/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

half working on-demand password and approved code

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# methods "add" and "remove" in the "AvahiService" class, the
10
 
# "server_state_changed" and "entry_group_state_changed" functions,
11
 
# and some lines in "main".
 
9
# methods "add", "remove", "server_state_changed",
 
10
# "entry_group_state_changed", "cleanup", and "activate" in the
 
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
 
14
# Copyright © 2008,2009 Teddy Hogeborn
 
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
# 
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
# 
32
33
 
33
 
from __future__ import division
 
34
from __future__ import division, with_statement, absolute_import
34
35
 
35
 
import SocketServer
 
36
import SocketServer as socketserver
36
37
import socket
37
 
from optparse import OptionParser
 
38
import optparse
38
39
import datetime
39
40
import errno
40
41
import gnutls.crypto
43
44
import gnutls.library.functions
44
45
import gnutls.library.constants
45
46
import gnutls.library.types
46
 
import ConfigParser
 
47
import ConfigParser as configparser
47
48
import sys
48
49
import re
49
50
import os
50
51
import signal
51
 
from sets import Set
52
52
import subprocess
53
53
import atexit
54
54
import stat
55
55
import logging
56
56
import logging.handlers
57
57
import pwd
 
58
import contextlib
 
59
import struct
 
60
import fcntl
 
61
import functools
 
62
import cPickle as pickle
58
63
 
59
64
import dbus
 
65
import dbus.service
60
66
import gobject
61
67
import avahi
62
68
from dbus.mainloop.glib import DBusGMainLoop
63
69
import ctypes
64
70
import ctypes.util
65
 
 
66
 
version = "1.0"
67
 
 
68
 
logger = logging.Logger('mandos')
69
 
syslogger = logging.handlers.SysLogHandler\
70
 
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
 
             address = "/dev/log")
72
 
syslogger.setFormatter(logging.Formatter\
73
 
                        ('Mandos: %(levelname)s: %(message)s'))
 
71
import xml.dom.minidom
 
72
import inspect
 
73
 
 
74
try:
 
75
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
 
76
except AttributeError:
 
77
    try:
 
78
        from IN import SO_BINDTODEVICE
 
79
    except ImportError:
 
80
        SO_BINDTODEVICE = None
 
81
 
 
82
 
 
83
version = "1.0.14"
 
84
 
 
85
logger = logging.Logger(u'mandos')
 
86
syslogger = (logging.handlers.SysLogHandler
 
87
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
88
              address = "/dev/log"))
 
89
syslogger.setFormatter(logging.Formatter
 
90
                       (u'Mandos [%(process)d]: %(levelname)s:'
 
91
                        u' %(message)s'))
74
92
logger.addHandler(syslogger)
75
93
 
76
94
console = logging.StreamHandler()
77
 
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
 
                                       ' %(message)s'))
 
95
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
 
96
                                       u' %(levelname)s:'
 
97
                                       u' %(message)s'))
79
98
logger.addHandler(console)
80
99
 
81
100
class AvahiError(Exception):
82
 
    def __init__(self, value):
 
101
    def __init__(self, value, *args, **kwargs):
83
102
        self.value = value
84
 
        super(AvahiError, self).__init__()
85
 
    def __str__(self):
86
 
        return repr(self.value)
 
103
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
104
    def __unicode__(self):
 
105
        return unicode(repr(self.value))
87
106
 
88
107
class AvahiServiceError(AvahiError):
89
108
    pass
94
113
 
95
114
class AvahiService(object):
96
115
    """An Avahi (Zeroconf) service.
 
116
    
97
117
    Attributes:
98
118
    interface: integer; avahi.IF_UNSPEC or an interface index.
99
119
               Used to optionally bind to the specified interface.
100
 
    name: string; Example: 'Mandos'
101
 
    type: string; Example: '_mandos._tcp'.
 
120
    name: string; Example: u'Mandos'
 
121
    type: string; Example: u'_mandos._tcp'.
102
122
                  See <http://www.dns-sd.org/ServiceTypes.html>
103
123
    port: integer; what port to announce
104
124
    TXT: list of strings; TXT record for the service
107
127
    max_renames: integer; maximum number of renames
108
128
    rename_count: integer; counter so we only rename after collisions
109
129
                  a sensible number of times
 
130
    group: D-Bus Entry Group
 
131
    server: D-Bus Server
 
132
    bus: dbus.SystemBus()
110
133
    """
111
134
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
112
 
                 servicetype = None, port = None, TXT = None, domain = "",
113
 
                 host = "", max_renames = 32768):
 
135
                 servicetype = None, port = None, TXT = None,
 
136
                 domain = u"", host = u"", max_renames = 32768,
 
137
                 protocol = avahi.PROTO_UNSPEC, bus = None):
114
138
        self.interface = interface
115
139
        self.name = name
116
140
        self.type = servicetype
117
141
        self.port = port
118
 
        if TXT is None:
119
 
            self.TXT = []
120
 
        else:
121
 
            self.TXT = TXT
 
142
        self.TXT = TXT if TXT is not None else []
122
143
        self.domain = domain
123
144
        self.host = host
124
145
        self.rename_count = 0
125
146
        self.max_renames = max_renames
 
147
        self.protocol = protocol
 
148
        self.group = None       # our entry group
 
149
        self.server = None
 
150
        self.bus = bus
126
151
    def rename(self):
127
152
        """Derived from the Avahi example code"""
128
153
        if self.rename_count >= self.max_renames:
129
154
            logger.critical(u"No suitable Zeroconf service name found"
130
155
                            u" after %i retries, exiting.",
131
156
                            self.rename_count)
132
 
            raise AvahiServiceError("Too many renames")
133
 
        self.name = server.GetAlternativeServiceName(self.name)
 
157
            raise AvahiServiceError(u"Too many renames")
 
158
        self.name = self.server.GetAlternativeServiceName(self.name)
134
159
        logger.info(u"Changing Zeroconf service name to %r ...",
135
 
                    str(self.name))
136
 
        syslogger.setFormatter(logging.Formatter\
137
 
                               ('Mandos (%s): %%(levelname)s:'
138
 
                               ' %%(message)s' % self.name))
 
160
                    unicode(self.name))
 
161
        syslogger.setFormatter(logging.Formatter
 
162
                               (u'Mandos (%s) [%%(process)d]:'
 
163
                                u' %%(levelname)s: %%(message)s'
 
164
                                % self.name))
139
165
        self.remove()
140
166
        self.add()
141
167
        self.rename_count += 1
142
168
    def remove(self):
143
169
        """Derived from the Avahi example code"""
144
 
        if group is not None:
145
 
            group.Reset()
 
170
        if self.group is not None:
 
171
            self.group.Reset()
146
172
    def add(self):
147
173
        """Derived from the Avahi example code"""
148
 
        global group
149
 
        if group is None:
150
 
            group = dbus.Interface\
151
 
                    (bus.get_object(avahi.DBUS_NAME,
152
 
                                    server.EntryGroupNew()),
153
 
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
 
            group.connect_to_signal('StateChanged',
155
 
                                    entry_group_state_changed)
 
174
        if self.group is None:
 
175
            self.group = dbus.Interface(
 
176
                self.bus.get_object(avahi.DBUS_NAME,
 
177
                                    self.server.EntryGroupNew()),
 
178
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
179
            self.group.connect_to_signal('StateChanged',
 
180
                                         self
 
181
                                         .entry_group_state_changed)
156
182
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
157
 
                     service.name, service.type)
158
 
        group.AddService(
159
 
                self.interface,         # interface
160
 
                avahi.PROTO_INET6,      # protocol
161
 
                dbus.UInt32(0),         # flags
162
 
                self.name, self.type,
163
 
                self.domain, self.host,
164
 
                dbus.UInt16(self.port),
165
 
                avahi.string_array_to_txt_array(self.TXT))
166
 
        group.Commit()
167
 
 
168
 
# From the Avahi example code:
169
 
group = None                            # our entry group
170
 
# End of Avahi example code
 
183
                     self.name, self.type)
 
184
        self.group.AddService(
 
185
            self.interface,
 
186
            self.protocol,
 
187
            dbus.UInt32(0),     # flags
 
188
            self.name, self.type,
 
189
            self.domain, self.host,
 
190
            dbus.UInt16(self.port),
 
191
            avahi.string_array_to_txt_array(self.TXT))
 
192
        self.group.Commit()
 
193
    def entry_group_state_changed(self, state, error):
 
194
        """Derived from the Avahi example code"""
 
195
        logger.debug(u"Avahi state change: %i", state)
 
196
        
 
197
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
198
            logger.debug(u"Zeroconf service established.")
 
199
        elif state == avahi.ENTRY_GROUP_COLLISION:
 
200
            logger.warning(u"Zeroconf service name collision.")
 
201
            self.rename()
 
202
        elif state == avahi.ENTRY_GROUP_FAILURE:
 
203
            logger.critical(u"Avahi: Error in group state changed %s",
 
204
                            unicode(error))
 
205
            raise AvahiGroupError(u"State changed: %s"
 
206
                                  % unicode(error))
 
207
    def cleanup(self):
 
208
        """Derived from the Avahi example code"""
 
209
        if self.group is not None:
 
210
            self.group.Free()
 
211
            self.group = None
 
212
    def server_state_changed(self, state):
 
213
        """Derived from the Avahi example code"""
 
214
        if state == avahi.SERVER_COLLISION:
 
215
            logger.error(u"Zeroconf server name collision")
 
216
            self.remove()
 
217
        elif state == avahi.SERVER_RUNNING:
 
218
            self.add()
 
219
    def activate(self):
 
220
        """Derived from the Avahi example code"""
 
221
        if self.server is None:
 
222
            self.server = dbus.Interface(
 
223
                self.bus.get_object(avahi.DBUS_NAME,
 
224
                                    avahi.DBUS_PATH_SERVER),
 
225
                avahi.DBUS_INTERFACE_SERVER)
 
226
        self.server.connect_to_signal(u"StateChanged",
 
227
                                 self.server_state_changed)
 
228
        self.server_state_changed(self.server.GetState())
171
229
 
172
230
 
173
231
class Client(object):
174
232
    """A representation of a client host served by this server.
 
233
    
175
234
    Attributes:
176
 
    name:      string; from the config file, used in log messages
 
235
    name:       string; from the config file, used in log messages and
 
236
                        D-Bus identifiers
177
237
    fingerprint: string (40 or 32 hexadecimal digits); used to
178
238
                 uniquely identify the client
179
 
    secret:    bytestring; sent verbatim (over TLS) to client
180
 
    host:      string; available for use by the checker command
181
 
    created:   datetime.datetime(); object creation, not client host
182
 
    last_checked_ok: datetime.datetime() or None if not yet checked OK
183
 
    timeout:   datetime.timedelta(); How long from last_checked_ok
184
 
                                     until this client is invalid
185
 
    interval:  datetime.timedelta(); How often to start a new checker
186
 
    stop_hook: If set, called by stop() as stop_hook(self)
187
 
    checker:   subprocess.Popen(); a running checker process used
188
 
                                   to see if the client lives.
189
 
                                   'None' if no process is running.
 
