/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2011-03-08 19:12:56 UTC
  • mfrom: (237.7.20 trunk)
  • Revision ID: teddy@fukt.bsnet.se-20110308191256-mjcukty9on3z0yhd
Merge from trunk.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
1
#!/usr/bin/python
2
 
 
3
 
from __future__ import division
4
 
 
5
 
import SocketServer
 
2
# -*- mode: python; coding: utf-8 -*-
 
3
# 
 
4
# Mandos server - give out binary blobs to connecting clients.
 
5
# 
 
6
# This program is partly derived from an example program for an Avahi
 
7
# service publisher, downloaded from
 
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
 
9
# methods "add", "remove", "server_state_changed",
 
10
# "entry_group_state_changed", "cleanup", and "activate" in the
 
11
# "AvahiService" class, and some lines in "main".
 
12
# 
 
13
# Everything else is
 
14
# Copyright © 2008-2011 Teddy Hogeborn
 
15
# Copyright © 2008-2011 Björn Påhlsson
 
16
# 
 
17
# This program is free software: you can redistribute it and/or modify
 
18
# it under the terms of the GNU General Public License as published by
 
19
# the Free Software Foundation, either version 3 of the License, or
 
20
# (at your option) any later version.
 
21
#
 
22
#     This program is distributed in the hope that it will be useful,
 
23
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
 
24
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
25
#     GNU General Public License for more details.
 
26
# 
 
27
# You should have received a copy of the GNU General Public License
 
28
# along with this program.  If not, see
 
29
# <http://www.gnu.org/licenses/>.
 
30
# 
 
31
# Contact the authors at <mandos@fukt.bsnet.se>.
 
32
# 
 
33
 
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
 
36
 
 
37
import SocketServer as socketserver
6
38
import socket
7
 
import select
8
 
from optparse import OptionParser
 
39
import optparse
9
40
import datetime
10
41
import errno
11
42
import gnutls.crypto
12
43
import gnutls.connection
13
44
import gnutls.errors
14
 
import ConfigParser
 
45
import gnutls.library.functions
 
46
import gnutls.library.constants
 
47
import gnutls.library.types
 
48
import ConfigParser as configparser
15
49
import sys
16
50
import re
17
51
import os
18
52
import signal
19
 
from sets import Set
20
53
import subprocess
 
54
import atexit
 
55
import stat
 
56
import logging
 
57
import logging.handlers
 
58
import pwd
 
59
import contextlib
 
60
import struct
 
61
import fcntl
 
62
import functools
 
63
import cPickle as pickle
 
64
import multiprocessing
 
65
 
 
66
import dbus
 
67
import dbus.service
 
68
import gobject
 
69
import avahi
 
70
from dbus.mainloop.glib import DBusGMainLoop
 
71
import ctypes
 
72
import ctypes.util
 
73
import xml.dom.minidom
 
74
import inspect
 
75
 
 
76
try:
 
77
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
 
78
except AttributeError:
 
79
    try:
 
80
        from IN import SO_BINDTODEVICE
 
81
    except ImportError:
 
82
        SO_BINDTODEVICE = None
 
83
 
 
84
 
 
85
version = "1.2.3"
 
86
 
 
87
#logger = logging.getLogger('mandos')
 
88
logger = logging.Logger('mandos')
 
89
syslogger = (logging.handlers.SysLogHandler
 
90
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
91
              address = str("/dev/log")))
 
92
syslogger.setFormatter(logging.Formatter
 
93
                       ('Mandos [%(process)d]: %(levelname)s:'
 
94
                        ' %(message)s'))
 
95
logger.addHandler(syslogger)
 
96
 
 
97
console = logging.StreamHandler()
 
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
 
99
                                       ' %(levelname)s:'
 
100
                                       ' %(message)s'))
 
101
logger.addHandler(console)
 
102
 
 
103
class AvahiError(Exception):
 
104
    def __init__(self, value, *args, **kwargs):
 
105
        self.value = value
 
106
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
107
    def __unicode__(self):
 
108
        return unicode(repr(self.value))
 
109
 
 
110
class AvahiServiceError(AvahiError):
 
111
    pass
 
112
 
 
113
class AvahiGroupError(AvahiError):
 
114
    pass
 
115
 
 
116
 
 
117
class AvahiService(object):
 
118
    """An Avahi (Zeroconf) service.
 
119
    
 
120
    Attributes:
 
121
    interface: integer; avahi.IF_UNSPEC or an interface index.
 
122
               Used to optionally bind to the specified interface.
 
123
    name: string; Example: 'Mandos'
 
124
    type: string; Example: '_mandos._tcp'.
 
125
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
126
    port: integer; what port to announce
 
127
    TXT: list of strings; TXT record for the service
 
128
    domain: string; Domain to publish on, default to .local if empty.
 
129
    host: string; Host to publish records for, default is localhost
 
130
    max_renames: integer; maximum number of renames
 
131
    rename_count: integer; counter so we only rename after collisions
 
132
                  a sensible number of times
 
133
    group: D-Bus Entry Group
 
134
    server: D-Bus Server
 
135
    bus: dbus.SystemBus()
 
136
    """
 
137
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
138
                 servicetype = None, port = None, TXT = None,
 
139
                 domain = "", host = "", max_renames = 32768,
 
140
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
141
        self.interface = interface
 
142
        self.name = name
 
143
        self.type = servicetype
 
144
        self.port = port
 
145
        self.TXT = TXT if TXT is not None else []
 
146
        self.domain = domain
 
147
        self.host = host
 
148
        self.rename_count = 0
 
149
        self.max_renames = max_renames
 
150
        self.protocol = protocol
 
151
        self.group = None       # our entry group
 
152
        self.server = None
 
153
        self.bus = bus
 
154
    def rename(self):
 
155
        """Derived from the Avahi example code"""
 
156
        if self.rename_count >= self.max_renames:
 
157
            logger.critical("No suitable Zeroconf service name found"
 
158
                            " after %i retries, exiting.",
 
159
                            self.rename_count)
 
160
            raise AvahiServiceError("Too many renames")
 
161
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
162
        logger.info("Changing Zeroconf service name to %r ...",
 
163
                    self.name)
 
164
        syslogger.setFormatter(logging.Formatter
 
165
                               ('Mandos (%s) [%%(process)d]:'
 
166
                                ' %%(levelname)s: %%(message)s'
 
167
                                % self.name))
 
168
        self.remove()
 
169
        try:
 
170
            self.add()
 
171
        except dbus.exceptions.DBusException, error:
 
172
            logger.critical("DBusException: %s", error)
 
173
            self.cleanup()
 
174
            os._exit(1)
 
175
        self.rename_count += 1
 
176
    def remove(self):
 
177
        """Derived from the Avahi example code"""
 
178
        if self.group is not None:
 
179
            self.group.Reset()
 
180
    def add(self):
 
181
        """Derived from the Avahi example code"""
 
182
        if self.group is None:
 
183
            self.group = dbus.Interface(
 
184
                self.bus.get_object(avahi.DBUS_NAME,
 
185
                                    self.server.EntryGroupNew()),
 
186
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
187
            self.group.connect_to_signal('StateChanged',
 
188
                                         self
 
189
                                         .entry_group_state_changed)
 
190
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
191
                     self.name, self.type)
 
192
        self.group.AddService(
 
193
            self.interface,
 
194
            self.protocol,
 
195
            dbus.UInt32(0),     # flags
 
196
            self.name, self.type,
 
197
            self.domain, self.host,
 
198
            dbus.UInt16(self.port),
 
199
            avahi.string_array_to_txt_array(self.TXT))
 
200
        self.group.Commit()
 
201
    def entry_group_state_changed(self, state, error):
 
202
        """Derived from the Avahi example code"""
 
203
        logger.debug("Avahi entry group state change: %i", state)
 
204
        
 
205
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
206
            logger.debug("Zeroconf service established.")
 
207
        elif state == avahi.ENTRY_GROUP_COLLISION:
 
208
            logger.info("Zeroconf service name collision.")
 
209
            self.rename()
 
210
        elif state == avahi.ENTRY_GROUP_FAILURE:
 
211
            logger.critical("Avahi: Error in group state changed %s",
 
212
                            unicode(error))
 
213
            raise AvahiGroupError("State changed: %s"
 
214
                                  % unicode(error))
 
215
    def cleanup(self):
 
216
        """Derived from the Avahi example code"""
 
217
        if self.group is not None:
 
218
            self.group.Free()
 
219
            self.group = None
 
220
    def server_state_changed(self, state):
 
221
        """Derived from the Avahi example code"""
 
222
        logger.debug("Avahi server state change: %i", state)
 
223
        if state == avahi.SERVER_COLLISION:
 
224
            logger.error("Zeroconf server name collision")
 
225
            self.remove()
 
226
        elif state == avahi.SERVER_RUNNING:
 
227
            self.add()
 
228
    def activate(self):
 
229
        """Derived from the Avahi example code"""
 
230
        if self.server is None:
 
231
            self.server = dbus.Interface(
 
232
                self.bus.get_object(avahi.DBUS_NAME,
 
233
                                    avahi.DBUS_PATH_SERVER),
 
234
                avahi.DBUS_INTERFACE_SERVER)
 
235
        self.server.connect_to_signal("StateChanged",
 
236
                                 self.server_state_changed)
 
237
        self.server_state_changed(self.server.GetState())
 
238
 
21
239
 
22
240
class Client(object):
23
 
    def __init__(self, name=None, options=None, dn=None,
24
 
                 password=None, passfile=None, fqdn=None,
25
 
                 timeout=None, interval=-1):
 
241
    """A representation of a client host served by this server.
 
242
    
 
243
    Attributes:
 
244
    _approved:   bool(); 'None' if not yet approved/disapproved
 
245
    approval_delay: datetime.timedelta(); Time to wait for approval
 
246
    approval_duration: datetime.timedelta(); Duration of one approval
 
247
    checker:    subprocess.Popen(); a running checker process used
 
248
                                    to see if the client lives.
 
249
                                    'None' if no process is running.
 
250
    checker_callback_tag: a gobject event source tag, or None
 
251
    checker_command: string; External command which is run to check
 
252
                     if client lives.  %() expansions are done at
 
253
                     runtime with vars(self) as dict, so that for
 
254
                     instance %(name)s can be used in the command.
 
255
    checker_initiator_tag: a gobject event source tag, or None
 
256
    created:    datetime.datetime(); (UTC) object creation
 
257
    current_checker_command: string; current running checker_command
 
258
    disable_hook:  If set, called by disable() as disable_hook(self)
 
259
    disable_initiator_tag: a gobject event source tag, or None
 
260
    enabled:    bool()
 
261
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
262
                 uniquely identify the client
 
263
    host:       string; available for use by the checker command
 
264
    interval:   datetime.timedelta(); How often to start a new checker
 
265
    last_approval_request: datetime.datetime(); (UTC) or None
 
266
    last_checked_ok: datetime.datetime(); (UTC) or None
 
267
    last_enabled: datetime.datetime(); (UTC)
 
268
    name:       string; from the config file, used in log messages and
 
269
                        D-Bus identifiers
 
270
    secret:     bytestring; sent verbatim (over TLS) to client
 
271
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
272
                                      until this client is disabled
 
273
    runtime_expansions: Allowed attributes for runtime expansion.
 
