enable all possible GnuTLS debugging
 
1764
 
 
1765
 
 
1766
    if not debug and not debuglevel:
 
1767
        syslogger.setLevel(logging.WARNING)
 
1768
        console.setLevel(logging.WARNING)
 
1769
    if debuglevel:
 
1770
        level = getattr(logging, debuglevel.upper())
 
1771
        syslogger.setLevel(level)
 
1772
        console.setLevel(level)
 
1773
 
1035
1774
    if debug:
1036
1775
        # "Use a log level over 10 to enable all debugging options."
1037
1776
        # - GnuTLS manual
1039
1778
        
1040
1779
        @gnutls.library.types.gnutls_log_func
1041
1780
        def debug_gnutls(level, string):
1042
 
            logger.debug("GnuTLS: %s", string[:-1])
 
1781
            logger.debug(u"GnuTLS: %s", string[:-1])
1043
1782
        
1044
1783
        (gnutls.library.functions
1045
1784
         .gnutls_global_set_log_function(debug_gnutls))
1046
 
    
1047
 
    global service
1048
 
    service = AvahiService(name = server_settings["servicename"],
1049
 
                           servicetype = "_mandos._tcp", )
1050
 
    if server_settings["interface"]:
1051
 
        service.interface = (if_nametoindex
1052
 
                             (server_settings["interface"]))
 
1785
 
 
1786
        # Redirect stdin so all checkers get /dev/null
 
1787
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1788
        os.dup2(null, sys.stdin.fileno())
 
1789
        if null > 2:
 
1790
            os.close(null)
 
1791
    else:
 
1792
        # No console logging
 
1793
        logger.removeHandler(console)
 
1794
 
1053
1795
    
1054
1796
    global main_loop
1055
 
    global bus
1056
 
    global server
1057
1797
    # From the Avahi example code
1058
1798
    DBusGMainLoop(set_as_default=True )
1059
1799
    main_loop = gobject.MainLoop()
1060
1800
    bus = dbus.SystemBus()
1061
 
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1062
 
                                           avahi.DBUS_PATH_SERVER),
1063
 
                            avahi.DBUS_INTERFACE_SERVER)
1064
1801
    # End of Avahi example code
1065
1802
    if use_dbus:
1066
 
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1067
 
    
1068
 
    clients.update(Set(Client(name = section,
1069
 
                              config
1070
 
                              = dict(client_config.items(section)),
1071
 
                              use_dbus = use_dbus)
1072
 
                       for section in client_config.sections()))
1073
 
    if not clients:
1074
 
        logger.warning(u"No clients defined")
1075
 
    
1076
 
    if debug:
1077
 
        # Redirect stdin so all checkers get /dev/null
1078
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1079
 
        os.dup2(null, sys.stdin.fileno())
1080
 
        if null > 2:
1081
 
            os.close(null)
1082
 
    else:
1083
 
        # No console logging
1084
 
        logger.removeHandler(console)
 
1803
        try:
 
1804
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
1805
                                            bus, do_not_queue=True)
 
1806
        except dbus.exceptions.NameExistsException, e:
 
1807
            logger.error(unicode(e) + u", disabling D-Bus")
 
1808
            use_dbus = False
 
1809
            server_settings[u"use_dbus"] = False
 
1810
            tcp_server.use_dbus = False
 
1811
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
1812
    service = AvahiService(name = server_settings[u"servicename"],
 
1813
                           servicetype = u"_mandos._tcp",
 
1814
                           protocol = protocol, bus = bus)
 
1815
    if server_settings["interface"]:
 
1816
        service.interface = (if_nametoindex
 
1817
                             (str(server_settings[u"interface"])))
 
1818
 
 
1819
    if not debug:
1085
1820
        # Close all input and output, do double fork, etc.
1086
1821
        daemon()
1087
 
    
 
1822
        
 
1823
    global multiprocessing_manager
 
1824
    multiprocessing_manager = multiprocessing.Manager()
 
1825
    
 
1826
    client_class = Client
 
1827
    if use_dbus:
 
1828
        client_class = functools.partial(ClientDBus, bus = bus)
 
1829
    def client_config_items(config, section):
 
1830
        special_settings = {
 
1831
            "approved_by_default":
 