239
    secret:     bytestring; sent verbatim (over TLS) to client
 
240
    host:       string; available for use by the checker command
 
241
    created:    datetime.datetime(); (UTC) object creation
 
242
    last_enabled: datetime.datetime(); (UTC)
 
243
    enabled:    bool()
 
244
    last_checked_ok: datetime.datetime(); (UTC) or None
 
245
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
246
                                      until this client is disabled
 
247
    interval:   datetime.timedelta(); How often to start a new checker
 
248
    disable_hook:  If set, called by disable() as disable_hook(self)
 
249
    checker:    subprocess.Popen(); a running checker process used
 
250
                                    to see if the client lives.
 
251
                                    'None' if no process is running.
190
252
    checker_initiator_tag: a gobject event source tag, or None
191
 
    stop_initiator_tag:    - '' -
 
253
    disable_initiator_tag: - '' -
192
254
    checker_callback_tag:  - '' -
193
255
    checker_command: string; External command which is run to check if
194
256
                     client lives.  %() expansions are done at
195
257
                     runtime with vars(self) as dict, so that for
196
258
                     instance %(name)s can be used in the command.
197
 
    Private attibutes:
198
 
    _timeout: Real variable for 'timeout'
199
 
    _interval: Real variable for 'interval'
200
 
    _timeout_milliseconds: Used when calling gobject.timeout_add()
201
 
    _interval_milliseconds: - '' -
 
259
    current_checker_command: string; current running checker_command
 
260
    changesignal: File descriptor; written to on object change
 
261
    _reset: File descriptor; for flushing changesignal
 
262
    delay: datetime.timedelta(); how long to wait for approval/secret
 
263
    approved: bool(); None if not yet approved/disapproved
202
264
    """
203
 
    def _set_timeout(self, timeout):
204
 
        "Setter function for 'timeout' attribute"
205
 
        self._timeout = timeout
206
 
        self._timeout_milliseconds = ((self.timeout.days
207
 
                                       * 24 * 60 * 60 * 1000)
208
 
                                      + (self.timeout.seconds * 1000)
209
 
                                      + (self.timeout.microseconds
210
 
                                         // 1000))
211
 
    timeout = property(lambda self: self._timeout,
212
 
                       _set_timeout)
213
 
    del _set_timeout
214
 
    def _set_interval(self, interval):
215
 
        "Setter function for 'interval' attribute"
216
 
        self._interval = interval
217
 
        self._interval_milliseconds = ((self.interval.days
218
 
                                        * 24 * 60 * 60 * 1000)
219
 
                                       + (self.interval.seconds
220
 
                                          * 1000)
221
 
                                       + (self.interval.microseconds
222
 
                                          // 1000))
223
 
    interval = property(lambda self: self._interval,
224
 
                        _set_interval)
225
 
    del _set_interval
226
 
    def __init__(self, name = None, stop_hook=None, config=None):
 
265
    
 
266
    @staticmethod
 
267
    def _timedelta_to_milliseconds(td):
 
268
        "Convert a datetime.timedelta() to milliseconds"
 
269
        return ((td.days * 24 * 60 * 60 * 1000)
 
270
                + (td.seconds * 1000)
 
271
                + (td.microseconds // 1000))
 
272
    
 
273
    def timeout_milliseconds(self):
 
274
        "Return the 'timeout' attribute in milliseconds"
 
275
        return self._timedelta_to_milliseconds(self.timeout)
 
276
    
 
277
    def interval_milliseconds(self):
 
278
        "Return the 'interval' attribute in milliseconds"
 
279
        return self._timedelta_to_milliseconds(self.interval)
 
280
    
 
281
    def __init__(self, name = None, disable_hook=None, config=None):
227
282
        """Note: the 'checker' key in 'config' sets the
228
283
        'checker_command' attribute and *not* the 'checker'
229
284
        attribute."""
 
285
        self.name = name
230
286
        if config is None:
231
287
            config = {}
232
 
        self.name = name
233
288
        logger.debug(u"Creating client %r", self.name)
234
289
        # Uppercase and remove spaces from fingerprint for later
235
290
        # comparison purposes with return value from the fingerprint()
236
291
        # function
237
 
        self.fingerprint = config["fingerprint"].upper()\
238
 
                           .replace(u" ", u"")
 
292
        self.fingerprint = (config[u"fingerprint"].upper()
 
293
                            .replace(u" ", u""))
239
294
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
240
 
        if "secret" in config:
241
 
            self.secret = config["secret"].decode(u"base64")
242
 
        elif "secfile" in config:
243
 
            secfile = open(os.path.expanduser(os.path.expandvars
244
 
                                              (config["secfile"])))
245
 
            self.secret = secfile.read()
246
 
            secfile.close()
 
295
        if u"secret" in config:
 
296
            self._secret = config[u"secret"].decode(u"base64")
 
297
        elif u"secfile" in config:
 
298
            with open(os.path.expanduser(os.path.expandvars
 
299
                                         (config[u"secfile"])),
 
300
                      "rb") as secfile:
 
301
                self._secret = secfile.read()
247
302
        else:
 
303
            #XXX Need to allow secret on demand!
248
304
            raise TypeError(u"No secret or secfile for client %s"
249
305
                            % self.name)
250
 
        self.host = config.get("host", "")
251
 
        self.created = datetime.datetime.now()
 
306
        self.host = config.get(u"host", u"")
 
307
        self.created = datetime.datetime.utcnow()
 
308
        self.enabled = False
 
309
        self.last_enabled = None
252
310
        self.last_checked_ok = None
253
 
        self.timeout = string_to_delta(config["timeout"])
254
 
        self.interval = string_to_delta(config["interval"])
255
 
        self.stop_hook = stop_hook
 
311
        self.timeout = string_to_delta(config[u"timeout"])
 
312
        self.interval = string_to_delta(config[u"interval"])
 
313
        self.disable_hook = disable_hook
256
314
        self.checker = None
257
315
        self.checker_initiator_tag = None
258
 
        self.stop_initiator_tag = None
 
316
        self.disable_initiator_tag = None
259
317
        self.checker_callback_tag = None
260
 
        self.check_command = config["checker"]
261
 
    def start(self):
 
318
        self.checker_command = config[u"checker"]
 
319
        self.current_checker_command = None
 
320
        self.last_connect = None
 
321
        self.changesignal, self._reset = os.pipe()
 
322
        self._approved = None #XXX should be based on configfile
 
323
        self.delay = 10; #XXX Should be based on configfile
 
324
 
 
325
    def setsecret(self, value):
 
326
        self._secret = value
 
327
        os.write(self.changesignal, "\0")
 
328
        os.read(self._reset, 1)
 
329
 
 
330
    secret = property(lambda self: self._secret, setsecret)
 
331
    del setsecret
 
332
    
 
333
    def setapproved(self, value):
 
334
        self._approved = value
 
335
        os.write(self.changesignal, "\0")
 
336
        os.read(self._reset, 1)
 
337
 
 
338
    approved = property(lambda self: self._approved, setapproved)
 
339
    del setapproved
 
340
 
 
341
    def enable(self):
262
342
        """Start this client's checker and timeout hooks"""
 
343
        if getattr(self, u"enabled", False):
 
344
            # Already enabled
 
345
            return
 
346
        self.last_enabled = datetime.datetime.utcnow()
263
347
        # Schedule a new checker to be started an 'interval' from now,
264
348
        # and every interval from then on.
265
 
        self.checker_initiator_tag = gobject.timeout_add\
266
 
                                     (self._interval_milliseconds,
267
 
                                      self.start_checker)
 
349
        self.checker_initiator_tag = (gobject.timeout_add
 
350
                                      (self.interval_milliseconds(),
 
351
                                       self.start_checker))
 
352
        # Schedule a disable() when 'timeout' has passed
 
353
        self.disable_initiator_tag = (gobject.timeout_add
 
354
                                   (self.timeout_milliseconds(),
 
355
                                    self.disable))
 
356
        self.enabled = True
268
357
        # Also start a new checker *right now*.
269
358
        self.start_checker()
270
 
        # Schedule a stop() when 'timeout' has passed
271
 
        self.stop_initiator_tag = gobject.timeout_add\
272
 
                                  (self._timeout_milliseconds,
273
 
                                   self.stop)
274
 
    def stop(self):
275
 
        """Stop this client.
276
 
        The possibility that a client might be restarted is left open,
277
 
        but not currently used."""
278
 
        # If this client doesn't have a secret, it is already stopped.
279
 
        if hasattr(self, "secret") and self.secret:
280
 
            logger.info(u"Stopping client %s", self.name)
281
 
            self.secret = None
282
 
        else:
 
359
    
 
360
    def disable(self, quiet=True):
 
361
        """Disable this client."""
 
362
        if not getattr(self, "enabled", False):
283
363
            return False
284
 
        if getattr(self, "stop_initiator_tag", False):
285
 
            gobject.source_remove(self.stop_initiator_tag)
286
 
            self.stop_initiator_tag = None
287
 
        if getattr(self, "checker_initiator_tag", False):
 
364
        if not quiet:
 
365
            logger.info(u"Disabling client %s", self.name)
 
366
        if getattr(self, u"disable_initiator_tag", False):
 
367
            gobject.source_remove(self.disable_initiator_tag)
 
368
            self.disable_initiator_tag = None
 
369
        if getattr(self, u"checker_initiator_tag", False):
288
370
            gobject.source_remove(self.checker_initiator_tag)
289
371
            self.checker_initiator_tag = None
290
372
        self.stop_checker()
291
 
        if self.stop_hook:
292
 
            self.stop_hook(self)
 
373
        if self.disable_hook:
 
374
            self.disable_hook(self)
 
375
        self.enabled = False
293
376
        # Do not run this again if called by a gobject.timeout_add
294
377
        return False
 
378
    
295
379
    def __del__(self):
296
 
        self.stop_hook = None
297
 
        self.stop()
298
 
    def checker_callback(self, pid, condition):
 
380
        self.disable_hook = None
 
381
        self.disable()
 
382
    
 
383
    def checker_callback(self, pid, condition, command):
299
384
        """The checker has completed, so take appropriate actions."""
300
 
        now = datetime.datetime.now()
301
385
        self.checker_callback_tag = None
302
386
        self.checker = None
303
 
        if os.WIFEXITED(condition) \
304
 
               and (os.WEXITSTATUS(condition) == 0):
305
 
            logger.info(u"Checker for %(name)s succeeded",
306
 
                        vars(self))
307
 
            self.last_checked_ok = now
308
 
            gobject.source_remove(self.stop_initiator_tag)
309
 
            self.stop_initiator_tag = gobject.timeout_add\
310
 
                                      (self._timeout_milliseconds,
311
 
                                       self.stop)
312
 
        elif not os.WIFEXITED(condition):
 
387
        if os.WIFEXITED(condition):
 
388
            exitstatus = os.WEXITSTATUS(condition)
 
389
            if exitstatus == 0:
 
390
                logger.info(u"Checker for %(name)s succeeded",
 
391
                            vars(self))
 
392
                self.checked_ok()
 
393
            else:
 
394
                logger.info(u"Checker for %(name)s failed",
 
395
                            vars(self))
 
396
        else:
313
397
            logger.warning(u"Checker for %(name)s crashed?",
314
398
                           vars(self))
315
 
        else:
316
 
            logger.info(u"Checker for %(name)s failed",
317
 
                        vars(self))
 
399
    
 
400
    def checked_ok(self):
 
401
        """Bump up the timeout for this client.
 
402
        
 
403
        This should only be called when the client has been seen,
 
404
        alive and well.
 