274
    """
 
275
    
 
276
    runtime_expansions = ("approval_delay", "approval_duration",
 
277
                          "created", "enabled", "fingerprint",
 
278
                          "host", "interval", "last_checked_ok",
 
279
                          "last_enabled", "name", "timeout")
 
280
    
 
281
    @staticmethod
 
282
    def _timedelta_to_milliseconds(td):
 
283
        "Convert a datetime.timedelta() to milliseconds"
 
284
        return ((td.days * 24 * 60 * 60 * 1000)
 
285
                + (td.seconds * 1000)
 
286
                + (td.microseconds // 1000))
 
287
    
 
288
    def timeout_milliseconds(self):
 
289
        "Return the 'timeout' attribute in milliseconds"
 
290
        return self._timedelta_to_milliseconds(self.timeout)
 
291
    
 
292
    def interval_milliseconds(self):
 
293
        "Return the 'interval' attribute in milliseconds"
 
294
        return self._timedelta_to_milliseconds(self.interval)
 
295
 
 
296
    def approval_delay_milliseconds(self):
 
297
        return self._timedelta_to_milliseconds(self.approval_delay)
 
298
    
 
299
    def __init__(self, name = None, disable_hook=None, config=None):
 
300
        """Note: the 'checker' key in 'config' sets the
 
301
        'checker_command' attribute and *not* the 'checker'
 
302
        attribute."""
26
303
        self.name = name
27
 
        self.dn = dn
28
 
        if password:
29
 
            self.password = password
30
 
        elif passfile:
31
 
            self.password = open(passfile).readall()
32
 
        else:
33
 
            print "No Password or Passfile in client config file"
34
 
            # raise RuntimeError XXX
35
 
            self.password = "gazonk"
36
 
        self.fqdn = fqdn                # string
37
 
        self.created = datetime.datetime.now()
38
 
        self.last_seen = None           # datetime.datetime()
39
 
        if timeout is None:
40
 
            timeout = options.timeout
41
 
        self.timeout = timeout          # datetime.timedelta()
42
 
        if interval == -1:
43
 
            interval = options.interval
44
 
        else:
45
 
            interval = string_to_delta(interval)
46
 
        self.interval = interval        # datetime.timedelta()
47
 
        self.next_check = datetime.datetime.now() # datetime.datetime()
48
 
        # Note: next_check may be in the past if checker is not None
49
 
        self.checker = None             # or a subprocess.Popen()
50
 
    def check_action(self):
51
 
        """The checker said something and might have completed.
52
 
        Check if is has, and take appropriate actions."""
53
 
        if self.checker.poll() is None:
54
 
            # False alarm, no result yet
55
 
            #self.checker.read()
56
 
            #print "Checker for %(name)s said nothing?" % vars(self)
 
304
        if config is None:
 
305
            config = {}
 
306
        logger.debug("Creating client %r", self.name)
 
307
        # Uppercase and remove spaces from fingerprint for later
 
308
        # comparison purposes with return value from the fingerprint()
 
309
        # function
 
310
        self.fingerprint = (config["fingerprint"].upper()
 
311
                            .replace(" ", ""))
 
312
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
313
        if "secret" in config:
 
314
            self.secret = config["secret"].decode("base64")
 
315
        elif "secfile" in config:
 
316
            with open(os.path.expanduser(os.path.expandvars
 
317
                                         (config["secfile"])),
 
318
                      "rb") as secfile:
 
319
                self.secret = secfile.read()
 
320
        else:
 
321
            raise TypeError("No secret or secfile for client %s"
 
322
                            % self.name)
 
323
        self.host = config.get("host", "")
 
324
        self.created = datetime.datetime.utcnow()
 
325
        self.enabled = False
 
326
        self.last_approval_request = None
 
327
        self.last_enabled = None
 
328
        self.last_checked_ok = None
 
329
        self.timeout = string_to_delta(config["timeout"])
 
330
        self.interval = string_to_delta(config["interval"])
 
331
        self.disable_hook = disable_hook
 
332
        self.checker = None
 
333
        self.checker_initiator_tag = None
 
334
        self.disable_initiator_tag = None
 
335
        self.checker_callback_tag = None
 
336
        self.checker_command = config["checker"]
 
337
        self.current_checker_command = None
 
338
        self.last_connect = None
 
339
        self._approved = None
 
340
        self.approved_by_default = config.get("approved_by_default",
 
341
                                              True)
 
342
        self.approvals_pending = 0
 
343
        self.approval_delay = string_to_delta(
 
344
            config["approval_delay"])
 
345
        self.approval_duration = string_to_delta(
 
346
            config["approval_duration"])
 
347
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
348
    
 
349
    def send_changedstate(self):
 
350
        self.changedstate.acquire()
 
351
        self.changedstate.notify_all()
 
352
        self.changedstate.release()
 
353
        
 
354
    def enable(self):
 
355
        """Start this client's checker and timeout hooks"""
 
356
        if getattr(self, "enabled", False):
 
357
            # Already enabled
57
358
            return
58
 
        now = datetime.datetime.now()
59
 
        if self.checker.returncode == 0:
60
 
            print "Checker for %(name)s succeeded" % vars(self)
61
 
            self.last_seen = now
 
359
        self.send_changedstate()
 
360
        self.last_enabled = datetime.datetime.utcnow()
 
361
        # Schedule a new checker to be started an 'interval' from now,
 
362
        # and every interval from then on.
 
363
        self.checker_initiator_tag = (gobject.timeout_add
 
364
                                      (self.interval_milliseconds(),
 
365
                                       self.start_checker))
 
366
        # Schedule a disable() when 'timeout' has passed
 
367
        self.disable_initiator_tag = (gobject.timeout_add
 
368
                                   (self.timeout_milliseconds(),
 
369
                                    self.disable))
 
370
        self.enabled = True
 
371
        # Also start a new checker *right now*.
 
372
        self.start_checker()
 
373
    
 
374
    def disable(self, quiet=True):
 
375
        """Disable this client."""
 
376
        if not getattr(self, "enabled", False):
 
377
            return False
 
378
        if not quiet:
 
379
            self.send_changedstate()
 
380
        if not quiet:
 
381
            logger.info("Disabling client %s", self.name)
 
382
        if getattr(self, "disable_initiator_tag", False):
 
383
            gobject.source_remove(self.disable_initiator_tag)
 
384
            self.disable_initiator_tag = None
 
385
        if getattr(self, "checker_initiator_tag", False):
 
386
            gobject.source_remove(self.checker_initiator_tag)
 
387
            self.checker_initiator_tag = None
 
388
        self.stop_checker()
 
389
        if self.disable_hook:
 
390
            self.disable_hook(self)
 
391
        self.enabled = False
 
392
        # Do not run this again if called by a gobject.timeout_add
 
393
        return False
 
394
    
 
395
    def __del__(self):
 
396
        self.disable_hook = None
 
397
        self.disable()
 
398
    
 
399
    def checker_callback(self, pid, condition, command):
 
400
        """The checker has completed, so take appropriate actions."""
 
401
        self.checker_callback_tag = None
 
402
        self.checker = None
 
403
        if os.WIFEXITED(condition):
 
404
            exitstatus = os.WEXITSTATUS(condition)
 
405
            if exitstatus == 0:
 
406
                logger.info("Checker for %(name)s succeeded",
 
407
                            vars(self))
 
408
                self.checked_ok()
 
409
            else:
 
410
                logger.info("Checker for %(name)s failed",
 
411
                            vars(self))
62
412
        else:
63
 
            print "Checker for %(name)s failed" % vars(self)
64
 
        while self.next_check <= now:
65
 
            self.next_check += self.interval
66
 
        self.checker = None
67
 
    handle_request = check_action
 
413
            logger.warning("Checker for %(name)s crashed?",
 
414
                           vars(self))
 
415
    
 
416
    def checked_ok(self):
 
417
        """Bump up the timeout for this client.
 
418
        
 
419
        This should only be called when the client has been seen,
 
420
        alive and well.
 
421
        """
 
422
        self.last_checked_ok = datetime.datetime.utcnow()
 
423
        gobject.source_remove(self.disable_initiator_tag)
 
424
        self.disable_initiator_tag = (gobject.timeout_add
 
425
                                      (self.timeout_milliseconds(),
 
426
                                       self.disable))
 
427
    
 
428
    def need_approval(self):
 
429
        self.last_approval_request = datetime.datetime.utcnow()
 
430
    
68
431
    def start_checker(self):
69
 
        self.stop_checker()
 
432
        """Start a new checker subprocess if one is not running.
 
433
        
 
434
        If a checker already exists, leave it running and do
 
435
        nothing."""
 
436
        # The reason for not killing a running checker is that if we
 
437
        # did that, then if a checker (for some reason) started
 
438
        # running slowly and taking more than 'interval' time, the
 
439
        # client would inevitably timeout, since no checker would get
 
440
        # a chance to run to completion.  If we instead leave running
 
441
        # checkers alone, the checker would have to take more time
 
442
        # than 'timeout' for the client to be disabled, which is as it
 
443
        # should be.
 
444
        
 
445
        # If a checker exists, make sure it is not a zombie
70
446
        try:
71
 
            self.checker = subprocess.Popen("sleep 10; fping -q -- %s"
72
 
                                            % re.escape(self.fqdn),
73
 
                                            stdout=subprocess.PIPE,
74
 
                                            close_fds=True,
75
 
                                            shell=True, cwd="/")
76
 
        except subprocess.OSError, e:
77
 
            print "Failed to start subprocess:", e
 
447
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
448
        except (AttributeError, OSError), error:
 
449
            if (isinstance(error, OSError)
 
450
                and error.errno != errno.ECHILD):
 
451
                raise error
 
452
        else:
 
453
            if pid:
 
454
                logger.warning("Checker was a zombie")
 
455
                gobject.source_remove(self.checker_callback_tag)
 
456
                self.checker_callback(pid, status,
 
457
                                      self.current_checker_command)
 
458
        # Start a new checker if needed
 
459
        if self.checker is None:
 
460
            try:
 
461
                # In case checker_command has exactly one % operator
 
462
                command = self.checker_command % self.host
 
463
            except TypeError:
 
464
                # Escape attributes for the shell
 
465
                escaped_attrs = dict(
 
466
                    (attr,
 
467
                     re.escape(unicode(str(getattr(self, attr, "")),
 
468
                                       errors=
 
469
                                       'replace')))
 
470
                    for attr in
 
471
                    self.runtime_expansions)
 
472
 
 
473
                try:
 
474
                    command = self.checker_command % escaped_attrs
 
475
                except TypeError, error:
 
476
                    logger.error('Could not format string "%s":'
 
477
                                 ' %s', self.checker_command, error)
 
478
                    return True # Try again later
 
479
            self.current_checker_command = command
 
480
            try:
 
481
                logger.info("Starting checker %r for %s",
 
482
                            command, self.name)
 
483
                # We don't need to redirect stdout and stderr, since
 
484
                # in normal mode, that is already done by daemon(),
 
485
                # and in debug mode we don't want to.  (Stdin is
 
486
                # always replaced by /dev/null.)
 
487
                self.checker = subprocess.Popen(command,
 
488
                                                close_fds=True,
 
489
                                                shell=True, cwd="/")
 
490
                self.checker_callback_tag = (gobject.child_watch_add
 
491
                                             (self.checker.pid,
 
492
                                              self.checker_callback,
 
493
                                              data=command))
 
494
                # The checker may have completed before the gobject
 
495
                # watch was added.  Check for this.
 
496
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
497
                if pid:
 
498
                    gobject.source_remove(self.checker_callback_tag)
 
499
                    self.checker_callback(pid, status, command)
 
500
            except OSError, error:
 
501
                logger.error("Failed to start subprocess: %s",
 
502
                             error)
 
503
        # Re-run this periodically if run by gobject.timeout_add
 
504
        return True
 
505
    
78
506
    def stop_checker(self):
79
 
        if self.checker is None:
80
 
            return
81
 
        os.kill(self.checker.pid, signal.SIGTERM)
82
 
        if self.checker.poll() is None:
83
 
            os.kill(self.checker.pid, signal.SIGKILL)
84
 
        self.checker = None
85
 
    __del__ = stop_checker
86
 
    def fileno(self):
87
 
        if self.checker is None:
 
507
        """Force the checker process, if any, to stop."""
 
508
        if self.checker_callback_tag:
 
509
            gobject.source_remove(self.checker_callback_tag)
 
510
            self.checker_callback_tag = None
 
511
        if getattr(self, "checker", None) is None:
 
512
            return
 
513
        logger.debug("Stopping checker for %(name)s", vars(self))
 
514
        try:
 
515
            os.kill(self.checker.pid, signal.SIGTERM)
 
516
            #time.sleep(0.5)
 
517
            #if self.checker.poll() is None:
 
518
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
519
        except OSError, error:
 
520
            if error.errno != errno.ESRCH: # No such process
 
521
                raise
 
522
        self.checker = None
 
523
 
 
524
def dbus_service_property(dbus_interface, signature="v",
 
525
                          access="readwrite", byte_arrays=False):
 
526
    """Decorators for marking methods of a DBusObjectWithProperties to
 
527
    become properties on the D-Bus.
 