1832
                lambda: config.getboolean(section,
 
1833
                                          "approved_by_default"),
 
1834
            }
 
1835
        for name, value in config.items(section):
 
1836
            try:
 
1837
                yield (name, special_settings[name]())
 
1838
            except KeyError:
 
1839
                yield (name, value)
 
1840
    
 
1841
    tcp_server.clients.update(set(
 
1842
            client_class(name = section,
 
1843
                         config= dict(client_config_items(
 
1844
                        client_config, section)))
 
1845
            for section in client_config.sections()))
 
1846
    if not tcp_server.clients:
 
1847
        logger.warning(u"No clients defined")
 
1848
        
1088
1849
    try:
1089
 
        pid = os.getpid()
1090
 
        pidfile.write(str(pid) + "\n")
1091
 
        pidfile.close()
 
1850
        with pidfile:
 
1851
            pid = os.getpid()
 
1852
            pidfile.write(str(pid) + "\n")
1092
1853
        del pidfile
1093
1854
    except IOError:
1094
1855
        logger.error(u"Could not write to file %r with PID %d",
1098
1859
        pass
1099
1860
    del pidfilename
1100
1861
    
1101
 
    def cleanup():
1102
 
        "Cleanup function; run on exit"
1103
 
        global group
1104
 
        # From the Avahi example code
1105
 
        if not group is None:
1106
 
            group.Free()
1107
 
            group = None
1108
 
        # End of Avahi example code
1109
 
        
1110
 
        while clients:
1111
 
            client = clients.pop()
1112
 
            client.disable_hook = None
1113
 
            client.disable()
1114
 
    
1115
 
    atexit.register(cleanup)
1116
 
    
1117
1862
    if not debug:
1118
1863
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1119
1864
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1120
1865
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1121
1866
    
1122
1867
    if use_dbus:
1123
 
        class MandosServer(dbus.service.Object):
 
1868
        class MandosDBusService(dbus.service.Object):
1124
1869
            """A D-Bus proxy object"""
1125
1870
            def __init__(self):
1126
 
                dbus.service.Object.__init__(self, bus, "/")
 
1871
                dbus.service.Object.__init__(self, bus, u"/")
1127
1872
            _interface = u"se.bsnet.fukt.Mandos"
1128
1873
            
1129
 
            @dbus.service.signal(_interface, signature="oa{sv}")
1130
 
            def ClientAdded(self, objpath, properties):
1131
 
                "D-Bus signal"
1132
 
                pass
1133
 
            
1134
 
            @dbus.service.signal(_interface, signature="os")
 
1874
            @dbus.service.signal(_interface, signature=u"o")
 
1875
            def ClientAdded(self, objpath):
 
1876
                "D-Bus signal"
 
1877
                pass
 
1878
            
 
1879
            @dbus.service.signal(_interface, signature=u"ss")
 
1880
            def ClientNotFound(self, fingerprint, address):
 
1881
                "D-Bus signal"
 
1882
                pass
 
1883
            
 
1884
            @dbus.service.signal(_interface, signature=u"os")
1135
1885
            def ClientRemoved(self, objpath, name):
1136
1886
                "D-Bus signal"
1137
1887
                pass
1138
1888
            
1139
 
            @dbus.service.method(_interface, out_signature="ao")
 
1889
            @dbus.service.method(_interface, out_signature=u"ao")
1140
1890
            def GetAllClients(self):
1141
1891
                "D-Bus method"
1142
 
                return dbus.Array(c.dbus_object_path for c in clients)
 
1892
                return dbus.Array(c.dbus_object_path
 
1893
                                  for c in tcp_server.clients)
1143
1894
            
1144
 
            @dbus.service.method(_interface, out_signature="a{oa{sv}}")
 
1895
            @dbus.service.method(_interface,
 
1896
                                 out_signature=u"a{oa{sv}}")
1145
1897
            def GetAllClientsWithProperties(self):
1146
1898
                "D-Bus method"
1147
1899
                return dbus.Dictionary(
1148
 
                    ((c.dbus_object_path, c.GetAllProperties())
1149
 
                     for c in clients),
1150
 
                    signature="oa{sv}")
 
1900
                    ((c.dbus_object_path, c.GetAll(u""))
 