405
        """
 
406
        self.last_checked_ok = datetime.datetime.utcnow()
 
407
        gobject.source_remove(self.disable_initiator_tag)
 
408
        self.disable_initiator_tag = (gobject.timeout_add
 
409
                                      (self.timeout_milliseconds(),
 
410
                                       self.disable))
 
411
    
318
412
    def start_checker(self):
319
413
        """Start a new checker subprocess if one is not running.
 
414
        
320
415
        If a checker already exists, leave it running and do
321
416
        nothing."""
322
417
        # The reason for not killing a running checker is that if we
325
420
        # client would inevitably timeout, since no checker would get
326
421
        # a chance to run to completion.  If we instead leave running
327
422
        # checkers alone, the checker would have to take more time
328
 
        # than 'timeout' for the client to be declared invalid, which
329
 
        # is as it should be.
 
423
        # than 'timeout' for the client to be disabled, which is as it
 
424
        # should be.
 
425
        
 
426
        # If a checker exists, make sure it is not a zombie
 
427
        try:
 
428
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
429
        except (AttributeError, OSError), error:
 
430
            if (isinstance(error, OSError)
 
431
                and error.errno != errno.ECHILD):
 
432
                raise error
 
433
        else:
 
434
            if pid:
 
435
                logger.warning(u"Checker was a zombie")
 
436
                gobject.source_remove(self.checker_callback_tag)
 
437
                self.checker_callback(pid, status,
 
438
                                      self.current_checker_command)
 
439
        # Start a new checker if needed
330
440
        if self.checker is None:
331
441
            try:
332
 
                # In case check_command has exactly one % operator
333
 
                command = self.check_command % self.host
 
442
                # In case checker_command has exactly one % operator
 
443
                command = self.checker_command % self.host
334
444
            except TypeError:
335
445
                # Escape attributes for the shell
336
 
                escaped_attrs = dict((key, re.escape(str(val)))
 
446
                escaped_attrs = dict((key,
 
447
                                      re.escape(unicode(str(val),
 
448
                                                        errors=
 
449
                                                        u'replace')))
337
450
                                     for key, val in
338
451
                                     vars(self).iteritems())
339
452
                try:
340
 
                    command = self.check_command % escaped_attrs
 
453
                    command = self.checker_command % escaped_attrs
341
454
                except TypeError, error:
342
455
                    logger.error(u'Could not format string "%s":'
343
 
                                 u' %s', self.check_command, error)
 
456
                                 u' %s', self.checker_command, error)
344
457
                    return True # Try again later
 
458
            self.current_checker_command = command
345
459
            try:
346
460
                logger.info(u"Starting checker %r for %s",
347
461
                            command, self.name)
351
465
                # always replaced by /dev/null.)
352
466
                self.checker = subprocess.Popen(command,
353
467
                                                close_fds=True,
354
 
                                                shell=True, cwd="/")
355
 
                self.checker_callback_tag = gobject.child_watch_add\
356
 
                                            (self.checker.pid,
357
 
                                             self.checker_callback)
 
468
                                                shell=True, cwd=u"/")
 
469
                self.checker_callback_tag = (gobject.child_watch_add
 
470
                                             (self.checker.pid,
 
471
                                              self.checker_callback,
 
472
                                              data=command))
 
473
                # The checker may have completed before the gobject
 
474
                # watch was added.  Check for this.
 
475
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
476
                if pid:
 
477
                    gobject.source_remove(self.checker_callback_tag)
 
478
                    self.checker_callback(pid, status, command)
358
479
            except OSError, error:
359
480
                logger.error(u"Failed to start subprocess: %s",
360
481
                             error)
361
482
        # Re-run this periodically if run by gobject.timeout_add
362
483
        return True
 
484
    
363
485
    def stop_checker(self):
364
486
        """Force the checker process, if any, to stop."""
365
487
        if self.checker_callback_tag:
366
488
            gobject.source_remove(self.checker_callback_tag)
367
489
            self.checker_callback_tag = None
368
 
        if getattr(self, "checker", None) is None:
 
490
        if getattr(self, u"checker", None) is None:
369
491
            return
370
492
        logger.debug(u"Stopping checker for %(name)s", vars(self))
371
493
        try:
372
494
            os.kill(self.checker.pid, signal.SIGTERM)
373
 
            #os.sleep(0.5)
 
495
            #time.sleep(0.5)
374
496
            #if self.checker.poll() is None:
375
497
            #    os.kill(self.checker.pid, signal.SIGKILL)
376
498
        except OSError, error:
377
499
            if error.errno != errno.ESRCH: # No such process
378
500
                raise
379
501
        self.checker = None
380
 
    def still_valid(self):
381
 
        """Has the timeout not yet passed for this client?"""
382
 
        now = datetime.datetime.now()
 
502
 
 
503
 
 
504
def dbus_service_property(dbus_interface, signature=u"v",
 
505
                          access=u"readwrite", byte_arrays=False):
 
506
    """Decorators for marking methods of a DBusObjectWithProperties to
 
507
    become properties on the D-Bus.
 
508
    
 
509
    The decorated method will be called with no arguments by "Get"
 
510
    and with one argument by "Set".
 
511
    
 
512
    The parameters, where they are supported, are the same as
 
513
    dbus.service.method, except there is only "signature", since the
 
514
    type from Get() and the type sent to Set() is the same.
 
515
    """
 
516
    # Encoding deeply encoded byte arrays is not supported yet by the
 
517
    # "Set" method, so we fail early here:
 
518
    if byte_arrays and signature != u"ay":
 
519
        raise ValueError(u"Byte arrays not supported for non-'ay'"
 
520
                         u" signature %r" % signature)
 
521
    def decorator(func):
 
522
        func._dbus_is_property = True
 
523
        func._dbus_interface = dbus_interface
 
524
        func._dbus_signature = signature
 
525
        func._dbus_access = access
 
526
        func._dbus_name = func.__name__
 
527
        if func._dbus_name.endswith(u"_dbus_property"):
 
528
            func._dbus_name = func._dbus_name[:-14]
 
529
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
 
530
        return func
 
531
    return decorator
 
532
 
 
533
 
 
534
class DBusPropertyException(dbus.exceptions.DBusException):
 
535
    """A base class for D-Bus property-related exceptions
 
536
    """
 
537
    def __unicode__(self):
 
538
        return unicode(str(self))
 
539
 
 
540
 
 
541
class DBusPropertyAccessException(DBusPropertyException):
 
542
    """A property's access permissions disallows an operation.
 
543
    """
 
544
    pass
 
545
 
 
546
 
 
547
class DBusPropertyNotFound(DBusPropertyException):
 
548
    """An attempt was made to access a non-existing property.
 
549
    """
 
550
    pass
 
551
 
 
552
 
 
553
class DBusObjectWithProperties(dbus.service.Object):
 
554
    """A D-Bus object with properties.
 
555
 
 
556
    Classes inheriting from this can use the dbus_service_property
 
557
    decorator to expose methods as D-Bus properties.  It exposes the
 
558
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
559
    """
 
560
    
 
561
    @staticmethod
 
562
    def _is_dbus_property(obj):
 
563
        return getattr(obj, u"_dbus_is_property", False)
 
564
    
 
565
    def _get_all_dbus_properties(self):
 
566
        """Returns a generator of (name, attribute) pairs
 
567
        """
 
568
        return ((prop._dbus_name, prop)
 
569
                for name, prop in
 
570
                inspect.getmembers(self, self._is_dbus_property))
 
571
    
 
572
    def _get_dbus_property(self, interface_name, property_name):
 
573
        """Returns a bound method if one exists which is a D-Bus
 
574
        property with the specified name and interface.
 
575
        """
 
576
        for name in (property_name,
 
577
                     property_name + u"_dbus_property"):
 
578
            prop = getattr(self, name, None)
 
579
            if (prop is None
 
580
                or not self._is_dbus_property(prop)
 
581
                or prop._dbus_name != property_name
 
582
                or (interface_name and prop._dbus_interface
 
583
                    and interface_name != prop._dbus_interface)):
 
584
                continue
 
585
            return prop
 
586
        # No such property
 
587
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
 
588
                                   + interface_name + u"."
 
589
                                   + property_name)
 
590
    
 
591
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
 
592
                         out_signature=u"v")
 
593
    def Get(self, interface_name, property_name):
 
594
        """Standard D-Bus property Get() method, see D-Bus standard.
 
595
        """
 
596
        prop = self._get_dbus_property(interface_name, property_name)
 
597
        if prop._dbus_access == u"write":
 
598
            raise DBusPropertyAccessException(property_name)
 
599
        value = prop()
 
600
        if not hasattr(value, u"variant_level"):
 
601
            return value
 
602
        return type(value)(value, variant_level=value.variant_level+1)
 
603
    
 
604
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
 
605
    def Set(self, interface_name, property_name, value):
 
606
        """Standard D-Bus property Set() method, see D-Bus standard.
 
607
        """
 
608
        prop = self._get_dbus_property(interface_name, property_name)
 
609
        if prop._dbus_access == u"read":
 
610
            raise DBusPropertyAccessException(property_name)
 
611
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
612
            # The byte_arrays option is not supported yet on
 
613
            # signatures other than "ay".
 
614
            if prop._dbus_signature != u"ay":
 
615
                raise ValueError
 
616
            value = dbus.ByteArray(''.join(unichr(byte)
 
617
                                           for byte in value))
 
618
        prop(value)
 
619
    
 
620
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
 
621
                         out_signature=u"a{sv}")
 
622
    def GetAll(self, interface_name):
 
623
        """Standard D-Bus property GetAll() method, see D-Bus
 
624
        standard.
 
625
 
 
626
        Note: Will not include properties with access="write".
 
627
        """
 
628
        all = {}
 
629
        for name, prop in self._get_all_dbus_properties():
 
630
            if (interface_name
 
631
                and interface_name != prop._dbus_interface):
 
632
                # Interface non-empty but did not match
 
633
                continue
 
634
            # Ignore write-only properties
 
635
            if prop._dbus_access == u"write":
 
636
                continue
 
637
            value = prop()
 
638
            if not hasattr(value, u"variant_level"):
 
639
                all[name] = value
 
640
                continue
 
641
            all[name] = type(value)(value, variant_level=
 
642
                                    value.variant_level+1)
 
643
        return dbus.Dictionary(all, signature=u"sv")
 
644
    
 
645
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
646
                         out_signature=u"s",
 
647
                         path_keyword='object_path',
 
648
                         connection_keyword='connection')
 
649
    def Introspect(self, object_path, connection):
 
650
        """Standard D-Bus method, overloaded to insert property tags.
 