528
    
 
529
    The decorated method will be called with no arguments by "Get"
 
530
    and with one argument by "Set".
 
531
    
 
532
    The parameters, where they are supported, are the same as
 
533
    dbus.service.method, except there is only "signature", since the
 
534
    type from Get() and the type sent to Set() is the same.
 
535
    """
 
536
    # Encoding deeply encoded byte arrays is not supported yet by the
 
537
    # "Set" method, so we fail early here:
 
538
    if byte_arrays and signature != "ay":
 
539
        raise ValueError("Byte arrays not supported for non-'ay'"
 
540
                         " signature %r" % signature)
 
541
    def decorator(func):
 
542
        func._dbus_is_property = True
 
543
        func._dbus_interface = dbus_interface
 
544
        func._dbus_signature = signature
 
545
        func._dbus_access = access
 
546
        func._dbus_name = func.__name__
 
547
        if func._dbus_name.endswith("_dbus_property"):
 
548
            func._dbus_name = func._dbus_name[:-14]
 
549
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
550
        return func
 
551
    return decorator
 
552
 
 
553
 
 
554
class DBusPropertyException(dbus.exceptions.DBusException):
 
555
    """A base class for D-Bus property-related exceptions
 
556
    """
 
557
    def __unicode__(self):
 
558
        return unicode(str(self))
 
559
 
 
560
 
 
561
class DBusPropertyAccessException(DBusPropertyException):
 
562
    """A property's access permissions disallows an operation.
 
563
    """
 
564
    pass
 
565
 
 
566
 
 
567
class DBusPropertyNotFound(DBusPropertyException):
 
568
    """An attempt was made to access a non-existing property.
 
569
    """
 
570
    pass
 
571
 
 
572
 
 
573
class DBusObjectWithProperties(dbus.service.Object):
 
574
    """A D-Bus object with properties.
 
575
 
 
576
    Classes inheriting from this can use the dbus_service_property
 
577
    decorator to expose methods as D-Bus properties.  It exposes the
 
578
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
579
    """
 
580
    
 
581
    @staticmethod
 
582
    def _is_dbus_property(obj):
 
583
        return getattr(obj, "_dbus_is_property", False)
 
584
    
 
585
    def _get_all_dbus_properties(self):
 
586
        """Returns a generator of (name, attribute) pairs
 
587
        """
 
588
        return ((prop._dbus_name, prop)
 
589
                for name, prop in
 
590
                inspect.getmembers(self, self._is_dbus_property))
 
591
    
 
592
    def _get_dbus_property(self, interface_name, property_name):
 
593
        """Returns a bound method if one exists which is a D-Bus
 
594
        property with the specified name and interface.
 
595
        """
 
596
        for name in (property_name,
 
597
                     property_name + "_dbus_property"):
 
598
            prop = getattr(self, name, None)
 
599
            if (prop is None
 
600
                or not self._is_dbus_property(prop)
 
601
                or prop._dbus_name != property_name
 
602
                or (interface_name and prop._dbus_interface
 
603
                    and interface_name != prop._dbus_interface)):
 
604
                continue
 
605
            return prop
 
606
        # No such property
 
607
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
608
                                   + interface_name + "."
 
609
                                   + property_name)
 
610
    
 
611
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
612
                         out_signature="v")
 
613
    def Get(self, interface_name, property_name):
 
614
        """Standard D-Bus property Get() method, see D-Bus standard.
 
615
        """
 
616
        prop = self._get_dbus_property(interface_name, property_name)
 
617
        if prop._dbus_access == "write":
 
618
            raise DBusPropertyAccessException(property_name)
 
619
        value = prop()
 
620
        if not hasattr(value, "variant_level"):
 
621
            return value
 
622
        return type(value)(value, variant_level=value.variant_level+1)
 
623
    
 
624
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
 
625
    def Set(self, interface_name, property_name, value):
 
626
        """Standard D-Bus property Set() method, see D-Bus standard.
 
627
        """
 
628
        prop = self._get_dbus_property(interface_name, property_name)
 
629
        if prop._dbus_access == "read":
 
630
            raise DBusPropertyAccessException(property_name)
 
631
        if prop._dbus_get_args_options["byte_arrays"]:
 
632
            # The byte_arrays option is not supported yet on
 
633
            # signatures other than "ay".
 
634
            if prop._dbus_signature != "ay":
 
635
                raise ValueError
 
636
            value = dbus.ByteArray(''.join(unichr(byte)
 
637
                                           for byte in value))
 
638
        prop(value)
 
639
    
 
640
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
641
                         out_signature="a{sv}")
 
642
    def GetAll(self, interface_name):
 
643
        """Standard D-Bus property GetAll() method, see D-Bus
 
644
        standard.
 
645
 
 
646
        Note: Will not include properties with access="write".
 
647
        """
 
648
        all = {}
 
649
        for name, prop in self._get_all_dbus_properties():
 
650
            if (interface_name
 
651
                and interface_name != prop._dbus_interface):
 
652
                # Interface non-empty but did not match
 
653
                continue
 
654
            # Ignore write-only properties
 
655
            if prop._dbus_access == "write":
 
656
                continue
 
657
            value = prop()
 
658
            if not hasattr(value, "variant_level"):
 
659
                all[name] = value
 
660
                continue
 
661
            all[name] = type(value)(value, variant_level=
 
662
                                    value.variant_level+1)
 
663
        return dbus.Dictionary(all, signature="sv")
 
664
    
 
665
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
666
                         out_signature="s",
 
667
                         path_keyword='object_path',
 
668
                         connection_keyword='connection')
 
669
    def Introspect(self, object_path, connection):
 
670
        """Standard D-Bus method, overloaded to insert property tags.
 
671
        """
 
672
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
673
                                                   connection)
 
674
        try:
 
675
            document = xml.dom.minidom.parseString(xmlstring)
 
676
            def make_tag(document, name, prop):
 
677
                e = document.createElement("property")
 
678
                e.setAttribute("name", name)
 
679
                e.setAttribute("type", prop._dbus_signature)
 
680
                e.setAttribute("access", prop._dbus_access)
 
681
                return e
 
682
            for if_tag in document.getElementsByTagName("interface"):
 
683
                for tag in (make_tag(document, name, prop)
 
684
                            for name, prop
 
685
                            in self._get_all_dbus_properties()
 
686
                            if prop._dbus_interface
 
687
                            == if_tag.getAttribute("name")):
 
688
                    if_tag.appendChild(tag)
 
689
                # Add the names to the return values for the
 
690
                # "org.freedesktop.DBus.Properties" methods
 
691
                if (if_tag.getAttribute("name")
 
692
                    == "org.freedesktop.DBus.Properties"):
 
693
                    for cn in if_tag.getElementsByTagName("method"):
 
694
                        if cn.getAttribute("name") == "Get":
 
695
                            for arg in cn.getElementsByTagName("arg"):
 
696
                                if (arg.getAttribute("direction")
 
697
                                    == "out"):
 
698
                                    arg.setAttribute("name", "value")
 
699
                        elif cn.getAttribute("name") == "GetAll":
 
700
                            for arg in cn.getElementsByTagName("arg"):
 
701
                                if (arg.getAttribute("direction")
 
702
                                    == "out"):
 
703
                                    arg.setAttribute("name", "props")
 
704
            xmlstring = document.toxml("utf-8")
 
705
            document.unlink()
 
706
        except (AttributeError, xml.dom.DOMException,
 
707
                xml.parsers.expat.ExpatError), error:
 
708
            logger.error("Failed to override Introspection method",
 
709
                         error)
 
710
        return xmlstring
 
711
 
 
712
 
 
713
class ClientDBus(Client, DBusObjectWithProperties):
 
714
    """A Client class using D-Bus
 
715
    
 
716
    Attributes:
 
717
    dbus_object_path: dbus.ObjectPath
 
718
    bus: dbus.SystemBus()
 
719
    """
 
720
    
 
721
    runtime_expansions = (Client.runtime_expansions
 
722
                          + ("dbus_object_path",))
 
723
    
 
724
    # dbus.service.Object doesn't use super(), so we can't either.
 
725
    
 
726
    def __init__(self, bus = None, *args, **kwargs):
 
727
        self._approvals_pending = 0
 
728
        self.bus = bus
 
729
        Client.__init__(self, *args, **kwargs)
 
730
        # Only now, when this client is initialized, can it show up on
 
731
        # the D-Bus
 
732
        client_object_name = unicode(self.name).translate(
 
733
            {ord("."): ord("_"),
 
734
             ord("-"): ord("_")})
 
735
        self.dbus_object_path = (dbus.ObjectPath
 
736
                                 ("/clients/" + client_object_name))
 
737
        DBusObjectWithProperties.__init__(self, self.bus,
 
738
                                          self.dbus_object_path)
 
739
        
 
740
    def _get_approvals_pending(self):
 
741
        return self._approvals_pending
 
742
    def _set_approvals_pending(self, value):
 
743
        old_value = self._approvals_pending
 
744
        self._approvals_pending = value
 
745
        bval = bool(value)
 
746
        if (hasattr(self, "dbus_object_path")
 
747
            and bval is not bool(old_value)):
 
748
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
749
            self.PropertyChanged(dbus.String("ApprovalPending"),
 
750
                                 dbus_bool)
 
751
 
 
752
    approvals_pending = property(_get_approvals_pending,
 
753
                                 _set_approvals_pending)
 
754
    del _get_approvals_pending, _set_approvals_pending
 
755
    
 
756
    @staticmethod
 
757
    def _datetime_to_dbus(dt, variant_level=0):
 
758
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
759
        return dbus.String(dt.isoformat(),
 
760
                           variant_level=variant_level)
 
761
    
 
762
    def enable(self):
 
763
        oldstate = getattr(self, "enabled", False)
 
764
        r = Client.enable(self)
 
765
        if oldstate != self.enabled:
 
766
            # Emit D-Bus signals
 
767
            self.PropertyChanged(dbus.String("Enabled"),
 
768
                                 dbus.Boolean(True, variant_level=1))
 
769
            self.PropertyChanged(
 
770
                dbus.String("LastEnabled"),
 
771
                self._datetime_to_dbus(self.last_enabled,
 
772
                                       variant_level=1))
 
773
        return r
 
774
    
 
775
    def disable(self, quiet = False):
 
776
        oldstate = getattr(self, "enabled", False)
 
777
        r = Client.disable(self, quiet=quiet)
 
778
        if not quiet and oldstate != self.enabled:
 
779
            # Emit D-Bus signal
 
780
            self.PropertyChanged(dbus.String("Enabled"),
 
781
                                 dbus.Boolean(False, variant_level=1))
 
782
        return r
 
783
    
 
784
    def __del__(self, *args, **kwargs):
 
785
        try:
 
786
            self.remove_from_connection()
 
787
        except LookupError:
 
788
            pass
 
789
        if hasattr(DBusObjectWithProperties, "__del__"):
 
790
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
 
791
        Client.__del__(self, *args, **kwargs)
 
792
    
 
793
    def checker_callback(self, pid, condition, command,
 
794
                         *args, **kwargs):
 
795
        self.checker_callback_tag = None
 
796
        self.checker = None
 
797
        # Emit D-Bus signal
 
798
        self.PropertyChanged(dbus.String("CheckerRunning"),
 
799
                             dbus.Boolean(False, variant_level=1))
 
800
        if os.WIFEXITED(condition):
 
801
            exitstatus = os.WEXITSTATUS(condition)
 
802
            # Emit D-Bus signal
 
803
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
804
                                  dbus.Int64(condition),
 
805
                                  dbus.String(command))
 
806
        else:
 
807
            # Emit D-Bus signal
 
808
            self.CheckerCompleted(dbus.Int16(-1),
 
809
                                  dbus.Int64(condition),
 
810
                                  dbus.String(command))
 
811
        
 
812
        return Client.checker_callback(self, pid, condition, command,
 
813
                                       *args, **kwargs)
 
814
    
 
815
    def checked_ok(self, *args, **kwargs):
 