1901
                     for c in tcp_server.clients),
 
1902
                    signature=u"oa{sv}")
1151
1903
            
1152
 
            @dbus.service.method(_interface, in_signature="o")
 
1904
            @dbus.service.method(_interface, in_signature=u"o")
1153
1905
            def RemoveClient(self, object_path):
1154
1906
                "D-Bus method"
1155
 
                for c in clients:
 
1907
                for c in tcp_server.clients:
1156
1908
                    if c.dbus_object_path == object_path:
1157
 
                        clients.remove(c)
 
1909
                        tcp_server.clients.remove(c)
 
1910
                        c.remove_from_connection()
1158
1911
                        # Don't signal anything except ClientRemoved
1159
 
                        c.use_dbus = False
1160
 
                        c.disable()
 
1912
                        c.disable(quiet=True)
1161
1913
                        # Emit D-Bus signal
1162
1914
                        self.ClientRemoved(object_path, c.name)
1163
1915
                        return
1164
 
                raise KeyError
 
1916
                raise KeyError(object_path)
1165
1917
            
1166
1918
            del _interface
1167
1919
        
1168
 
        mandos_server = MandosServer()
1169
 
    
1170
 
    for client in clients:
 
1920
        mandos_dbus_service = MandosDBusService()
 
1921
    
 
1922
    def cleanup():
 
1923
        "Cleanup function; run on exit"
 
1924
        service.cleanup()
 
1925
        
 
1926
        while tcp_server.clients:
 
1927
            client = tcp_server.clients.pop()
 
1928
            if use_dbus:
 
1929
                client.remove_from_connection()
 
1930
            client.disable_hook = None
 
1931
            # Don't signal anything except ClientRemoved
 
1932
            client.disable(quiet=True)
 
1933
            if use_dbus:
 
1934
                # Emit D-Bus signal
 
1935
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
1936
                                                  client.name)
 
1937
    
 
1938
    atexit.register(cleanup)
 
1939
    
 
1940
    for client in tcp_server.clients:
1171
1941
        if use_dbus:
1172
1942
            # Emit D-Bus signal
1173
 
            mandos_server.ClientAdded(client.dbus_object_path,
1174
 
                                      client.GetAllProperties())
 
1943
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
1175
1944
        client.enable()
1176
1945
    
1177
1946
    tcp_server.enable()
1179
1948
    
1180
1949
    # Find out what port we got
1181
1950
    service.port = tcp_server.socket.getsockname()[1]
1182
 
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1183
 
                u" scope_id %d" % tcp_server.socket.getsockname())
 
1951
    if use_ipv6:
 
1952
        logger.info(u"Now listening on address %r, port %d,"
 
1953
                    " flowinfo %d, scope_id %d"
 
1954
                    % tcp_server.socket.getsockname())
 
1955
    else:                       # IPv4
 
1956
        logger.info(u"Now listening on address %r, port %d"
 
1957
                    % tcp_server.socket.getsockname())
1184
1958
    
1185
1959
    #service.interface = tcp_server.socket.getsockname()[3]
1186
1960
    
1187
1961
    try:
1188
1962
        # From the Avahi example code
1189
 
        server.connect_to_signal("StateChanged", server_state_changed)
1190
1963
        try:
1191
 
            server_state_changed(server.GetState())
 
1964
            service.activate()
1192
1965
        except dbus.exceptions.DBusException, error:
1193
1966
            logger.critical(u"DBusException: %s", error)
 
1967
            cleanup()
1194
1968
            sys.exit(1)
1195
1969
        # End of Avahi example code
1196
1970
        
1203
1977
        main_loop.run()
1204
1978
    except AvahiError, error:
1205
1979
        logger.critical(u"AvahiError: %s", error)
 
1980
        cleanup()
1206
1981
        sys.exit(1)
1207
1982
    except KeyboardInterrupt:
1208
1983
        if debug:
1209
1984
            print >> sys.stderr
1210
 
        logger.debug("Server received KeyboardInterrupt")
1211
 
    logger.debug("Server exiting")
 
1985
        logger.debug(u"Server received KeyboardInterrupt")
 
1986
    logger.debug(u"Server exiting")
 
1987
    # Must run before the D-Bus bus name gets deregistered
 
1988
    cleanup()
1212
1989
 
1213
1990
if __name__ == '__main__':
1214
1991
    main()