651
        """
 
652
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
653
                                                   connection)
 
654
        try:
 
655
            document = xml.dom.minidom.parseString(xmlstring)
 
656
            def make_tag(document, name, prop):
 
657
                e = document.createElement(u"property")
 
658
                e.setAttribute(u"name", name)
 
659
                e.setAttribute(u"type", prop._dbus_signature)
 
660
                e.setAttribute(u"access", prop._dbus_access)
 
661
                return e
 
662
            for if_tag in document.getElementsByTagName(u"interface"):
 
663
                for tag in (make_tag(document, name, prop)
 
664
                            for name, prop
 
665
                            in self._get_all_dbus_properties()
 
666
                            if prop._dbus_interface
 
667
                            == if_tag.getAttribute(u"name")):
 
668
                    if_tag.appendChild(tag)
 
669
                # Add the names to the return values for the
 
670
                # "org.freedesktop.DBus.Properties" methods
 
671
                if (if_tag.getAttribute(u"name")
 
672
                    == u"org.freedesktop.DBus.Properties"):
 
673
                    for cn in if_tag.getElementsByTagName(u"method"):
 
674
                        if cn.getAttribute(u"name") == u"Get":
 
675
                            for arg in cn.getElementsByTagName(u"arg"):
 
676
                                if (arg.getAttribute(u"direction")
 
677
                                    == u"out"):
 
678
                                    arg.setAttribute(u"name", u"value")
 
679
                        elif cn.getAttribute(u"name") == u"GetAll":
 
680
                            for arg in cn.getElementsByTagName(u"arg"):
 
681
                                if (arg.getAttribute(u"direction")
 
682
                                    == u"out"):
 
683
                                    arg.setAttribute(u"name", u"props")
 
684
            xmlstring = document.toxml(u"utf-8")
 
685
            document.unlink()
 
686
        except (AttributeError, xml.dom.DOMException,
 
687
                xml.parsers.expat.ExpatError), error:
 
688
            logger.error(u"Failed to override Introspection method",
 
689
                         error)
 
690
        return xmlstring
 
691
 
 
692
 
 
693
class ClientDBus(Client, DBusObjectWithProperties):
 
694
    """A Client class using D-Bus
 
695
    
 
696
    Attributes:
 
697
    dbus_object_path: dbus.ObjectPath
 
698
    bus: dbus.SystemBus()
 
699
    """
 
700
    # dbus.service.Object doesn't use super(), so we can't either.
 
701
    
 
702
    def __init__(self, bus = None, *args, **kwargs):
 
703
        self.bus = bus
 
704
        Client.__init__(self, *args, **kwargs)
 
705
        # Only now, when this client is initialized, can it show up on
 
706
        # the D-Bus
 
707
        self.dbus_object_path = (dbus.ObjectPath
 
708
                                 (u"/clients/"
 
709
                                  + self.name.replace(u".", u"_")))
 
710
        DBusObjectWithProperties.__init__(self, self.bus,
 
711
                                          self.dbus_object_path)
 
712
    
 
713
    @staticmethod
 
714
    def _datetime_to_dbus(dt, variant_level=0):
 
715
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
716
        return dbus.String(dt.isoformat(),
 
717
                           variant_level=variant_level)
 
718
    
 
719
    def enable(self):
 
720
        oldstate = getattr(self, u"enabled", False)
 
721
        r = Client.enable(self)
 
722
        if oldstate != self.enabled:
 
723
            # Emit D-Bus signals
 
724
            self.PropertyChanged(dbus.String(u"enabled"),
 
725
                                 dbus.Boolean(True, variant_level=1))
 
726
            self.PropertyChanged(
 
727
                dbus.String(u"last_enabled"),
 
728
                self._datetime_to_dbus(self.last_enabled,
 
729
                                       variant_level=1))
 
730
        return r
 
731
    
 
732
    def disable(self, quiet = False):
 
733
        oldstate = getattr(self, u"enabled", False)
 
734
        r = Client.disable(self, quiet=quiet)
 
735
        if not quiet and oldstate != self.enabled:
 
736
            # Emit D-Bus signal
 
737
            self.PropertyChanged(dbus.String(u"enabled"),
 
738
                                 dbus.Boolean(False, variant_level=1))
 
739
        return r
 
740
    
 
741
    def __del__(self, *args, **kwargs):
 
742
        try:
 
743
            self.remove_from_connection()
 
744
        except LookupError:
 
745
            pass
 
746
        if hasattr(DBusObjectWithProperties, u"__del__"):
 
747
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
 
748
        Client.__del__(self, *args, **kwargs)
 
749
    
 
750
    def checker_callback(self, pid, condition, command,
 
751
                         *args, **kwargs):
 
752
        self.checker_callback_tag = None
 
753
        self.checker = None
 
754
        # Emit D-Bus signal
 
755
        self.PropertyChanged(dbus.String(u"checker_running"),
 
756
                             dbus.Boolean(False, variant_level=1))
 
757
        if os.WIFEXITED(condition):
 
758
            exitstatus = os.WEXITSTATUS(condition)
 
759
            # Emit D-Bus signal
 
760
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
761
                                  dbus.Int64(condition),
 
762
                                  dbus.String(command))
 
763
        else:
 
764
            # Emit D-Bus signal
 
765
            self.CheckerCompleted(dbus.Int16(-1),
 
766
                                  dbus.Int64(condition),
 
767
                                  dbus.String(command))
 
768
        
 
769
        return Client.checker_callback(self, pid, condition, command,
 
770
                                       *args, **kwargs)
 
771
    
 
772
    def checked_ok(self, *args, **kwargs):
 
773
        r = Client.checked_ok(self, *args, **kwargs)
 
774
        # Emit D-Bus signal
 
775
        self.PropertyChanged(
 
776
            dbus.String(u"last_checked_ok"),
 
777
            (self._datetime_to_dbus(self.last_checked_ok,
 
778
                                    variant_level=1)))
 
779
        return r
 
780
    
 
781
    def start_checker(self, *args, **kwargs):
 
782
        old_checker = self.checker
 
783
        if self.checker is not None:
 
784
            old_checker_pid = self.checker.pid
 
785
        else:
 
786
            old_checker_pid = None
 
787
        r = Client.start_checker(self, *args, **kwargs)
 
788
        # Only if new checker process was started
 
789
        if (self.checker is not None
 
790
            and old_checker_pid != self.checker.pid):
 
791
            # Emit D-Bus signal
 
792
            self.CheckerStarted(self.current_checker_command)
 
793
            self.PropertyChanged(
 
794
                dbus.String(u"checker_running"),
 
795
                dbus.Boolean(True, variant_level=1))
 
796
        return r
 
797
    
 
798
    def stop_checker(self, *args, **kwargs):
 
799
        old_checker = getattr(self, u"checker", None)
 
800
        r = Client.stop_checker(self, *args, **kwargs)
 
801
        if (old_checker is not None
 
802
            and getattr(self, u"checker", None) is None):
 
803
            self.PropertyChanged(dbus.String(u"checker_running"),
 
804
                                 dbus.Boolean(False, variant_level=1))
 
805
        return r
 
806
    
 
807
    ## D-Bus methods, signals & properties
 
808
    _interface = u"se.bsnet.fukt.Mandos.Client"
 
809
    
 
810
    ## Signals
 
811
    
 
812
    # CheckerCompleted - signal
 
813
    @dbus.service.signal(_interface, signature=u"nxs")
 
814
    def CheckerCompleted(self, exitcode, waitstatus, command):
 
815
        "D-Bus signal"
 
816
        pass
 
817
    
 
818
    # CheckerStarted - signal
 
819
    @dbus.service.signal(_interface, signature=u"s")
 
820
    def CheckerStarted(self, command):
 
821
        "D-Bus signal"
 
822
        pass
 
823
    
 
824
    # PropertyChanged - signal
 
825
    @dbus.service.signal(_interface, signature=u"sv")
 
826
    def PropertyChanged(self, property, value):
 
827
        "D-Bus signal"
 
828
        pass
 
829
    
 
830
    # GotSecret - signal
 
831
    @dbus.service.signal(_interface)
 
832
    def GotSecret(self):
 
833
        "D-Bus signal"
 
834
        pass
 
835
    
 
836
    # Rejected - signal
 
837
    @dbus.service.signal(_interface)
 
838
    def Rejected(self):
 
839
        "D-Bus signal"
 
840
        pass
 
841
    
 
842
    ## Methods
 
843
    
 
844
    # CheckedOK - method
 
845
    @dbus.service.method(_interface)
 
846
    def CheckedOK(self):
 
847
        return self.checked_ok()
 
848
    
 
849
    # Enable - method
 
850
    @dbus.service.method(_interface)
 
851
    def Enable(self):
 
852
        "D-Bus method"
 
853
        self.enable()
 
854
    
 
855
    # StartChecker - method
 
856
    @dbus.service.method(_interface)
 
857
    def StartChecker(self):
 
858
        "D-Bus method"
 
859
        self.start_checker()
 
860
    
 
861
    # Disable - method
 
862
    @dbus.service.method(_interface)
 
863
    def Disable(self):
 
864
        "D-Bus method"
 
865
        self.disable()
 
866
    
 
867
    # StopChecker - method
 
868
    @dbus.service.method(_interface)
 
869
    def StopChecker(self):
 
870
        self.stop_checker()
 
871
    
 
872
    ## Properties
 
873
    
 
874
    # name - property
 
875
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
876
    def name_dbus_property(self):
 
877
        return dbus.String(self.name)
 
878
    
 
879
    # fingerprint - property
 
880
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
881
    def fingerprint_dbus_property(self):
 
882
        return dbus.String(self.fingerprint)
 
883
    
 
884
    # host - property
 
885
    @dbus_service_property(_interface, signature=u"s",
 
886
                           access=u"readwrite")
 
887
    def host_dbus_property(self, value=None):
 
888
        if value is None:       # get
 
889
            return dbus.String(self.host)
 
890
        self.host = value
 
891
        # Emit D-Bus signal
 
892
        self.PropertyChanged(dbus.String(u"host"),
 
893
                             dbus.String(value, variant_level=1))
 
894
    
 
895
    # created - property
 
896
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
897
    def created_dbus_property(self):
 
898
        return dbus.String(self._datetime_to_dbus(self.created))
 
899
    
 
900
    # last_enabled - property
 
901
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
902
    def last_enabled_dbus_property(self):
 
903
        if self.last_enabled is None:
 
904
            return dbus.String(u"")
 
905
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
906
    
 
907
    # enabled - property
 
908
    @dbus_service_property(_interface, signature=u"b",
 
909
                           access=u"readwrite")
 
910
    def enabled_dbus_property(self, value=None):
 
911
        if value is None:       # get
 
912
            return dbus.Boolean(self.enabled)
 
913
        if value:
 
914
            self.enable()
 
915
        else:
 
916
            self.disable()
 
917
    
 
918
    # last_checked_ok - property
 
919
    @dbus_service_property(_interface, signature=u"s",
 
920
                           access=u"readwrite")
 
921
    def last_checked_ok_dbus_property(self, value=None):
 
922
        if value is not None:
 
923
            self.checked_ok()
 
924
            return
383
925
        if self.last_checked_ok is None:
384
 
            return now < (self.created + self.timeout)
385
 
        else:
386
 
            return now < (self.last_checked_ok + self.timeout)
387
 
 
388
 
 
389
 
def peer_certificate(session):
390
 
    "Return the peer's OpenPGP certificate as a bytestring"
391
 
    # If not an OpenPGP certificate...
392
 
    if gnutls.library.functions.gnutls_certificate_type_get\
393
 
            (session._c_object) \
394
 
           != gnutls.library.constants.GNUTLS_CRT_OPENPGP:
395
 
        # ...do the normal thing
396
 
        return session.peer_certificate
397
 
    list_size = ctypes.c_uint()
398
 
    cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
399
 
        (session._c_object, ctypes.byref(list_size))
400
 
    if list_size.value == 0:
401
 
        return None
402
 
    cert = cert_list[0]
403
 
    return ctypes.string_at(cert.data, cert.size)
404
 
 
405
 
 
406
 
def fingerprint(openpgp):
407
 
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
408
 
    # New GnuTLS "datum" with the OpenPGP public key
409
 
    datum = gnutls.library.types.gnutls_datum_t\
410
 
        (ctypes.cast(ctypes.c_char_p(openpgp),
411
 
                     ctypes.POINTER(ctypes.c_ubyte)),
412
 
         ctypes.c_uint(len(openpgp)))
413
 
    # New empty GnuTLS certificate
414
 
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
415
 
    gnutls.library.functions.gnutls_openpgp_crt_init\
416
 
        (ctypes.byref(crt))
417
 
    # Import the OpenPGP public key into the certificate
418
 
    gnutls.library.functions.gnutls_openpgp_crt_import\
419
 
                    (crt, ctypes.byref(datum),
420
 
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
421
 
    # Verify the self signature in the key
422
 
    crtverify = ctypes.c_uint()
423
 
    gnutls.library.functions.gnutls_openpgp_crt_verify_self\
424
 
        (crt, 0, ctypes.byref(crtverify))
425
 
    if crtverify.value != 0:
426
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
427
 
        raise gnutls.errors.CertificateSecurityError("Verify failed")
428
 
    # New buffer for the fingerprint
429
 
    buf = ctypes.create_string_buffer(20)
430
 
    buf_len = ctypes.c_size_t()
431
 
    # Get the fingerprint from the certificate into the buffer
432
 
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
433
 
        (crt, ctypes.byref(buf), ctypes.byref(buf_len))
434
 
    # Deinit the certificate
435
 
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
436
 
    # Convert the buffer to a Python bytestring
437
 
    fpr = ctypes.string_at(buf, buf_len.value)
438
 
    # Convert the bytestring to hexadecimal notation
439
 
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
440
 
    return hex_fpr
441
 
 
442
 
 
443
 
class TCP_handler(SocketServer.BaseRequestHandler, object):
444
 
    """A TCP request handler class.
445
 
    Instantiated by IPv6_TCPServer for each request to handle it.
 