816
        r = Client.checked_ok(self, *args, **kwargs)
 
817
        # Emit D-Bus signal
 
818
        self.PropertyChanged(
 
819
            dbus.String("LastCheckedOK"),
 
820
            (self._datetime_to_dbus(self.last_checked_ok,
 
821
                                    variant_level=1)))
 
822
        return r
 
823
    
 
824
    def need_approval(self, *args, **kwargs):
 
825
        r = Client.need_approval(self, *args, **kwargs)
 
826
        # Emit D-Bus signal
 
827
        self.PropertyChanged(
 
828
            dbus.String("LastApprovalRequest"),
 
829
            (self._datetime_to_dbus(self.last_approval_request,
 
830
                                    variant_level=1)))
 
831
        return r
 
832
    
 
833
    def start_checker(self, *args, **kwargs):
 
834
        old_checker = self.checker
 
835
        if self.checker is not None:
 
836
            old_checker_pid = self.checker.pid
 
837
        else:
 
838
            old_checker_pid = None
 
839
        r = Client.start_checker(self, *args, **kwargs)
 
840
        # Only if new checker process was started
 
841
        if (self.checker is not None
 
842
            and old_checker_pid != self.checker.pid):
 
843
            # Emit D-Bus signal
 
844
            self.CheckerStarted(self.current_checker_command)
 
845
            self.PropertyChanged(
 
846
                dbus.String("CheckerRunning"),
 
847
                dbus.Boolean(True, variant_level=1))
 
848
        return r
 
849
    
 
850
    def stop_checker(self, *args, **kwargs):
 
851
        old_checker = getattr(self, "checker", None)
 
852
        r = Client.stop_checker(self, *args, **kwargs)
 
853
        if (old_checker is not None
 
854
            and getattr(self, "checker", None) is None):
 
855
            self.PropertyChanged(dbus.String("CheckerRunning"),
 
856
                                 dbus.Boolean(False, variant_level=1))
 
857
        return r
 
858
 
 
859
    def _reset_approved(self):
 
860
        self._approved = None
 
861
        return False
 
862
    
 
863
    def approve(self, value=True):
 
864
        self.send_changedstate()
 
865
        self._approved = value
 
866
        gobject.timeout_add(self._timedelta_to_milliseconds
 
867
                            (self.approval_duration),
 
868
                            self._reset_approved)
 
869
    
 
870
    
 
871
    ## D-Bus methods, signals & properties
 
872
    _interface = "se.bsnet.fukt.Mandos.Client"
 
873
    
 
874
    ## Signals
 
875
    
 
876
    # CheckerCompleted - signal
 
877
    @dbus.service.signal(_interface, signature="nxs")
 
878
    def CheckerCompleted(self, exitcode, waitstatus, command):
 
879
        "D-Bus signal"
 
880
        pass
 
881
    
 
882
    # CheckerStarted - signal
 
883
    @dbus.service.signal(_interface, signature="s")
 
884
    def CheckerStarted(self, command):
 
885
        "D-Bus signal"
 
886
        pass
 
887
    
 
888
    # PropertyChanged - signal
 
889
    @dbus.service.signal(_interface, signature="sv")
 
890
    def PropertyChanged(self, property, value):
 
891
        "D-Bus signal"
 
892
        pass
 
893
    
 
894
    # GotSecret - signal
 
895
    @dbus.service.signal(_interface)
 
896
    def GotSecret(self):
 
897
        """D-Bus signal
 
898
        Is sent after a successful transfer of secret from the Mandos
 
899
        server to mandos-client
 
900
        """
 
901
        pass
 
902
    
 
903
    # Rejected - signal
 
904
    @dbus.service.signal(_interface, signature="s")
 
905
    def Rejected(self, reason):
 
906
        "D-Bus signal"
 
907
        pass
 
908
    
 
909
    # NeedApproval - signal
 
910
    @dbus.service.signal(_interface, signature="tb")
 
911
    def NeedApproval(self, timeout, default):
 
912
        "D-Bus signal"
 
913
        return self.need_approval()
 
914
    
 
915
    ## Methods
 
916
    
 
917
    # Approve - method
 
918
    @dbus.service.method(_interface, in_signature="b")
 
919
    def Approve(self, value):
 
920
        self.approve(value)
 
921
    
 
922
    # CheckedOK - method
 
923
    @dbus.service.method(_interface)
 
924
    def CheckedOK(self):
 
925
        return self.checked_ok()
 
926
    
 
927
    # Enable - method
 
928
    @dbus.service.method(_interface)
 
929
    def Enable(self):
 
930
        "D-Bus method"
 
931
        self.enable()
 
932
    
 
933
    # StartChecker - method
 
934
    @dbus.service.method(_interface)
 
935
    def StartChecker(self):
 
936
        "D-Bus method"
 
937
        self.start_checker()
 
938
    
 
939
    # Disable - method
 
940
    @dbus.service.method(_interface)
 
941
    def Disable(self):
 
942
        "D-Bus method"
 
943
        self.disable()
 
944
    
 
945
    # StopChecker - method
 
946
    @dbus.service.method(_interface)
 
947
    def StopChecker(self):
 
948
        self.stop_checker()
 
949
    
 
950
    ## Properties
 
951
    
 
952
    # ApprovalPending - property
 
953
    @dbus_service_property(_interface, signature="b", access="read")
 
954
    def ApprovalPending_dbus_property(self):
 
955
        return dbus.Boolean(bool(self.approvals_pending))
 
956
    
 
957
    # ApprovedByDefault - property
 
958
    @dbus_service_property(_interface, signature="b",
 
959
                           access="readwrite")
 
960
    def ApprovedByDefault_dbus_property(self, value=None):
 
961
        if value is None:       # get
 
962
            return dbus.Boolean(self.approved_by_default)
 
963
        self.approved_by_default = bool(value)
 
964
        # Emit D-Bus signal
 
965
        self.PropertyChanged(dbus.String("ApprovedByDefault"),
 
966
                             dbus.Boolean(value, variant_level=1))
 
967
    
 
968
    # ApprovalDelay - property
 
969
    @dbus_service_property(_interface, signature="t",
 
970
                           access="readwrite")
 
971
    def ApprovalDelay_dbus_property(self, value=None):
 
972
        if value is None:       # get
 
973
            return dbus.UInt64(self.approval_delay_milliseconds())
 
974
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
975
        # Emit D-Bus signal
 
976
        self.PropertyChanged(dbus.String("ApprovalDelay"),
 
977
                             dbus.UInt64(value, variant_level=1))
 
978
    
 
979
    # ApprovalDuration - property
 
980
    @dbus_service_property(_interface, signature="t",
 
981
                           access="readwrite")
 
982
    def ApprovalDuration_dbus_property(self, value=None):
 
983
        if value is None:       # get
 
984
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
985
                    self.approval_duration))
 
986
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
987
        # Emit D-Bus signal
 
988
        self.PropertyChanged(dbus.String("ApprovalDuration"),
 
989
                             dbus.UInt64(value, variant_level=1))
 
990
    
 
991
    # Name - property
 
992
    @dbus_service_property(_interface, signature="s", access="read")
 
993
    def Name_dbus_property(self):
 
994
        return dbus.String(self.name)
 
995
    
 
996
    # Fingerprint - property
 
997
    @dbus_service_property(_interface, signature="s", access="read")
 
998
    def Fingerprint_dbus_property(self):
 
999
        return dbus.String(self.fingerprint)
 
1000
    
 
1001
    # Host - property
 
1002
    @dbus_service_property(_interface, signature="s",
 
1003
                           access="readwrite")
 
1004
    def Host_dbus_property(self, value=None):
 
1005
        if value is None:       # get
 
1006
            return dbus.String(self.host)
 
1007
        self.host = value
 
1008
        # Emit D-Bus signal
 
1009
        self.PropertyChanged(dbus.String("Host"),
 
1010
                             dbus.String(value, variant_level=1))
 
1011
    
 
1012
    # Created - property
 
1013
    @dbus_service_property(_interface, signature="s", access="read")
 
1014
    def Created_dbus_property(self):
 
1015
        return dbus.String(self._datetime_to_dbus(self.created))
 
1016
    
 
1017
    # LastEnabled - property
 
1018
    @dbus_service_property(_interface, signature="s", access="read")
 
1019
    def LastEnabled_dbus_property(self):
 
1020
        if self.last_enabled is None:
 
1021
            return dbus.String("")
 
1022
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
1023
    
 
1024
    # Enabled - property
 
1025
    @dbus_service_property(_interface, signature="b",
 
1026
                           access="readwrite")
 
1027
    def Enabled_dbus_property(self, value=None):
 
1028
        if value is None:       # get
 
1029
            return dbus.Boolean(self.enabled)
 
1030
        if value:
 
1031
            self.enable()
 
1032
        else:
 
1033
            self.disable()
 
1034
    
 
1035
    # LastCheckedOK - property
 
1036
    @dbus_service_property(_interface, signature="s",
 
1037
                           access="readwrite")
 
1038
    def LastCheckedOK_dbus_property(self, value=None):
 
1039
        if value is not None:
 
1040
            self.checked_ok()
 
1041
            return
 
1042
        if self.last_checked_ok is None:
 
1043
            return dbus.String("")
 
1044
        return dbus.String(self._datetime_to_dbus(self
 
1045
                                                  .last_checked_ok))
 
1046
    
 
1047
    # LastApprovalRequest - property
 
1048
    @dbus_service_property(_interface, signature="s", access="read")
 
1049
    def LastApprovalRequest_dbus_property(self):
 
1050
        if self.last_approval_request is None:
 
1051
            return dbus.String("")
 
1052
        return dbus.String(self.
 
1053
                           _datetime_to_dbus(self
 
1054
                                             .last_approval_request))
 
1055
    
 
1056
    # Timeout - property
 
1057
    @dbus_service_property(_interface, signature="t",
 
1058
                           access="readwrite")
 
1059
    def Timeout_dbus_property(self, value=None):
 
1060
        if value is None:       # get
 
1061
            return dbus.UInt64(self.timeout_milliseconds())
 
1062
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1063
        # Emit D-Bus signal
 
1064
        self.PropertyChanged(dbus.String("Timeout"),
 
1065
                             dbus.UInt64(value, variant_level=1))
 
1066
        if getattr(self, "disable_initiator_tag", None) is None:
 
1067
            return
 
1068
        # Reschedule timeout
 
1069
        gobject.source_remove(self.disable_initiator_tag)
 
1070
        self.disable_initiator_tag = None
 
1071
        time_to_die = (self.
 
1072
                       _timedelta_to_milliseconds((self
 
1073
                                                   .last_checked_ok
 
1074
                                                   + self.timeout)
 
1075
                                                  - datetime.datetime
 
1076
                                                  .utcnow()))
 
1077
        if time_to_die <= 0:
 
1078
            # The timeout has passed
 
1079
            self.disable()
 
1080
        else:
 
1081
            self.disable_initiator_tag = (gobject.timeout_add
 
1082
                                          (time_to_die, self.disable))
 
1083
    
 
1084
    # Interval - property
 
1085
    @dbus_service_property(_interface, signature="t",
 
1086
                           access="readwrite")
 
1087
    def Interval_dbus_property(self, value=None):
 
1088
        if value is None:       # get
 
1089
            return dbus.UInt64(self.interval_milliseconds())
 
1090
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1091
        # Emit D-Bus signal
 
1092
        self.PropertyChanged(dbus.String("Interval"),
 
1093
                             dbus.UInt64(value, variant_level=1))
 
1094
        if getattr(self, "checker_initiator_tag", None) is None:
 
1095
            return
 
1096
        # Reschedule checker run
 
1097
        gobject.source_remove(self.checker_initiator_tag)
 
1098
        self.checker_initiator_tag = (gobject.timeout_add
 
1099
                                      (value, self.start_checker))
 
1100
        self.start_checker()    # Start one now, too
 
1101
 
 
1102
    # Checker - property
 
1103
    @dbus_service_property(_interface, signature="s",
 
1104
                           access="readwrite")
 
1105
    def Checker_dbus_property(self, value=None):
 
1106
        if value is None:       # get
 
1107
            return dbus.String(self.checker_command)
 
1108
        self.checker_command = value
 
1109
        # Emit D-Bus signal
 
1110
        self.PropertyChanged(dbus.String("Checker"),
 
1111
                             dbus.String(self.checker_command,
 
1112
                                         variant_level=1))
 
1113
    
 
1114
    # CheckerRunning - property
 
1115
    @dbus_service_property(_interface, signature="b",
 
1116
                           access="readwrite")
 
1117
    def CheckerRunning_dbus_property(self, value=None):
 
1118
        if value is None:       # get
 
1119
            return dbus.Boolean(self.checker is not None)
 
1120
        if value:
 
1121
            self.start_checker()
 
1122
        else:
 
1123
            self.stop_checker()
 
1124
    
 
1125
    # ObjectPath - property
 
1126
    @dbus_service_property(_interface, signature="o", access="read")
 
1127
    def ObjectPath_dbus_property(self):
 
1128
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1129
    
 
1130
    # Secret = property
 
1131
    @dbus_service_property(_interface, signature="ay",
 
1132
                           access="write", byte_arrays=True)
 
1133
    def Secret_dbus_property(self, value):
 
1134
        self.secret = str(value)
 
1135
    
 
1136
    del _interface
 
1137
 
 
1138
 
 
1139
class ProxyClient(object):
 
1140
    def __init__(self, child_pipe, fpr, address):
 
1141
        self._pipe = child_pipe
 
1142
        self._pipe.send(('init', fpr, address))
 
1143
        if not self._pipe.recv():
 
1144
            raise KeyError()
 
1145
 
 
1146
    def __getattribute__(self, name):
 
1147
        if(name == '_pipe'):
 
1148
            return super(ProxyClient, self).__getattribute__(name)
 
1149
        self._pipe.send(('getattr', name))
 
1150
        data = self._pipe.recv()
 
1151
        if data[0] == 'data':
 
1152
            return data[1]
 
1153
        if data[0] == 'function':
 
1154
            def func(*args, **kwargs):
 
1155
                self._pipe.send(('funcall', name, args, kwargs))
 
1156
                return self._pipe.recv()[1]
 
1157
            return func
 
1158
 
 
1159
    def __setattr__(self, name, value):
 
1160
        if(name == '_pipe'):
 
1161
            return super(ProxyClient, self).__setattr__(name, value)
 
1162
        self._pipe.send(('setattr', name, value))
 
1163
 
 
1164
 
 
1165
class ClientHandler(socketserver.BaseRequestHandler, object):
 
1166
    """A class to handle client connections.
 
1167
    
 
1168
    Instantiated once for each connection to handle it.
 
1169
    Note: This will run in its own forked process."""
 
1170
    
 
1171
    def handle(self):
 
1172
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1173
            logger.info("TCP connection from: %s",
 
1174
                        unicode(self.client_address))
 
1175
            logger.debug("Pipe FD: %d",
 
1176
                         self.server.child_pipe.fileno())
 
1177
 
 
1178
            session = (gnutls.connection
 
1179
                       .ClientSession(self.request,
 
1180
                                      gnutls.connection
 
1181
                                      .X509Credentials()))
 
1182
 
 
1183
            # Note: gnutls.connection.X509Credentials is really a
 
1184
            # generic GnuTLS certificate credentials object so long as
 
1185
            # no X.509 keys are added to it.  Therefore, we can use it
 
1186
            # here despite using OpenPGP certificates.
 
1187
 
 
1188
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1189
            #                      "+AES-256-CBC", "+SHA1",
 
1190
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1191
            #                      "+DHE-DSS"))
 
1192
            # Use a fallback default, since this MUST be set.
 
1193
            priority = self.server.gnutls_priority
 
1194
            if priority is None:
 
1195
                priority = "NORMAL"
 
1196
            (gnutls.library.functions
 
1197
             .gnutls_priority_set_direct(session._c_object,
 
1198
                                         priority, None))
 
1199
 
 
1200
            # Start communication using the Mandos protocol
 
1201
            # Get protocol number
 
1202
            line = self.request.makefile().readline()
 
1203
            logger.debug("Protocol version: %r", line)
 
1204
            try:
 
1205
                if int(line.strip().split()[0]) > 1:
 
1206
                    raise RuntimeError
 
1207
            except (ValueError, IndexError, RuntimeError), error:
 
1208
                logger.error("Unknown protocol version: %s", error)
 
1209
                return
 
1210
 
 
1211
            # Start GnuTLS connection
 
1212
            try:
 
1213
                session.handshake()
 
1214
            except gnutls.errors.GNUTLSError, error:
 
1215
                logger.warning("Handshake failed: %s", error)
 
1216
                # Do not run session.bye() here: the session is not
 
1217
                # established.  Just abandon the request.
 
1218
                return
 
1219
            logger.debug("Handshake succeeded")
 
1220
 
 
1221
            approval_required = False
 
1222
            try:
 
1223
                try:
 
1224
                    fpr = self.fingerprint(self.peer_certificate
 
1225
                                           (session))
 
1226
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1227
                    logger.warning("Bad certificate: %s", error)
 
1228
                    return
 
1229
                logger.debug("Fingerprint: %s", fpr)
 
1230
 
 
1231
                try:
 
1232
                    client = ProxyClient(child_pipe, fpr,
 
1233
                                         self.client_address)
 
1234
                except KeyError:
 
1235
                    return
 
1236
                
 
1237
                if client.approval_delay:
 
1238
                    delay = client.approval_delay
 
1239
                    client.approvals_pending += 1
 
1240
                    approval_required = True
 
1241
                
 
1242
                while True:
 
1243
                    if not client.enabled:
 
1244
                        logger.warning("Client %s is disabled",
 
1245
                                       client.name)
 
1246
                        if self.server.use_dbus:
 
1247
                            # Emit D-Bus signal
 
1248
                            client.Rejected("Disabled")                    
 
1249
                        return
 
1250
                    
 
1251
                    if client._approved or not client.approval_delay:
 
1252
                        #We are approved or approval is disabled
 
1253
                        break
 
1254
                    elif client._approved is None:
 
1255
                        logger.info("Client %s needs approval",
 
1256
                                    client.name)
 
1257
                        if self.server.use_dbus:
 
1258
                            # Emit D-Bus signal
 
1259
                            client.NeedApproval(
 
1260
                                client.approval_delay_milliseconds(),
 
1261
                                client.approved_by_default)
 
1262
                    else:
 
1263
                        logger.warning("Client %s was not approved",
 
1264
                                       client.name)
 
1265
                        if self.server.use_dbus:
 
1266
                            # Emit D-Bus signal
 
1267
                            client.Rejected("Denied")
 
1268
                        return
 
1269
                    
 
1270
                    #wait until timeout or approved
 
1271
                    #x = float(client._timedelta_to_milliseconds(delay))
 
1272
                    time = datetime.datetime.now()
 
1273
                    client.changedstate.acquire()
 
1274
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1275
                    client.changedstate.release()
 
1276
                    time2 = datetime.datetime.now()
 
1277
                    if (time2 - time) >= delay:
 
1278
                        if not client.approved_by_default:
 
1279
                            logger.warning("Client %s timed out while"
 
1280
                                           " waiting for approval",
 
1281
                                           client.name)
 
1282
                            if self.server.use_dbus:
 
1283
                                # Emit D-Bus signal
 
1284
                                client.Rejected("Approval timed out")
 
1285
                            return
 
1286
                        else:
 
1287
                            break
 
1288
                    else:
 
1289
                        delay -= time2 - time
 
1290
                
 
1291
                sent_size = 0
 
1292
                while sent_size < len(client.secret):
 
1293
                    try:
 
1294
                        sent = session.send(client.secret[sent_size:])
 
1295
                    except (gnutls.errors.GNUTLSError), error:
 
1296
                        logger.warning("gnutls send failed")
 
1297
                        return
 
1298
                    logger.debug("Sent: %d, remaining: %d",
 
1299
                                 sent, len(client.secret)
 
1300
                                 - (sent_size + sent))
 
1301
                    sent_size += sent
 
1302
 
 
1303
                logger.info("Sending secret to %s", client.name)
 
1304
                # bump the timeout as if seen
 
1305
                client.checked_ok()
 
1306
                if self.server.use_dbus:
 
1307
                    # Emit D-Bus signal
 
1308
                    client.GotSecret()
 
1309
            
 
1310
            finally:
 
1311
                if approval_required:
 
1312
                    client.approvals_pending -= 1
 
1313
                try:
 
1314
                    session.bye()
 
1315
                except (gnutls.errors.GNUTLSError), error:
 
1316
                    logger.warning("GnuTLS bye failed")
 
1317
    
 
1318
    @staticmethod
 
1319
    def peer_certificate(session):
 
1320
        "Return the peer's OpenPGP certificate as a bytestring"
 
1321
        # If not an OpenPGP certificate...
 
1322
        if (gnutls.library.functions
 
1323
            .gnutls_certificate_type_get(session._c_object)
 
1324
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1325
            # ...do the normal thing
 
1326
            return session.peer_certificate
 
1327
        list_size = ctypes.c_uint(1)
 
1328
        cert_list = (gnutls.library.functions
 
1329
                     .gnutls_certificate_get_peers
 
1330
                     (session._c_object, ctypes.byref(list_size)))
 
1331
        if not bool(cert_list) and list_size.value != 0:
 
1332
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1333
                                            " certificate")
 
1334
        if list_size.value == 0:
88
1335
            return None
89
 
        return self.checker.stdout.fileno()
90
 
    def next_stop(self):
91
 
        """The time when something must be done about this client
92
 
        May be in the past."""
93
 
        if self.last_seen is None:
94
 
            # This client has never been seen
95
 
            next_timeout = self.created + self.timeout
96
 
        else:
97
 
            next_timeout = self.last_seen + self.timeout
98
 
        if self.checker is None:
99
 
            return min(next_timeout, self.next_check)
100
 
        else:
101
 
            return next_timeout
102
 
    def still_valid(self, now=None):
103
 
        """Has this client's timeout not passed?"""
104
 
        if now is None:
105
 
            now = datetime.datetime.now()
106
 
        if self.last_seen is None:
107
 
            return now < (self.created + self.timeout)
108
 
        else:
109
 
            return now < (self.last_seen + self.timeout)
110
 
    def it_is_time_to_check(self, now=None):
111
 
        if now is None:
112
 
            now = datetime.datetime.now()
113
 
        return self.next_check <= now
114
 
 
115
 
 
116
 
class server_metaclass(type):
117
 
    "Common behavior for the UDP and TCP server classes"
118
 
    def __new__(cls, name, bases, attrs):
119
 
        attrs["address_family"] = socket.AF_INET6
120
 
        attrs["allow_reuse_address"] = True
121
 
        def server_bind(self):
122
 
            if self.options.interface:
123
 
                if not hasattr(socket, "SO_BINDTODEVICE"):
124
 
                    # From /usr/include/asm-i486/socket.h
125
 
                    socket.SO_BINDTODEVICE = 25
 
1336
        cert = cert_list[0]
 
1337
        return ctypes.string_at(cert.data, cert.size)
 
1338
    
 
1339
    @staticmethod
 
1340
    def fingerprint(openpgp):
 
1341
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
 
1342
        # New GnuTLS "datum" with the OpenPGP public key
 
1343
        datum = (gnutls.library.types
 
1344
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1345
                                             ctypes.POINTER
 
1346
                                             (ctypes.c_ubyte)),
 
1347
                                 ctypes.c_uint(len(openpgp))))
 
1348
        # New empty GnuTLS certificate
 
1349
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1350
        (gnutls.library.functions
 
1351
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1352
        # Import the OpenPGP public key into the certificate
 
1353
        (gnutls.library.functions
 
1354
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1355
                                    gnutls.library.constants
 
1356
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1357
        # Verify the self signature in the key
 
1358
        crtverify = ctypes.c_uint()
 
1359
        (gnutls.library.functions
 
1360
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1361
                                         ctypes.byref(crtverify)))
 
1362
        if crtverify.value != 0:
 
1363
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1364
            raise (gnutls.errors.CertificateSecurityError
 
1365
                   ("Verify failed"))
 
1366
        # New buffer for the fingerprint
 
1367
        buf = ctypes.create_string_buffer(20)
 
1368
        buf_len = ctypes.c_size_t()
 
1369
        # Get the fingerprint from the certificate into the buffer
 
1370
        (gnutls.library.functions
 
1371
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1372
                                             ctypes.byref(buf_len)))
 
1373
        # Deinit the certificate
 
1374
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1375
        # Convert the buffer to a Python bytestring
 
1376
        fpr = ctypes.string_at(buf, buf_len.value)
 
1377
        # Convert the bytestring to hexadecimal notation
 
1378
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1379
        return hex_fpr
 
1380
 
 
1381
 
 
1382
class MultiprocessingMixIn(object):
 
1383
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1384
    def sub_process_main(self, request, address):
 
1385
        try:
 
1386
            self.finish_request(request, address)
 
1387
        except:
 
1388
            self.handle_error(request, address)
 
1389
        self.close_request(request)
 
1390
            
 
1391
    def process_request(self, request, address):
 
1392
        """Start a new process to process the request."""
 