926
            return dbus.String(u"")
 
927
        return dbus.String(self._datetime_to_dbus(self
 
928
                                                  .last_checked_ok))
 
929
    
 
930
    # timeout - property
 
931
    @dbus_service_property(_interface, signature=u"t",
 
932
                           access=u"readwrite")
 
933
    def timeout_dbus_property(self, value=None):
 
934
        if value is None:       # get
 
935
            return dbus.UInt64(self.timeout_milliseconds())
 
936
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
937
        # Emit D-Bus signal
 
938
        self.PropertyChanged(dbus.String(u"timeout"),
 
939
                             dbus.UInt64(value, variant_level=1))
 
940
        if getattr(self, u"disable_initiator_tag", None) is None:
 
941
            return
 
942
        # Reschedule timeout
 
943
        gobject.source_remove(self.disable_initiator_tag)
 
944
        self.disable_initiator_tag = None
 
945
        time_to_die = (self.
 
946
                       _timedelta_to_milliseconds((self
 
947
                                                   .last_checked_ok
 
948
                                                   + self.timeout)
 
949
                                                  - datetime.datetime
 
950
                                                  .utcnow()))
 
951
        if time_to_die <= 0:
 
952
            # The timeout has passed
 
953
            self.disable()
 
954
        else:
 
955
            self.disable_initiator_tag = (gobject.timeout_add
 
956
                                          (time_to_die, self.disable))
 
957
    
 
958
    # interval - property
 
959
    @dbus_service_property(_interface, signature=u"t",
 
960
                           access=u"readwrite")
 
961
    def interval_dbus_property(self, value=None):
 
962
        if value is None:       # get
 
963
            return dbus.UInt64(self.interval_milliseconds())
 
964
        self.interval = datetime.timedelta(0, 0, 0, value)
 
965
        # Emit D-Bus signal
 
966
        self.PropertyChanged(dbus.String(u"interval"),
 
967
                             dbus.UInt64(value, variant_level=1))
 
968
        if getattr(self, u"checker_initiator_tag", None) is None:
 
969
            return
 
970
        # Reschedule checker run
 
971
        gobject.source_remove(self.checker_initiator_tag)
 
972
        self.checker_initiator_tag = (gobject.timeout_add
 
973
                                      (value, self.start_checker))
 
974
        self.start_checker()    # Start one now, too
 
975
 
 
976
    # checker - property
 
977
    @dbus_service_property(_interface, signature=u"s",
 
978
                           access=u"readwrite")
 
979
    def checker_dbus_property(self, value=None):
 
980
        if value is None:       # get
 
981
            return dbus.String(self.checker_command)
 
982
        self.checker_command = value
 
983
        # Emit D-Bus signal
 
984
        self.PropertyChanged(dbus.String(u"checker"),
 
985
                             dbus.String(self.checker_command,
 
986
                                         variant_level=1))
 
987
    
 
988
    # checker_running - property
 
989
    @dbus_service_property(_interface, signature=u"b",
 
990
                           access=u"readwrite")
 
991
    def checker_running_dbus_property(self, value=None):
 
992
        if value is None:       # get
 
993
            return dbus.Boolean(self.checker is not None)
 
994
        if value:
 
995
            self.start_checker()
 
996
        else:
 
997
            self.stop_checker()
 
998
    
 
999
    # object_path - property
 
1000
    @dbus_service_property(_interface, signature=u"o", access=u"read")
 
1001
    def object_path_dbus_property(self):
 
1002
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1003
    
 
1004
    # secret = property
 
1005
    @dbus_service_property(_interface, signature=u"ay",
 
1006
                           access=u"write", byte_arrays=True)
 
1007
    def secret_dbus_property(self, value):
 
1008
        self.secret = str(value)
 
1009
    
 
1010
    del _interface
 
1011
 
 
1012
 
 
1013
class ClientHandler(socketserver.BaseRequestHandler, object):
 
1014
    """A class to handle client connections.
 
1015
    
 
1016
    Instantiated once for each connection to handle it.
446
1017
    Note: This will run in its own forked process."""
447
1018
    
448
1019
    def handle(self):
449
1020
        logger.info(u"TCP connection from: %s",
450
 
                     unicode(self.client_address))
451
 
        session = gnutls.connection.ClientSession\
452
 
                  (self.request, gnutls.connection.X509Credentials())
453
 
        
454
 
        line = self.request.makefile().readline()
455
 
        logger.debug(u"Protocol version: %r", line)
456
 
        try:
457
 
            if int(line.strip().split()[0]) > 1:
458
 
                raise RuntimeError
459
 
        except (ValueError, IndexError, RuntimeError), error:
460
 
            logger.error(u"Unknown protocol version: %s", error)
461
 
            return
462
 
        
463
 
        # Note: gnutls.connection.X509Credentials is really a generic
464
 
        # GnuTLS certificate credentials object so long as no X.509
465
 
        # keys are added to it.  Therefore, we can use it here despite
466
 
        # using OpenPGP certificates.
467
 
        
468
 
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
469
 
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
470
 
        #                "+DHE-DSS"))
471
 
        priority = "NORMAL"             # Fallback default, since this
472
 
                                        # MUST be set.
473
 
        if self.server.settings["priority"]:
474
 
            priority = self.server.settings["priority"]
475
 
        gnutls.library.functions.gnutls_priority_set_direct\
476
 
            (session._c_object, priority, None)
477
 
        
478
 
        try:
479
 
            session.handshake()
480
 
        except gnutls.errors.GNUTLSError, error:
481
 
            logger.warning(u"Handshake failed: %s", error)
482
 
            # Do not run session.bye() here: the session is not
483
 
            # established.  Just abandon the request.
484
 
            return
485
 
        try:
486
 
            fpr = fingerprint(peer_certificate(session))
487
 
        except (TypeError, gnutls.errors.GNUTLSError), error:
488
 
            logger.warning(u"Bad certificate: %s", error)
489
 
            session.bye()
490
 
            return
491
 
        logger.debug(u"Fingerprint: %s", fpr)
492
 
        client = None
493
 
        for c in self.server.clients:
494
 
            if c.fingerprint == fpr:
495
 
                client = c
496
 
                break
497
 
        if not client:
498
 
            logger.warning(u"Client not found for fingerprint: %s",
499
 
                           fpr)
500
 
            session.bye()
501
 
            return
502
 
        # Have to check if client.still_valid(), since it is possible
503
 
        # that the client timed out while establishing the GnuTLS
504
 
        # session.
505
 
        if not client.still_valid():
506
 
            logger.warning(u"Client %(name)s is invalid",
507
 
                           vars(client))
508
 
            session.bye()
509
 
            return
510
 
        sent_size = 0
511
 
        while sent_size < len(client.secret):
512
 
            sent = session.send(client.secret[sent_size:])
513
 
            logger.debug(u"Sent: %d, remaining: %d",
514
 
                         sent, len(client.secret)
515
 
                         - (sent_size + sent))
516
 
            sent_size += sent
517
 
        session.bye()
518
 
 
519
 
 
520
 
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
521
 
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
 
1021
                    unicode(self.client_address))
 
1022
        logger.debug(u"IPC Pipe FD: %d",
 
1023
                     self.server.child_pipe[1].fileno())
 
1024
        # Open IPC pipe to parent process
 
1025
        with contextlib.nested(self.server.child_pipe[1],
 
1026
                               self.server.parent_pipe[0]
 
1027
                               ) as (ipc, ipc_return):
 
1028
            session = (gnutls.connection
 
1029
                       .ClientSession(self.request,
 
1030
                                      gnutls.connection
 
1031
                                      .X509Credentials()))
 
1032
            
 
1033
            line = self.request.makefile().readline()
 
1034
            logger.debug(u"Protocol version: %r", line)
 
1035
            try:
 
1036
                if int(line.strip().split()[0]) > 1:
 
1037
                    raise RuntimeError
 
1038
            except (ValueError, IndexError, RuntimeError), error:
 
1039
                logger.error(u"Unknown protocol version: %s", error)
 
1040
                return
 
1041
            
 
1042
            # Note: gnutls.connection.X509Credentials is really a
 
1043
            # generic GnuTLS certificate credentials object so long as
 
1044
            # no X.509 keys are added to it.  Therefore, we can use it
 
1045
            # here despite using OpenPGP certificates.
 
1046
            
 
1047
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
 
1048
            #                      u"+AES-256-CBC", u"+SHA1",
 
1049
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
 
1050
            #                      u"+DHE-DSS"))
 
1051
            # Use a fallback default, since this MUST be set.
 
1052
            priority = self.server.gnutls_priority
 
1053
            if priority is None:
 
1054
                priority = u"NORMAL"
 
1055
            (gnutls.library.functions
 
1056
             .gnutls_priority_set_direct(session._c_object,
 
1057
                                         priority, None))
 
1058
            
 
1059
            try:
 
1060
                session.handshake()
 
1061
            except gnutls.errors.GNUTLSError, error:
 
1062
                logger.warning(u"Handshake failed: %s", error)
 
1063
                # Do not run session.bye() here: the session is not
 
1064
                # established.  Just abandon the request.
 