1393
        multiprocessing.Process(target = self.sub_process_main,
 
1394
                                args = (request, address)).start()
 
1395
 
 
1396
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1397
    """ adds a pipe to the MixIn """
 
1398
    def process_request(self, request, client_address):
 
1399
        """Overrides and wraps the original process_request().
 
1400
        
 
1401
        This function creates a new pipe in self.pipe
 
1402
        """
 
1403
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1404
 
 
1405
        super(MultiprocessingMixInWithPipe,
 
1406
              self).process_request(request, client_address)
 
1407
        self.child_pipe.close()
 
1408
        self.add_pipe(parent_pipe)
 
1409
 
 
1410
    def add_pipe(self, parent_pipe):
 
1411
        """Dummy function; override as necessary"""
 
1412
        raise NotImplementedError
 
1413
 
 
1414
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
 
1415
                     socketserver.TCPServer, object):
 
1416
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
1417
    
 
1418
    Attributes:
 
1419
        enabled:        Boolean; whether this server is activated yet
 
1420
        interface:      None or a network interface name (string)
 
1421
        use_ipv6:       Boolean; to use IPv6 or not
 
1422
    """
 
1423
    def __init__(self, server_address, RequestHandlerClass,
 
1424
                 interface=None, use_ipv6=True):
 
1425
        self.interface = interface
 
1426
        if use_ipv6:
 
1427
            self.address_family = socket.AF_INET6
 
1428
        socketserver.TCPServer.__init__(self, server_address,
 
1429
                                        RequestHandlerClass)
 
1430
    def server_bind(self):
 
1431
        """This overrides the normal server_bind() function
 
1432
        to bind to an interface if one was specified, and also NOT to
 
1433
        bind to an address or port if they were not specified."""
 
1434
        if self.interface is not None:
 
1435
            if SO_BINDTODEVICE is None:
 
1436
                logger.error("SO_BINDTODEVICE does not exist;"
 
1437
                             " cannot bind to interface %s",
 
1438
                             self.interface)
 
1439
            else:
126
1440
                try:
127
1441
                    self.socket.setsockopt(socket.SOL_SOCKET,
128
 
                                           socket.SO_BINDTODEVICE,
129
 
                                           self.options.interface)
 
1442
                                           SO_BINDTODEVICE,
 
1443
                                           str(self.interface
 
1444
                                               + '\0'))
130
1445
                except socket.error, error:
131
1446
                    if error[0] == errno.EPERM:
132
 
                        print "Warning: No permission to bind to interface", \
133
 
                              self.options.interface
 
1447
                        logger.error("No permission to"
 
1448
                                     " bind to interface %s",
 
1449
                                     self.interface)
 
1450
                    elif error[0] == errno.ENOPROTOOPT:
 
1451
                        logger.error("SO_BINDTODEVICE not available;"
 
1452
                                     " cannot bind to interface %s",
 
1453
                                     self.interface)
134
1454
                    else:
135
 
                        raise error
136
 
            return super(type(self), self).server_bind()
137
 
        attrs["server_bind"] = server_bind
138
 
        def init(self, *args, **kwargs):
139
 
            if "options" in kwargs:
140
 
                self.options = kwargs["options"]
141
 
                del kwargs["options"]
142
 
            if "clients" in kwargs:
143
 
                self.clients = kwargs["clients"]
144
 
                del kwargs["clients"]
145
 
            if "credentials" in kwargs:
146
 
                self.credentials = kwargs["credentials"]
147
 
                del kwargs["credentials"]
148
 
            return super(type(self), self).__init__(*args, **kwargs)
149
 
        attrs["__init__"] = init
150
 
        return type.__new__(cls, name, bases, attrs)
151
 
 
152
 
 
153
 
class udp_handler(SocketServer.DatagramRequestHandler, object):
154
 
    def handle(self):
155
 
        self.wfile.write("Polo")
156
 
        print "UDP request answered"
157
 
 
158
 
 
159
 
class IPv6_UDPServer(SocketServer.UDPServer, object):
160
 
    __metaclass__ = server_metaclass
161
 
    def verify_request(self, request, client_address):
162
 
        print "UDP request came"
163
 
        return request[0] == "Marco"
164
 
 
165
 
 
166
 
class tcp_handler(SocketServer.BaseRequestHandler, object):
167
 
    def handle(self):
168
 
        print "TCP request came"
169
 
        print "Request:", self.request
170
 
        print "Client Address:", self.client_address
171
 
        print "Server:", self.server
172
 
        session = gnutls.connection.ServerSession(self.request,
173
 
                                                  self.server.credentials)
174
 
        session.handshake()
175
 
        if session.peer_certificate:
176
 
            print "DN:", session.peer_certificate.subject
177
 
        try:
178
 
            session.verify_peer()
179
 
        except gnutls.errors.CertificateError, error:
180
 
            print "Verify failed", error
181
 
            session.bye()
182
 
            return
183
 
        try:
184
 
            session.send([client.password
185
 
                          for client in self.server.clients
186
 
                          if (client.dn ==
187
 
                              session.peer_certificate.subject)][0])
188
 
        except IndexError:
189
 
            session.send("gazonk")
190
 
            # Log maybe? XXX
191
 
        session.bye()
192
 
 
193
 
 
194
 
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
195
 
    __metaclass__ = server_metaclass
 
1455
                        raise
 
1456
        # Only bind(2) the socket if we really need to.
 
1457
        if self.server_address[0] or self.server_address[1]:
 
1458
            if not self.server_address[0]:
 
1459
                if self.address_family == socket.AF_INET6:
 
1460
                    any_address = "::" # in6addr_any
 
1461
                else:
 
1462
                    any_address = socket.INADDR_ANY
 
1463
                self.server_address = (any_address,
 
1464
                                       self.server_address[1])
 
1465
            elif not self.server_address[1]:
 
1466
                self.server_address = (self.server_address[0],
 
1467
                                       0)
 
1468
#                 if self.interface:
 
1469
#                     self.server_address = (self.server_address[0],
 
1470
#                                            0, # port
 
1471
#                                            0, # flowinfo
 
1472
#                                            if_nametoindex
 
1473
#                                            (self.interface))
 
1474
            return socketserver.TCPServer.server_bind(self)
 
1475
 
 
1476
 
 
1477
class MandosServer(IPv6_TCPServer):
 
1478
    """Mandos server.
 
1479
    
 
1480
    Attributes:
 
1481
        clients:        set of Client objects
 
1482
        gnutls_priority GnuTLS priority string
 
1483
        use_dbus:       Boolean; to emit D-Bus signals or not
 
1484
    
 
1485
    Assumes a gobject.MainLoop event loop.
 
1486
    """
 
1487
    def __init__(self, server_address, RequestHandlerClass,
 
1488
                 interface=None, use_ipv6=True, clients=None,
 
1489
                 gnutls_priority=None, use_dbus=True):
 
1490
        self.enabled = False
 
1491
        self.clients = clients
 
1492
        if self.clients is None:
 
1493
            self.clients = set()
 
1494
        self.use_dbus = use_dbus
 
1495
        self.gnutls_priority = gnutls_priority
 
1496
        IPv6_TCPServer.__init__(self, server_address,
 
1497
                                RequestHandlerClass,
 
1498
                                interface = interface,
 
1499
                                use_ipv6 = use_ipv6)
 
1500
    def server_activate(self):
 
1501
        if self.enabled:
 
1502
            return socketserver.TCPServer.server_activate(self)
 
1503
    def enable(self):
 
1504
        self.enabled = True
 
1505
    def add_pipe(self, parent_pipe):
 
1506
        # Call "handle_ipc" for both data and EOF events
 
1507
        gobject.io_add_watch(parent_pipe.fileno(),
 
1508
                             gobject.IO_IN | gobject.IO_HUP,
 
1509
                             functools.partial(self.handle_ipc,
 
1510
                                               parent_pipe = parent_pipe))
 
1511
        
 
1512
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1513
                   client_object=None):
 
1514
        condition_names = {
 
1515
            gobject.IO_IN: "IN",   # There is data to read.
 
1516
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1517
                                    # blocking).
 
1518
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1519
            gobject.IO_ERR: "ERR", # Error condition.
 
1520
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1521
                                    # broken, usually for pipes and
 
1522
                                    # sockets).
 
1523
            }
 
1524
        conditions_string = ' | '.join(name
 
1525
                                       for cond, name in
 
1526
                                       condition_names.iteritems()
 
1527
                                       if cond & condition)
 
1528
        # error or the other end of multiprocessing.Pipe has closed
 
1529
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1530
            return False
 
1531
        
 
1532
        # Read a request from the child
 
1533
        request = parent_pipe.recv()
 
1534
        command = request[0]
 
1535
        
 
1536
        if command == 'init':
 
1537
            fpr = request[1]
 
1538
            address = request[2]
 
1539
            
 
1540
            for c in self.clients:
 
1541
                if c.fingerprint == fpr:
 
1542
                    client = c
 
1543
                    break
 
1544
            else:
 
1545
                logger.warning("Client not found for fingerprint: %s, ad"
 
1546
                               "dress: %s", fpr, address)
 
1547
                if self.use_dbus:
 
1548
                    # Emit D-Bus signal
 
1549
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
1550
                parent_pipe.send(False)
 
1551
                return False
 
1552
            
 
1553
            gobject.io_add_watch(parent_pipe.fileno(),
 
1554
                                 gobject.IO_IN | gobject.IO_HUP,
 
1555
                                 functools.partial(self.handle_ipc,
 
1556
                                                   parent_pipe = parent_pipe,
 
1557
                                                   client_object = client))
 
1558
            parent_pipe.send(True)
 
1559
            # remove the old hook in favor of the new above hook on same fileno
 
1560
            return False
 
1561
        if command == 'funcall':
 
1562
            funcname = request[1]
 
1563
            args = request[2]
 
1564
            kwargs = request[3]
 
1565
            
 
1566
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1567
 
 
1568
        if command == 'getattr':
 
1569
            attrname = request[1]
 
1570
            if callable(client_object.__getattribute__(attrname)):
 
1571
                parent_pipe.send(('function',))
 
1572
            else:
 
1573
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
1574
        
 
1575
        if command == 'setattr':
 
1576
            attrname = request[1]
 
1577
            value = request[2]
 
1578
            setattr(client_object, attrname, value)
 
1579
 
 
1580
        return True
196
1581
 
197
1582
 
198
1583
def string_to_delta(interval):
199
1584
    """Parse a string and return a datetime.timedelta
200
 
 
 
1585
    
201
1586
    >>> string_to_delta('7d')
202
1587
    datetime.timedelta(7)
203
1588
    >>> string_to_delta('60s')
206
1591
    datetime.timedelta(0, 3600)
207
1592
    >>> string_to_delta('24h')
208
1593
    datetime.timedelta(1)
209
 
    >>> string_to_delta(u'1w')
 
1594
    >>> string_to_delta('1w')
210
1595
    datetime.timedelta(7)
 
1596
    >>> string_to_delta('5m 30s')
 
1597
    datetime.timedelta(0, 330)
211
1598
    """
 
1599
    timevalue = datetime.timedelta(0)
 
1600
    for s in interval.split():
 
1601
        try:
 
1602
            suffix = unicode(s[-1])
 
1603
            value = int(s[:-1])
 
1604
            if suffix == "d":
 
1605
                delta = datetime.timedelta(value)
 
1606
            elif suffix == "s":
 
1607
                delta = datetime.timedelta(0, value)
 
1608
            elif suffix == "m":
 
1609
                delta = datetime.timedelta(0, 0, 0, 0, value)
 
1610
            elif suffix == "h":
 
1611
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
 
1612
            elif suffix == "w":
 
1613
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
 
1614
            else:
 
1615
                raise ValueError("Unknown suffix %r" % suffix)
 
1616
        except (ValueError, IndexError), e:
 
1617
            raise ValueError(*(e.args))
 
1618
        timevalue += delta
 
1619
    return timevalue
 
1620
 
 
1621
 
 
1622
def if_nametoindex(interface):
 
1623
    """Call the C function if_nametoindex(), or equivalent
 
1624
    
 
1625
    Note: This function cannot accept a unicode string."""
 
1626
    global if_nametoindex
212
1627
    try:
213
 
        suffix=unicode(interval[-1])
214
 
        value=int(interval[:-1])
215
 
        if suffix == u"d":
216
 
            delta = datetime.timedelta(value)
217
 
        elif suffix == u"s":
218
 
            delta = datetime.timedelta(0, value)
219
 
        elif suffix == u"m":
220
 
            delta = datetime.timedelta(0, 0, 0, 0, value)
221
 
        elif suffix == u"h":
222
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
223
 
        elif suffix == u"w":
224
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
225
 
        else:
226
 
            raise ValueError
227
 
    except (ValueError, IndexError):
228
 
        raise ValueError
229
 
    return delta
 
1628
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1629
                          (ctypes.util.find_library("c"))
 
1630
                          .if_nametoindex)
 
1631
    except (OSError, AttributeError):
 
1632
        logger.warning("Doing if_nametoindex the hard way")
 
1633
        def if_nametoindex(interface):
 
1634
            "Get an interface index the hard way, i.e. using fcntl()"
 
1635
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
1636
            with contextlib.closing(socket.socket()) as s:
 
1637
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1638
                                    struct.pack(str("16s16x"),
 
1639
                                                interface))
 
1640
            interface_index = struct.unpack(str("I"),
 
1641
                                            ifreq[16:20])[0]
 
1642
            return interface_index
 
1643
    return if_nametoindex(interface)
 
1644
 
 
1645
 
 
1646
def daemon(nochdir = False, noclose = False):
 
1647
    """See daemon(3).  Standard BSD Unix function.
 
1648
    
 
1649
    This should really exist as os.daemon, but it doesn't (yet)."""
 
1650
    if os.fork():
 
1651
        sys.exit()
 
1652
    os.setsid()
 
1653
    if not nochdir:
 
1654
        os.chdir("/")
 
1655
    if os.fork():
 
1656
        sys.exit()
 
1657
    if not noclose:
 
1658
        # Close all standard open file descriptors
 
1659
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1660
        if not stat.S_ISCHR(os.fstat(null).st_mode):
 
1661
            raise OSError(errno.ENODEV,
 
1662
                          "%s not a character device"
 
1663
                          % os.path.devnull)
 
1664
        os.dup2(null, sys.stdin.fileno())
 
1665
        os.dup2(null, sys.stdout.fileno())
 
1666
        os.dup2(null, sys.stderr.fileno())
 
1667
        if null > 2:
 
1668
            os.close(null)
230
1669
 
231
1670
 
232
1671
def main():
233
 
    parser = OptionParser()
 
1672
    
 
1673
    ##################################################################
 
1674
    # Parsing of options, both command line and config file
 
1675
    
 
1676
    parser = optparse.OptionParser(version = "%%prog %s" % version)
234
1677
    parser.add_option("-i", "--interface", type="string",
235
 
                      default="eth0", metavar="IF",
236
 
                      help="Interface to bind to")
237
 
    parser.add_option("--cert", type="string", default="cert.pem",
238
 
                      metavar="FILE",
239
 
                      help="Public key certificate to use")
240
 
    parser.add_option("--key", type="string", default="key.pem",
241
 
                      metavar="FILE",
242
 
                      help="Private key to use")
243
 
    parser.add_option("--ca", type="string", default="ca.pem",
244
 
                      metavar="FILE",
245
 
                      help="Certificate Authority certificate to use")
246
 
    parser.add_option("--crl", type="string", default="crl.pem",
247
 
                      metavar="FILE",
248
 
                      help="Certificate Revokation List to use")
249
 
    parser.add_option("-p", "--port", type="int", default=49001,
 
1678
                      metavar="IF", help="Bind to interface IF")
 
1679
    parser.add_option("-a", "--address", type="string",
 
1680
                      help="Address to listen for requests on")
 
1681
    parser.add_option("-p", "--port", type="int",
250
1682
                      help="Port number to receive requests on")
251
 
    parser.add_option("--dh", type="int", metavar="BITS",
252
 
                      help="DH group to use")
253
 
    parser.add_option("-t", "--timeout", type="string", # Parsed later
254
 
                      default="15m",
255
 
                      help="Amount of downtime allowed for clients")
256
 
    parser.add_option("--interval", type="string", # Parsed later
257
 
                      default="5m",
258
 
                      help="How often to check that a client is up")
259
 
    parser.add_option("--check", action="store_true", default=False,
 
1683
    parser.add_option("--check", action="store_true",
260
1684
                      help="Run self-test")
261
 
    (options, args) = parser.parse_args()
262
 
 
 
1685
    parser.add_option("--debug", action="store_true",
 
1686
                      help="Debug mode; run in foreground and log to"
 
1687
                      " terminal")
 
1688
    parser.add_option("--debuglevel", type="string", metavar="LEVEL",
 
1689
                      help="Debug level for stdout output")
 
1690
    parser.add_option("--priority", type="string", help="GnuTLS"
 
1691
                      " priority string (see GnuTLS documentation)")
 
1692
    parser.add_option("--servicename", type="string",
 
1693
                      metavar="NAME", help="Zeroconf service name")
 
1694
    parser.add_option("--configdir", type="string",
 
1695
                      default="/etc/mandos", metavar="DIR",
 
1696
                      help="Directory to search for configuration"
 
1697
                      " files")
 
1698
    parser.add_option("--no-dbus", action="store_false",
 
1699
                      dest="use_dbus", help="Do not provide D-Bus"
 
1700
                      " system bus interface")
 
1701
    parser.add_option("--no-ipv6", action="store_false",
 
1702
                      dest="use_ipv6", help="Do not use IPv6")
 
1703
    options = parser.parse_args()[0]
 
1704
    
263
1705
    if options.check:
264
1706
        import doctest
265
1707
        doctest.testmod()
266
1708
        sys.exit()
267
1709
    
268
 
    # Parse the time arguments
269
 
    try:
270
 
        options.timeout = string_to_delta(options.timeout)
271
 
    except ValueError:
272
 
        parser.error("option --timeout: Unparseable time")
273
 
    
274
 
    try:
275
 
        options.interval = string_to_delta(options.interval)
276
 
    except ValueError:
277
 
        parser.error("option --interval: Unparseable time")
278
 
    
279
 
    cert = gnutls.crypto.X509Certificate(open(options.cert).read())
280
 
    key = gnutls.crypto.X509PrivateKey(open(options.key).read())
281
 
    ca = gnutls.crypto.X509Certificate(open(options.ca).read())
282
 
    crl = gnutls.crypto.X509CRL(open(options.crl).read())
283
 
    cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl])
284
 
    
285
 
    # Parse config file
286
 
    defaults = {}
287
 
    client_config_object = ConfigParser.SafeConfigParser(defaults)
288
 
    client_config_object.read("mandos-clients.conf")
289
 
    clients = Set(Client(name=section, options=options,
290
 
                         **(dict(client_config_object\
291
 
                                 .items(section))))
292
 
                  for section in client_config_object.sections())
293
 
    
294
 
    in6addr_any = "::"
295
 
    udp_server = IPv6_UDPServer((in6addr_any, options.port),
296
 
                                udp_handler,
297
 
                                options=options)
298
 
    
299
 
    tcp_server = IPv6_TCPServer((in6addr_any, options.port),
300
 
                                tcp_handler,
301
 
                                options=options,
302
 
                                clients=clients,
303
 
                                credentials=cred)
304
 
    
305
 
    while True:
306
 
        if not clients:
307
 
            break
308
 
        try:
309
 
            next_stop = min(client.next_stop() for client in clients)
310
 
            now = datetime.datetime.now()
311
 
            if next_stop > now:
312
 
                delay = next_stop - now
313
 
                delay_seconds = (delay.days * 24 * 60 * 60
314
 
                                 + delay.seconds
315
 
                                 + delay.microseconds / 1000000)
316
 
                clients_with_checkers = tuple(client for client in
317
 
                                              clients
318
 
                                              if client.checker
319
 
                                              is not None)
320
 
                input_checks = (udp_server, tcp_server) \
321
 
                               + clients_with_checkers
322
 
                print "Waiting for network",
323
 
                if clients_with_checkers:
324
 
                    print "and checkers for:",
325
 
                    for client in clients_with_checkers:
326
 
                        print client.name,
327
 
                print
328
 
                input, out, err = select.select(input_checks, (), (),
329
 
                                                delay_seconds)
330
 
                for obj in input:
331
 
                    obj.handle_request()
332
 
            # start new checkers
333
 
            for client in clients:
334
 
                if client.it_is_time_to_check(now=now) and \
335
 
                       client.checker is None:
336
 
                    print "Starting checker for client %(name)s" \
337
 
                          % vars(client)
338
 
                    client.start_checker()
339
 
            # delete timed-out clients
340
 
            for client in clients.copy():
341
 
                if not client.still_valid(now=now):
342
 
                    # log xxx
343
 
                    print "Removing client %(name)s" % vars(client)
344
 
                    clients.remove(client)
345
 
        except KeyboardInterrupt:
346
 
            break
347
 
    
348
 
    # Cleanup here
349
 
    for client in clients:
350
 
        client.stop_checker()
351
 
 
352
 
 
353
 
if __name__ == "__main__":
 
1710
    # Default values for config file for server-global settings
 
1711
    server_defaults = { "interface": "",
 
1712
                        "address": "",
 
1713
                        "port": "",
 
1714
                        "debug": "False",
 
1715
                        "priority":
 
1716
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1717
                        "servicename": "Mandos",
 
1718
                        "use_dbus": "True",
 
1719
                        "use_ipv6": "True",
 
1720
                        "debuglevel": "",
 
1721
                        }
 
1722
    
 
1723
    # Parse config file for server-global settings
 
1724
    server_config = configparser.SafeConfigParser(server_defaults)
 
1725
    del server_defaults
 
1726
    server_config.read(os.path.join(options.configdir,
 
1727
                                    "mandos.conf"))
 
1728
    # Convert the SafeConfigParser object to a dict
 
1729
    server_settings = server_config.defaults()
 
1730
    # Use the appropriate methods on the non-string config options
 
1731
    for option in ("debug", "use_dbus", "use_ipv6"):
 
1732
        server_settings[option] = server_config.getboolean("DEFAULT",
 
1733
                                                           option)
 
1734
    if server_settings["port"]:
 
1735
        server_settings["port"] = server_config.getint("DEFAULT",
 
1736
                                                       "port")
 
1737
    del server_config
 
1738
    
 
1739
    # Override the settings from the config file with command line
 
1740
    # options, if set.
 