1065
                return
 
1066
            logger.debug(u"Handshake succeeded")
 
1067
            try:
 
1068
                try:
 
1069
                    fpr = self.fingerprint(self.peer_certificate
 
1070
                                           (session))
 
1071
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1072
                    logger.warning(u"Bad certificate: %s", error)
 
1073
                    return
 
1074
                logger.debug(u"Fingerprint: %s", fpr)
 
1075
 
 
1076
                for c in self.server.clients:
 
1077
                    if c.fingerprint == fpr:
 
1078
                        client = c
 
1079
                        break
 
1080
                else:
 
1081
                    ipc.write(u"NOTFOUND %s %s\n"
 
1082
                              % (fpr, unicode(self.client_address)))
 
1083
                    return
 
1084
 
 
1085
                class proxyclient(object):
 
1086
                    def __getattribute__(self, name):
 
1087
                        ipc.write(u"GETATTR %s %s\n" % name, client.fpr)
 
1088
                        return pickle.load(ipc_reply)
 
1089
                p = proxyclient(client)
 
1090
 
 
1091
                while True:
 
1092
                    if not p.client.enabled:
 
1093
                        icp.write("DISABLED %s\n" % client.fpr)
 
1094
                        return
 
1095
                    if p.client.approved == False:
 
1096
                        icp.write("Disaproved")
 
1097
                        return
 
1098
                    
 
1099
                    if not p.client.secret:
 
1100
                        icp.write("No password")
 
1101
                    elif not p.client.approved:
 
1102
                        icp.write("Need approval"):
 
1103
                    else:
 
1104
                        #We have a password and are approved
 
1105
                        break
 
1106
                    i, o, e = select(p.changesignal, (), (), client.delay)
 
1107
                    if not i:
 
1108
                        icp.write("Timeout passed")
 
1109
                        return
 
1110
                    
 
1111
                ipc.write(u"SENDING %s\n" % client.name)
 
1112
                sent_size = 0
 
1113
                while sent_size < len(client.secret):
 
1114
                    sent = session.send(client.secret[sent_size:])
 
1115
                    logger.debug(u"Sent: %d, remaining: %d",
 
1116
                                 sent, len(client.secret)
 
1117
                                 - (sent_size + sent))
 
1118
                    sent_size += sent
 
1119
            finally:
 
1120
                session.bye()
 
1121
    
 
1122
    @staticmethod
 
1123
    def peer_certificate(session):
 
1124
        "Return the peer's OpenPGP certificate as a bytestring"
 
1125
        # If not an OpenPGP certificate...
 
1126
        if (gnutls.library.functions
 
1127
            .gnutls_certificate_type_get(session._c_object)
 
1128
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1129
            # ...do the normal thing
 
1130
            return session.peer_certificate
 
1131
        list_size = ctypes.c_uint(1)
 
1132
        cert_list = (gnutls.library.functions
 
1133
                     .gnutls_certificate_get_peers
 
1134
                     (session._c_object, ctypes.byref(list_size)))
 
1135
        if not bool(cert_list) and list_size.value != 0:
 
1136
            raise gnutls.errors.GNUTLSError(u"error getting peer"
 
1137
                                            u" certificate")
 
1138
        if list_size.value == 0:
 
1139
            return None
 
1140
        cert = cert_list[0]
 
1141
        return ctypes.string_at(cert.data, cert.size)
 
1142
    
 
1143
    @staticmethod
 
1144
    def fingerprint(openpgp):
 
1145
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
 
1146
        # New GnuTLS "datum" with the OpenPGP public key
 
1147
        datum = (gnutls.library.types
 
1148
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1149
                                             ctypes.POINTER
 
1150
                                             (ctypes.c_ubyte)),
 
1151
                                 ctypes.c_uint(len(openpgp))))
 
1152
        # New empty GnuTLS certificate
 
1153
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1154
        (gnutls.library.functions
 
1155
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1156
        # Import the OpenPGP public key into the certificate
 
1157
        (gnutls.library.functions
 
1158
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1159
                                    gnutls.library.constants
 
1160
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1161
        # Verify the self signature in the key
 
1162
        crtverify = ctypes.c_uint()
 
1163
        (gnutls.library.functions
 
1164
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1165
                                         ctypes.byref(crtverify)))
 
1166
        if crtverify.value != 0:
 
1167
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1168
            raise (gnutls.errors.CertificateSecurityError
 
1169
                   (u"Verify failed"))
 
1170
        # New buffer for the fingerprint
 
1171
        buf = ctypes.create_string_buffer(20)
 
1172
        buf_len = ctypes.c_size_t()
 
1173
        # Get the fingerprint from the certificate into the buffer
 
1174
        (gnutls.library.functions
 
1175
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1176
                                             ctypes.byref(buf_len)))
 
1177
        # Deinit the certificate
 
1178
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1179
        # Convert the buffer to a Python bytestring
 
1180
        fpr = ctypes.string_at(buf, buf_len.value)
 
1181
        # Convert the bytestring to hexadecimal notation
 
1182
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1183
        return hex_fpr
 
1184
 
 
1185
 
 
1186
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
 
1187
    """Like socketserver.ForkingMixIn, but also pass a pipe pair."""
 
1188
    def process_request(self, request, client_address):
 
1189
        """Overrides and wraps the original process_request().
 
1190
        
 
1191
        This function creates a new pipe in self.pipe
 
1192
        """
 
1193
        # Child writes to child_pipe
 
1194
        self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
 
1195
        # Parent writes to parent_pipe
 
1196
        self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
 
1197
        super(ForkingMixInWithPipes,
 
1198
              self).process_request(request, client_address)
 
1199
        # Close unused ends for parent
 
1200
        self.parent_pipe[0].close() # close read end
 
1201
        self.child_pipe[1].close()  # close write end
 
1202
        self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
 
1203
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
 
1204
        """Dummy function; override as necessary"""
 
1205
        child_pipe_fd.close()
 
1206
        parent_pipe_fd.close()
 
1207
 
 
1208
 
 
1209
class IPv6_TCPServer(ForkingMixInWithPipes,
 
1210
                     socketserver.TCPServer, object):
 
1211
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
1212
    
522
1213
    Attributes:
523
 
        settings:       Server settings
524
 
        clients:        Set() of Client objects
525
1214
        enabled:        Boolean; whether this server is activated yet
 
1215
        interface:      None or a network interface name (string)
 
1216
        use_ipv6:       Boolean; to use IPv6 or not
526
1217
    """
527
 
    address_family = socket.AF_INET6
528
 
    def __init__(self, *args, **kwargs):
529
 
        if "settings" in kwargs:
530
 
            self.settings = kwargs["settings"]
531
 
            del kwargs["settings"]
532
 
        if "clients" in kwargs:
533
 
            self.clients = kwargs["clients"]
534
 
            del kwargs["clients"]
535
 
        self.enabled = False
536
 
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
 
1218
    def __init__(self, server_address, RequestHandlerClass,
 
1219
                 interface=None, use_ipv6=True):
 
1220
        self.interface = interface
 
1221
        if use_ipv6:
 
1222
            self.address_family = socket.AF_INET6
 
1223
        socketserver.TCPServer.__init__(self, server_address,
 
1224
                                        RequestHandlerClass)
537
1225
    def server_bind(self):
538
1226
        """This overrides the normal server_bind() function
539
1227
        to bind to an interface if one was specified, and also NOT to
540
1228
        bind to an address or port if they were not specified."""
541
 
        if self.settings["interface"]:
542
 
            # 25 is from /usr/include/asm-i486/socket.h
543
 
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
544
 
            try:
545
 
                self.socket.setsockopt(socket.SOL_SOCKET,
546
 
                                       SO_BINDTODEVICE,
547
 
                                       self.settings["interface"])
548
 
            except socket.error, error:
549
 
                if error[0] == errno.EPERM:
550
 
                    logger.error(u"No permission to"
551
 
                                 u" bind to interface %s",
552
 
                                 self.settings["interface"])
553
 
                else:
554
 
                    raise error
 
1229
        if self.interface is not None:
 
1230
            if SO_BINDTODEVICE is None:
 
1231
                logger.error(u"SO_BINDTODEVICE does not exist;"
 
1232
                             u" cannot bind to interface %s",
 
1233
                             self.interface)
 
1234
            else:
 
1235
                try:
 
1236
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1237
                                           SO_BINDTODEVICE,
 
1238
                                           str(self.interface
 
1239
                                               + u'\0'))
 
1240
                except socket.error, error:
 
1241
                    if error[0] == errno.EPERM:
 
1242
                        logger.error(u"No permission to"
 
1243
                                     u" bind to interface %s",
 
1244
                                     self.interface)
 
1245
                    elif error[0] == errno.ENOPROTOOPT:
 
1246
                        logger.error(u"SO_BINDTODEVICE not available;"
 
1247
                                     u" cannot bind to interface %s",
 
1248
                                     self.interface)
 
1249
                    else:
 
1250
                        raise
555
1251
        # Only bind(2) the socket if we really need to.
556
1252
        if self.server_address[0] or self.server_address[1]:
557
1253
            if not self.server_address[0]:
558
 
                in6addr_any = "::"
559
 
                self.server_address = (in6addr_any,
 
1254
                if self.address_family == socket.AF_INET6:
 
1255
                    any_address = u"::" # in6addr_any
 
1256
                else:
 
1257
                    any_address = socket.INADDR_ANY
 
1258
                self.server_address = (any_address,
560
1259
                                       self.server_address[1])
561
1260
            elif not self.server_address[1]:
562
1261
                self.server_address = (self.server_address[0],
563
1262
                                       0)
564
 
#                 if self.settings["interface"]:
 
1263
#                 if self.interface:
565
1264
#                     self.server_address = (self.server_address[0],
566
1265
#                                            0, # port
567
1266
#                                            0, # flowinfo
568
1267
#                                            if_nametoindex
569
 
#                                            (self.settings
570
 
#                                             ["interface"]))
571
 
            return super(IPv6_TCPServer, self).server_bind()
 
1268
#                                            (self.interface))
 
1269
            return socketserver.TCPServer.server_bind(self)
 
1270
 
 
1271
 
 
1272
class MandosServer(IPv6_TCPServer):
 
1273
    """Mandos server.
 
1274
    
 
1275
    Attributes:
 
1276
        clients:        set of Client objects
 
1277
        gnutls_priority GnuTLS priority string
 
1278
        use_dbus:       Boolean; to emit D-Bus signals or not
 
1279
    
 
1280
    Assumes a gobject.MainLoop event loop.
 
1281
    """
 
1282
    def __init__(self, server_address, RequestHandlerClass,
 
1283
                 interface=None, use_ipv6=True, clients=None,
 
1284
                 gnutls_priority=None, use_dbus=True):
 
1285
        self.enabled = False
 
1286
        self.clients = clients
 
1287
        if self.clients is None:
 
1288
            self.clients = set()
 
1289
        self.use_dbus = use_dbus
 
1290
        self.gnutls_priority = gnutls_priority
 
1291
        IPv6_TCPServer.__init__(self, server_address,
 
1292
                                RequestHandlerClass,
 
1293
                                interface = interface,
 
1294
                                use_ipv6 = use_ipv6)
572
1295
    def server_activate(self):
573
1296
        if self.enabled:
574
 
            return super(IPv6_TCPServer, self).server_activate()
 
1297
            return socketserver.TCPServer.server_activate(self)
575
1298
    def enable(self):
576
1299
        self.enabled = True
 
1300
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
 
1301
        # Call "handle_ipc" for both data and EOF events
 
1302
        gobject.io_add_watch(child_pipe_fd.fileno(),
 
1303
                             gobject.IO_IN | gobject.IO_HUP,
 
1304
                             functools.partial(self.handle_ipc,
 
1305
                                               reply = parent_pipe_fd,
 
1306
                                               sender= child_pipe_fd))
 
1307
    def handle_ipc(self, source, condition, reply=None, sender=None):
 
1308
        condition_names = {
 
1309
            gobject.IO_IN: u"IN",   # There is data to read.
 
1310
            gobject.IO_OUT: u"OUT", # Data can be written (without
 
1311
                                    # blocking).
 