1741
    for option in ("interface", "address", "port", "debug",
 
1742
                   "priority", "servicename", "configdir",
 
1743
                   "use_dbus", "use_ipv6", "debuglevel"):
 
1744
        value = getattr(options, option)
 
1745
        if value is not None:
 
1746
            server_settings[option] = value
 
1747
    del options
 
1748
    # Force all strings to be unicode
 
1749
    for option in server_settings.keys():
 
1750
        if type(server_settings[option]) is str:
 
1751
            server_settings[option] = unicode(server_settings[option])
 
1752
    # Now we have our good server settings in "server_settings"
 
1753
    
 
1754
    ##################################################################
 
1755
    
 
1756
    # For convenience
 
1757
    debug = server_settings["debug"]
 
1758
    debuglevel = server_settings["debuglevel"]
 
1759
    use_dbus = server_settings["use_dbus"]
 
1760
    use_ipv6 = server_settings["use_ipv6"]
 
1761
 
 
1762
    if server_settings["servicename"] != "Mandos":
 
1763
        syslogger.setFormatter(logging.Formatter
 
1764
                               ('Mandos (%s) [%%(process)d]:'
 
1765
                                ' %%(levelname)s: %%(message)s'
 
1766
                                % server_settings["servicename"]))
 
1767
    
 
1768
    # Parse config file with clients
 
1769
    client_defaults = { "timeout": "1h",
 
1770
                        "interval": "5m",
 
1771
                        "checker": "fping -q -- %%(host)s",
 
1772
                        "host": "",
 
1773
                        "approval_delay": "0s",
 
1774
                        "approval_duration": "1s",
 
1775
                        }
 
1776
    client_config = configparser.SafeConfigParser(client_defaults)
 
1777
    client_config.read(os.path.join(server_settings["configdir"],
 
1778
                                    "clients.conf"))
 
1779
    
 
1780
    global mandos_dbus_service
 
1781
    mandos_dbus_service = None
 
1782
    
 
1783
    tcp_server = MandosServer((server_settings["address"],
 
1784
                               server_settings["port"]),
 
1785
                              ClientHandler,
 
1786
                              interface=(server_settings["interface"]
 
1787
                                         or None),
 
1788
                              use_ipv6=use_ipv6,
 
1789
                              gnutls_priority=
 
1790
                              server_settings["priority"],
 
1791
                              use_dbus=use_dbus)
 
1792
    if not debug:
 
1793
        pidfilename = "/var/run/mandos.pid"
 
1794
        try:
 
1795
            pidfile = open(pidfilename, "w")
 
1796
        except IOError:
 
1797
            logger.error("Could not open file %r", pidfilename)
 
1798
    
 
1799
    try:
 
1800
        uid = pwd.getpwnam("_mandos").pw_uid
 
1801
        gid = pwd.getpwnam("_mandos").pw_gid
 
1802
    except KeyError:
 
1803
        try:
 
1804
            uid = pwd.getpwnam("mandos").pw_uid
 
1805
            gid = pwd.getpwnam("mandos").pw_gid
 
1806
        except KeyError:
 
1807
            try:
 
1808
                uid = pwd.getpwnam("nobody").pw_uid
 
1809
                gid = pwd.getpwnam("nobody").pw_gid
 
1810
            except KeyError:
 
1811
                uid = 65534
 
1812
                gid = 65534
 
1813
    try:
 
1814
        os.setgid(gid)
 
1815
        os.setuid(uid)
 
1816
    except OSError, error:
 
1817
        if error[0] != errno.EPERM:
 
1818
            raise error
 
1819
    
 
1820
    if not debug and not debuglevel:
 
1821
        syslogger.setLevel(logging.WARNING)
 
1822
        console.setLevel(logging.WARNING)
 
1823
    if debuglevel:
 
1824
        level = getattr(logging, debuglevel.upper())
 
1825
        syslogger.setLevel(level)
 
1826
        console.setLevel(level)
 
1827
 
 
1828
    if debug:
 
1829
        # Enable all possible GnuTLS debugging
 
1830
        
 
1831
        # "Use a log level over 10 to enable all debugging options."
 
1832
        # - GnuTLS manual
 
1833
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
1834
        
 
1835
        @gnutls.library.types.gnutls_log_func
 
1836
        def debug_gnutls(level, string):
 
1837
            logger.debug("GnuTLS: %s", string[:-1])
 
1838
        
 
1839
        (gnutls.library.functions
 
1840
         .gnutls_global_set_log_function(debug_gnutls))
 
1841
        
 
1842
        # Redirect stdin so all checkers get /dev/null
 
1843
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1844
        os.dup2(null, sys.stdin.fileno())
 
1845
        if null > 2:
 
1846
            os.close(null)
 
1847
    else:
 
1848
        # No console logging
 
1849
        logger.removeHandler(console)
 
1850
    
 
1851
    # Need to fork before connecting to D-Bus
 
1852
    if not debug:
 
1853
        # Close all input and output, do double fork, etc.
 
1854
        daemon()
 
1855
    
 
1856
    global main_loop
 
1857
    # From the Avahi example code
 
1858
    DBusGMainLoop(set_as_default=True )
 
1859
    main_loop = gobject.MainLoop()
 
1860
    bus = dbus.SystemBus()
 
1861
    # End of Avahi example code
 
1862
    if use_dbus:
 
1863
        try:
 
1864
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
 
1865
                                            bus, do_not_queue=True)
 
1866
        except dbus.exceptions.NameExistsException, e:
 
1867
            logger.error(unicode(e) + ", disabling D-Bus")
 
1868
            use_dbus = False
 
1869
            server_settings["use_dbus"] = False
 
1870
            tcp_server.use_dbus = False
 
1871
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
1872
    service = AvahiService(name = server_settings["servicename"],
 
1873
                           servicetype = "_mandos._tcp",
 
1874
                           protocol = protocol, bus = bus)
 
1875
    if server_settings["interface"]:
 
1876
        service.interface = (if_nametoindex
 
1877
                             (str(server_settings["interface"])))
 
1878
    
 
1879
    global multiprocessing_manager
 
1880
    multiprocessing_manager = multiprocessing.Manager()
 
1881
    
 
1882
    client_class = Client
 
1883
    if use_dbus:
 
1884
        client_class = functools.partial(ClientDBus, bus = bus)
 
1885
    def client_config_items(config, section):
 
1886
        special_settings = {
 
1887
            "approved_by_default":
 
1888
                lambda: config.getboolean(section,
 
1889
                                          "approved_by_default"),
 
1890
            }
 
1891
        for name, value in config.items(section):
 
1892
            try:
 
1893
                yield (name, special_settings[name]())
 
1894
            except KeyError:
 
1895
                yield (name, value)
 
1896
    
 
1897
    tcp_server.clients.update(set(
 
1898
            client_class(name = section,
 
1899
                         config= dict(client_config_items(
 
1900
                        client_config, section)))
 
1901
            for section in client_config.sections()))
 
1902
    if not tcp_server.clients:
 
1903
        logger.warning("No clients defined")
 
1904
        
 
1905
    if not debug:
 
1906
        try:
 
1907
            with pidfile:
 
1908
                pid = os.getpid()
 
1909
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
1910
            del pidfile
 
1911
        except IOError:
 
1912
            logger.error("Could not write to file %r with PID %d",
 
1913
                         pidfilename, pid)
 
1914
        except NameError:
 
1915
            # "pidfile" was never created
 
1916
            pass
 
1917
        del pidfilename
 
1918
        
 
1919
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
1920
 
 
1921
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
 
1922
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
 
1923
    
 
1924
    if use_dbus:
 
1925
        class MandosDBusService(dbus.service.Object):
 
1926
            """A D-Bus proxy object"""
 
1927
            def __init__(self):
 
1928
                dbus.service.Object.__init__(self, bus, "/")
 
1929
            _interface = "se.bsnet.fukt.Mandos"
 
1930
            
 
1931
            @dbus.service.signal(_interface, signature="o")
 
1932
            def ClientAdded(self, objpath):
 
1933
                "D-Bus signal"
 
1934
                pass
 
1935
            
 
1936
            @dbus.service.signal(_interface, signature="ss")
 
1937
            def ClientNotFound(self, fingerprint, address):
 
1938
                "D-Bus signal"
 
1939
                pass
 
1940
            
 
1941
            @dbus.service.signal(_interface, signature="os")
 
1942
            def ClientRemoved(self, objpath, name):
 
1943
                "D-Bus signal"
 
1944
                pass
 
1945
            
 
1946
            @dbus.service.method(_interface, out_signature="ao")
 
1947
            def GetAllClients(self):
 
1948
                "D-Bus method"
 
1949
                return dbus.Array(c.dbus_object_path
 
1950
                                  for c in tcp_server.clients)
 
1951
            
 
1952
            @dbus.service.method(_interface,
 
1953
                                 out_signature="a{oa{sv}}")
 
1954
            def GetAllClientsWithProperties(self):
 
1955
                "D-Bus method"
 
1956
                return dbus.Dictionary(
 
1957
                    ((c.dbus_object_path, c.GetAll(""))
 
1958
                     for c in tcp_server.clients),
 
1959
                    signature="oa{sv}")
 
1960
            
 
1961
            @dbus.service.method(_interface, in_signature="o")
 
1962
            def RemoveClient(self, object_path):
 
1963
                "D-Bus method"
 
1964
                for c in tcp_server.clients:
 
1965
                    if c.dbus_object_path == object_path:
 
1966
                        tcp_server.clients.remove(c)
 
1967
                        c.remove_from_connection()
 
1968
                        # Don't signal anything except ClientRemoved
 
1969
                        c.disable(quiet=True)
 
1970
                        # Emit D-Bus signal
 
1971
                        self.ClientRemoved(object_path, c.name)
 
1972
                        return
 
1973
                raise KeyError(object_path)
 
1974
            
 
1975
            del _interface
 
1976
        
 
1977
        mandos_dbus_service = MandosDBusService()
 
1978
    
 
1979
    def cleanup():
 
1980
        "Cleanup function; run on exit"
 
1981
        service.cleanup()
 
1982
        
 
1983
        while tcp_server.clients:
 
1984
            client = tcp_server.clients.pop()
 
1985
            if use_dbus:
 
1986
                client.remove_from_connection()
 
1987
            client.disable_hook = None
 
1988
            # Don't signal anything except ClientRemoved
 
1989
            client.disable(quiet=True)
 
1990
            if use_dbus:
 
1991
                # Emit D-Bus signal
 
1992
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
1993
                                                  client.name)
 
1994
    
 
1995
    atexit.register(cleanup)
 
1996
    
 
1997
    for client in tcp_server.clients:
 
1998
        if use_dbus:
 
1999
            # Emit D-Bus signal
 
2000
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
2001
        client.enable()
 
2002
    
 
2003
    tcp_server.enable()
 
2004
    tcp_server.server_activate()
 
2005
    
 
2006
    # Find out what port we got
 
2007
    service.port = tcp_server.socket.getsockname()[1]
 
2008
    if use_ipv6:
 
2009
        logger.info("Now listening on address %r, port %d,"
 
2010
                    " flowinfo %d, scope_id %d"
 
2011
                    % tcp_server.socket.getsockname())
 
2012
    else:                       # IPv4
 
2013
        logger.info("Now listening on address %r, port %d"
 
2014
                    % tcp_server.socket.getsockname())
 
2015
    
 
2016
    #service.interface = tcp_server.socket.getsockname()[3]
 
2017
    
 
2018
    try:
 
2019
        # From the Avahi example code
 
2020
        try:
 
2021
            service.activate()
 
2022
        except dbus.exceptions.DBusException, error:
 
2023
            logger.critical("DBusException: %s", error)
 
2024
            cleanup()
 
2025
            sys.exit(1)
 
2026
        # End of Avahi example code
 
2027
        
 
2028
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
 
2029
                             lambda *args, **kwargs:
 
2030
                             (tcp_server.handle_request
 
2031
                              (*args[2:], **kwargs) or True))
 
2032
        
 
2033
        logger.debug("Starting main loop")
 
2034
        main_loop.run()
 
2035
    except AvahiError, error:
 
2036
        logger.critical("AvahiError: %s", error)
 
2037
        cleanup()
 
2038
        sys.exit(1)
 
2039
    except KeyboardInterrupt:
 
2040
        if debug:
 
2041
            print("", file=sys.stderr)
 
2042
        logger.debug("Server received KeyboardInterrupt")
 
2043
    logger.debug("Server exiting")
 
2044
    # Must run before the D-Bus bus name gets deregistered
 
2045
    cleanup()
 
2046
 
 
2047
if __name__ == '__main__':
354
2048
    main()
355