1312
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
 
1313
            gobject.IO_ERR: u"ERR", # Error condition.
 
1314
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
 
1315
                                    # broken, usually for pipes and
 
1316
                                    # sockets).
 
1317
            }
 
1318
        conditions_string = ' | '.join(name
 
1319
                                       for cond, name in
 
1320
                                       condition_names.iteritems()
 
1321
                                       if cond & condition)
 
1322
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
 
1323
                     conditions_string)
 
1324
        
 
1325
        # Read a line from the file object
 
1326
        cmdline = sender.readline()
 
1327
        if not cmdline:             # Empty line means end of file
 
1328
            # close the IPC pipes
 
1329
            sender.close()
 
1330
            reply.close()
 
1331
            
 
1332
            # Stop calling this function
 
1333
            return False
 
1334
        
 
1335
        logger.debug(u"IPC command: %r", cmdline)
 
1336
        
 
1337
        # Parse and act on command
 
1338
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
 
1339
        
 
1340
        if cmd == u"NOTFOUND":
 
1341
            fpr, address = args.split(None, 1)
 
1342
            logger.warning(u"Client not found for fingerprint: %s, ad"
 
1343
                           u"dress: %s", fpr, address)
 
1344
            if self.use_dbus:
 
1345
                # Emit D-Bus signal
 
1346
                mandos_dbus_service.ClientNotFound(fpr, address)
 
1347
        elif cmd == u"DISABLED":
 
1348
            for client in self.clients:
 
1349
                if client.name == args:
 
1350
                    logger.warning(u"Client %s is disabled", args)
 
1351
                    if self.use_dbus:
 
1352
                        # Emit D-Bus signal
 
1353
                        client.Rejected()
 
1354
                    break
 
1355
            else:
 
1356
                logger.error(u"Unknown client %s is disabled", args)
 
1357
        elif cmd == u"SENDING":
 
1358
            for client in self.clients:
 
1359
                if client.name == args:
 
1360
                    logger.info(u"Sending secret to %s", client.name)
 
1361
                    client.checked_ok()
 
1362
                    if self.use_dbus:
 
1363
                        # Emit D-Bus signal
 
1364
                        client.GotSecret()
 
1365
                    break
 
1366
            else:
 
1367
                logger.error(u"Sending secret to unknown client %s",
 
1368
                             args)
 
1369
        elif cmd == u"GETATTR":
 
1370
            attr_name, fpr = args.split(None, 1)
 
1371
            for client in self.clients:
 
1372
                if client.fingerprint == fpr:
 
1373
                    attr_value = getattr(client, attr_name, None)
 
1374
                    logger.debug("IPC reply: %r", attr_value)
 
1375
                    pickle.dump(attr_value, reply)
 
1376
                    break
 
1377
            else:
 
1378
                logger.error(u"Client %s on address %s requesting "
 
1379
                             u"attribute %s not found", fpr, address,
 
1380
                             attr_name)
 
1381
                pickle.dump(None, reply)
 
1382
        else:
 
1383
            logger.error(u"Unknown IPC command: %r", cmdline)
 
1384
        
 
1385
        # Keep calling this function
 
1386
        return True
577
1387
 
578
1388
 
579
1389
def string_to_delta(interval):
580
1390
    """Parse a string and return a datetime.timedelta
581
 
 
582
 
    >>> string_to_delta('7d')
 
1391
    
 
1392
    >>> string_to_delta(u'7d')
583
1393
    datetime.timedelta(7)
584
 
    >>> string_to_delta('60s')
 
1394
    >>> string_to_delta(u'60s')
585
1395
    datetime.timedelta(0, 60)
586
 
    >>> string_to_delta('60m')
 
1396
    >>> string_to_delta(u'60m')
587
1397
    datetime.timedelta(0, 3600)
588
 
    >>> string_to_delta('24h')
 
1398
    >>> string_to_delta(u'24h')
589
1399
    datetime.timedelta(1)
590
1400
    >>> string_to_delta(u'1w')
591
1401
    datetime.timedelta(7)
592
 
    >>> string_to_delta('5m 30s')
 
1402
    >>> string_to_delta(u'5m 30s')
593
1403
    datetime.timedelta(0, 330)
594
1404
    """
595
1405
    timevalue = datetime.timedelta(0)
608
1418
            elif suffix == u"w":
609
1419
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
610
1420
            else:
611
 
                raise ValueError
612
 
        except (ValueError, IndexError):
613
 
            raise ValueError
 
1421
                raise ValueError(u"Unknown suffix %r" % suffix)
 
1422
        except (ValueError, IndexError), e:
 
1423
            raise ValueError(e.message)
614
1424
        timevalue += delta
615
1425
    return timevalue
616
1426
 
617
1427
 
618
 
def server_state_changed(state):
619
 
    """Derived from the Avahi example code"""
620
 
    if state == avahi.SERVER_COLLISION:
621
 
        logger.error(u"Zeroconf server name collision")
622
 
        service.remove()
623
 
    elif state == avahi.SERVER_RUNNING:
624
 
        service.add()
625
 
 
626
 
 
627
 
def entry_group_state_changed(state, error):
628
 
    """Derived from the Avahi example code"""
629
 
    logger.debug(u"Avahi state change: %i", state)
630
 
    
631
 
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
632
 
        logger.debug(u"Zeroconf service established.")
633
 
    elif state == avahi.ENTRY_GROUP_COLLISION:
634
 
        logger.warning(u"Zeroconf service name collision.")
635
 
        service.rename()
636
 
    elif state == avahi.ENTRY_GROUP_FAILURE:
637
 
        logger.critical(u"Avahi: Error in group state changed %s",
638
 
                        unicode(error))
639
 
        raise AvahiGroupError("State changed: %s", str(error))
640
 
 
641
1428
def if_nametoindex(interface):
642
 
    """Call the C function if_nametoindex(), or equivalent"""
 
1429
    """Call the C function if_nametoindex(), or equivalent
 
1430
    
 
1431
    Note: This function cannot accept a unicode string."""
643
1432
    global if_nametoindex
644
1433
    try:
645
 
        if_nametoindex = ctypes.cdll.LoadLibrary\
646
 
            (ctypes.util.find_library("c")).if_nametoindex
 
1434
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1435
                          (ctypes.util.find_library(u"c"))
 
1436
                          .if_nametoindex)
647
1437
    except (OSError, AttributeError):
648
 
        if "struct" not in sys.modules:
649
 
            import struct
650
 
        if "fcntl" not in sys.modules:
651
 
            import fcntl
 
1438
        logger.warning(u"Doing if_nametoindex the hard way")
652
1439
        def if_nametoindex(interface):
653
1440
            "Get an interface index the hard way, i.e. using fcntl()"
654
1441
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
655
 
            s = socket.socket()
656
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
657
 
                                struct.pack("16s16x", interface))
658
 
            s.close()
659
 
            interface_index = struct.unpack("I", ifreq[16:20])[0]
 
1442
            with contextlib.closing(socket.socket()) as s:
 
1443
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1444
                                    struct.pack(str(u"16s16x"),
 
1445
                                                interface))
 
1446
            interface_index = struct.unpack(str(u"I"),
 
1447
                                            ifreq[16:20])[0]
660
1448
            return interface_index
661
1449
    return if_nametoindex(interface)
662
1450
 
663
1451
 
664
1452
def daemon(nochdir = False, noclose = False):
665
1453
    """See daemon(3).  Standard BSD Unix function.
 
1454
    
666
1455
    This should really exist as os.daemon, but it doesn't (yet)."""
667
1456
    if os.fork():
668
1457
        sys.exit()
669
1458
    os.setsid()
670
1459
    if not nochdir:
671
 
        os.chdir("/")
 
1460
        os.chdir(u"/")
672
1461
    if os.fork():
673
1462
        sys.exit()
674
1463
    if not noclose:
676
1465
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
677
1466
        if not stat.S_ISCHR(os.fstat(null).st_mode):
678
1467
            raise OSError(errno.ENODEV,
679
 
                          "/dev/null not a character device")
 
1468
                          u"%s not a character device"
 
1469
                          % os.path.devnull)
680
1470
        os.dup2(null, sys.stdin.fileno())
681
1471
        os.dup2(null, sys.stdout.fileno())
682
1472
        os.dup2(null, sys.stderr.fileno())
685
1475
 
686
1476
 
687
1477
def main():
688
 
    parser = OptionParser(version = "%%prog %s" % version)
689
 
    parser.add_option("-i", "--interface", type="string",
690
 
                      metavar="IF", help="Bind to interface IF")
691
 
    parser.add_option("-a", "--address", type="string",
692
 
                      help="Address to listen for requests on")
693
 
    parser.add_option("-p", "--port", type="int",
694
 
                      help="Port number to receive requests on")
695
 
    parser.add_option("--check", action="store_true", default=False,
696
 
                      help="Run self-test")
697
 
    parser.add_option("--debug", action="store_true",
698
 
                      help="Debug mode; run in foreground and log to"
699
 
                      " terminal")
700
 
    parser.add_option("--priority", type="string", help="GnuTLS"
701
 
                      " priority string (see GnuTLS documentation)")
702
 
    parser.add_option("--servicename", type="string", metavar="NAME",
703
 
                      help="Zeroconf service name")
704
 
    parser.add_option("--configdir", type="string",
705
 
                      default="/etc/mandos", metavar="DIR",
706
 
                      help="Directory to search for configuration"
707
 
                      " files")
 
1478
    
 
1479
    ##################################################################
 
1480
    # Parsing of options, both command line and config file
 
1481
    
 
1482
    parser = optparse.OptionParser(version = "%%prog %s" % version)
 
1483
    parser.add_option("-i", u"--interface", type=u"string",
 
1484
                      metavar="IF", help=u"Bind to interface IF")
 
1485
    parser.add_option("-a", u"--address", type=u"string",
 
1486
                      help=u"Address to listen for requests on")
 
1487
    parser.add_option("-p", u"--port", type=u"int",
 
1488
                      help=u"Port number to receive requests on")
 
1489
    parser.add_option("--check", action=u"store_true",
 
1490
                      help=u"Run self-test")
 
1491
    parser.add_option("--debug", action=u"store_true",
 
1492
                      help=u"Debug mode; run in foreground and log to"
 
1493
                      u" terminal")
 
1494
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
 
1495
                      u" priority string (see GnuTLS documentation)")
 
1496
    parser.add_option("--servicename", type=u"string",
 
1497
                      metavar=u"NAME", help=u"Zeroconf service name")
 
1498
    parser.add_option("--configdir", type=u"string",
 
1499
                      default=u"/etc/mandos", metavar=u"DIR",
 
1500
                      help=u"Directory to search for configuration"
 
1501
                      u" files")
 
1502
    parser.add_option("--no-dbus", action=u"store_false",
 
1503
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
 
1504
                      u" system bus interface")
 
1505
    parser.add_option("--no-ipv6", action=u"store_false",
 
1506
                      dest=u"use_ipv6", help=u"Do not use IPv6")
708
1507
    options = parser.parse_args()[0]
709
1508
    
710
1509
    if options.check:
713
1512
        sys.exit()
714
1513
    
715
1514
    # Default values for config file for server-global settings
716
 
    server_defaults = { "interface": "",
717
 
                        "address": "",
718
 
                        "port": "",
719
 
                        "debug": "False",
720
 
                        "priority":
721
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
722
 
                        "servicename": "Mandos",
 
1515
    server_defaults = { u"interface": u"",
 
1516
                        u"address": u"",
 
1517
                        u"port": u"",
 
1518
                        u"debug": u"False",
 
1519
                        u"priority":
 
1520
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1521
                        u"servicename": u"Mandos",
 
1522
                        u"use_dbus": u"True",
 
1523
                        u"use_ipv6": u"True",
723
1524
                        }
724
1525
    
725
1526
    # Parse config file for server-global settings
726
 
    server_config = ConfigParser.SafeConfigParser(server_defaults)
 
1527
    server_config = configparser.SafeConfigParser(server_defaults)
727
1528
    del server_defaults
728
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
1529
    server_config.read(os.path.join(options.configdir,
 
1530
                                    u"mandos.conf"))
729
1531
    # Convert the SafeConfigParser object to a dict
730
1532
    server_settings = server_config.defaults()
731
 
    # Use getboolean on the boolean config option
732
 
    server_settings["debug"] = server_config.getboolean\
733
 
                               ("DEFAULT", "debug")
 
1533
    # Use the appropriate methods on the non-string config options
 
1534
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
 
1535
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
1536
                                                           option)
 
1537
    if server_settings["port"]:
 
1538
        server_settings["port"] = server_config.getint(u"DEFAULT",
 
1539
                                                       u"port")
734
1540
    del server_config
735
1541
    
736
1542
    # Override the settings from the config file with command line
737
1543
    # options, if set.
738
 
    for option in ("interface", "address", "port", "debug",
739
 
                   "priority", "servicename", "configdir"):
 
1544
    for option in (u"interface", u"address", u"port", u"debug",
 
1545
                   u"priority", u"servicename", u"configdir",
 
1546
                   u"use_dbus", u"use_ipv6"):
740
1547
        value = getattr(options, option)
741
1548
        if value is not None:
742
1549
            server_settings[option] = value
743
1550
    del options
 
1551
    # Force all strings to be unicode
 
1552
    for option in server_settings.keys():
 
1553
        if type(server_settings[option]) is str:
 
1554
            server_settings[option] = unicode(server_settings[option])
744
1555
    # Now we have our good server settings in "server_settings"
745
1556
    
746
 
    debug = server_settings["debug"]
 
1557
    ##################################################################
 
1558
    
 
1559
    # For convenience
 
1560
    debug = server_settings[u"debug"]
 
1561
    use_dbus = server_settings[u"use_dbus"]
 
1562
    use_ipv6 = server_settings[u"use_ipv6"]
747
1563
    
748
1564
    if not debug:
749
1565
        syslogger.setLevel(logging.WARNING)
750
1566
        console.setLevel(logging.WARNING)
751
1567
    
752
 
    if server_settings["servicename"] != "Mandos":
753
 
        syslogger.setFormatter(logging.Formatter\
754
 
                               ('Mandos (%s): %%(levelname)s:'
755
 
                                ' %%(message)s'
756
 
                                % server_settings["servicename"]))
 
1568
    if server_settings[u"servicename"] != u"Mandos":
 
1569
        syslogger.setFormatter(logging.Formatter
 
1570
                               (u'Mandos (%s) [%%(process)d]:'
 
1571
                                u' %%(levelname)s: %%(message)s'
 
1572
                                % server_settings[u"servicename"]))
757
1573
    
758
1574
    # Parse config file with clients
759
 
    client_defaults = { "timeout": "1h",
760
 
                        "interval": "5m",
761
 
                        "checker": "fping -q -- %(host)s",
762
 
                        "host": "",
 
1575
    client_defaults = { u"timeout": u"1h",
 
1576
                        u"interval": u"5m",
 
1577
                        u"checker": u"fping -q -- %%(host)s",
 
1578
                        u"host": u"",
763
1579
                        }
764
 
    client_config = ConfigParser.SafeConfigParser(client_defaults)
765
 
    client_config.read(os.path.join(server_settings["configdir"],
766
 
                                    "clients.conf"))
767
 
    
768
 
    clients = Set()
769
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
770
 
                                 server_settings["port"]),
771
 
                                TCP_handler,
772
 
                                settings=server_settings,
773
 
                                clients=clients)
774
 
    pidfilename = "/var/run/mandos.pid"
775
 
    try:
776
 
        pidfile = open(pidfilename, "w")
777
 
    except IOError, error:
778
 
        logger.error("Could not open file %r", pidfilename)
779
 
    
780
 
    uid = 65534
781
 
    gid = 65534
782
 
    try:
783
 
        uid = pwd.getpwnam("mandos").pw_uid
784
 
    except KeyError:
785
 
        try:
786
 
            uid = pwd.getpwnam("nobody").pw_uid
787
 
        except KeyError:
788
 
            pass
789
 
    try:
790
 
        gid = pwd.getpwnam("mandos").pw_gid
791
 
    except KeyError:
792
 
        try:
793
 
            gid = pwd.getpwnam("nogroup").pw_gid
794
 
        except KeyError:
795
 
            pass
796
 
    try:
 
1580
    client_config = configparser.SafeConfigParser(client_defaults)
 
1581
    client_config.read(os.path.join(server_settings[u"configdir"],
 
1582
                                    u"clients.conf"))
 
1583
    
 
1584
    global mandos_dbus_service
 
1585
    mandos_dbus_service = None
 
1586
    
 
1587
    tcp_server = MandosServer((server_settings[u"address"],
 
1588
                               server_settings[u"port"]),
 
1589
                              ClientHandler,
 
1590
                              interface=server_settings[u"interface"],
 
1591
                              use_ipv6=use_ipv6,
 
1592
                              gnutls_priority=
 
1593
                              server_settings[u"priority"],
 
1594
                              use_dbus=use_dbus)
 
1595
    pidfilename = u"/var/run/mandos.pid"
 
1596
    try:
 
1597
        pidfile = open(pidfilename, u"w")
 
1598
    except IOError:
 
1599
        logger.error(u"Could not open file %r", pidfilename)
 
1600
    
 
1601
    try:
 
1602
        uid = pwd.getpwnam(u"_mandos").pw_uid
 
1603
        gid = pwd.getpwnam(u"_mandos").pw_gid
 
1604
    except KeyError:
 
1605
        try:
 
1606
            uid = pwd.getpwnam(u"mandos").pw_uid
 
1607
            gid = pwd.getpwnam(u"mandos").pw_gid
 
1608
        except KeyError:
 
1609
            try:
 
1610
                uid = pwd.getpwnam(u"nobody").pw_uid
 
1611
                gid = pwd.getpwnam(u"nobody").pw_gid
 
1612
            except KeyError:
 
1613
                uid = 65534
 
1614
                gid = 65534
 
1615
    try:
 
1616
        os.setgid(gid)
797
1617
        os.setuid(uid)
798
 
        os.setgid(gid)
799
1618
    except OSError, error:
800
1619
        if error[0] != errno.EPERM:
801
1620
            raise error
802
1621
    
803
 
    global service
804
 
    service = AvahiService(name = server_settings["servicename"],
805
 
                           servicetype = "_mandos._tcp", )
806
 
    if server_settings["interface"]:
807
 
        service.interface = if_nametoindex\
808
 
                            (server_settings["interface"])
 
1622
    # Enable all possible GnuTLS debugging
 
1623
    if debug:
 
1624
        # "Use a log level over 10 to enable all debugging options."
 
1625
        # - GnuTLS manual
 
1626
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
1627
        
 
1628
        @gnutls.library.types.gnutls_log_func
 
1629
        def debug_gnutls(level, string):
 
1630
            logger.debug(u"GnuTLS: %s", string[:-1])
 
1631
        
 
1632
        (gnutls.library.functions
 
1633
         .gnutls_global_set_log_function(debug_gnutls))
809
1634
    
810
1635
    global main_loop
811
 
    global bus
812
 
    global server
813
1636
    # From the Avahi example code
814
1637
    DBusGMainLoop(set_as_default=True )
815
1638
    main_loop = gobject.MainLoop()
816
1639
    bus = dbus.SystemBus()
817
 
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
818
 
                                           avahi.DBUS_PATH_SERVER),
819
 
                            avahi.DBUS_INTERFACE_SERVER)
820
1640
    # End of Avahi example code
821
 
    
822
 
    def remove_from_clients(client):
823
 
        clients.remove(client)
824
 
        if not clients:
825
 
            logger.critical(u"No clients left, exiting")
826
 
            sys.exit()
827
 
    
828
 
    clients.update(Set(Client(name = section,
829
 
                              stop_hook = remove_from_clients,
830
 
                              config
831
 
                              = dict(client_config.items(section)))
832
 
                       for section in client_config.sections()))
833
 
    if not clients:
834
 
        logger.critical(u"No clients defined")
835
 
        sys.exit(1)
 
1641
    if use_dbus:
 
1642
        try:
 
1643
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
1644
                                            bus, do_not_queue=True)
 
1645
        except dbus.exceptions.NameExistsException, e:
 
1646
            logger.error(unicode(e) + u", disabling D-Bus")
 
1647
            use_dbus = False
 
1648
            server_settings[u"use_dbus"] = False
 
1649
            tcp_server.use_dbus = False
 
1650
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
1651
    service = AvahiService(name = server_settings[u"servicename"],
 
1652
                           servicetype = u"_mandos._tcp",
 
1653
                           protocol = protocol, bus = bus)
 
1654
    if server_settings["interface"]:
 
1655
        service.interface = (if_nametoindex
 
1656
                             (str(server_settings[u"interface"])))
 
1657
    
 
1658
    client_class = Client
 
1659
    if use_dbus:
 
1660
        client_class = functools.partial(ClientDBus, bus = bus)
 
1661
    tcp_server.clients.update(set(
 
1662
            client_class(name = section,
 
1663
                         config= dict(client_config.items(section)))
 
1664
            for section in client_config.sections()))
 
1665
    if not tcp_server.clients:
 
1666
        logger.warning(u"No clients defined")
836
1667
    
837
1668
    if debug:
838
1669
        # Redirect stdin so all checkers get /dev/null
847
1678
        daemon()
848
1679
    
849
1680
    try:
850
 
        pid = os.getpid()
851
 
        pidfile.write(str(pid) + "\n")
852
 
        pidfile.close()
 
1681
        with pidfile:
 
1682
            pid = os.getpid()
 
1683
            pidfile.write(str(pid) + "\n")
853
1684
        del pidfile
854
1685
    except IOError:
855
1686
        logger.error(u"Could not write to file %r with PID %d",
859
1690
        pass
860
1691
    del pidfilename
861
1692
    
 
1693
    if not debug:
 
1694
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
1695
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
 
1696
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
 
1697
    
 
1698
    if use_dbus:
 
1699
        class MandosDBusService(dbus.service.Object):
 
1700
            """A D-Bus proxy object"""
 
1701
            def __init__(self):
 
1702
                dbus.service.Object.__init__(self, bus, u"/")
 
1703
            _interface = u"se.bsnet.fukt.Mandos"
 
1704
            
 
1705
            @dbus.service.signal(_interface, signature=u"o")
 
1706
            def ClientAdded(self, objpath):
 
1707
                "D-Bus signal"
 
1708
                pass
 
1709
            
 
1710
            @dbus.service.signal(_interface, signature=u"ss")
 
1711
            def ClientNotFound(self, fingerprint, address):
 
1712
                "D-Bus signal"
 
1713
                pass
 
1714
            
 
1715
            @dbus.service.signal(_interface, signature=u"os")
 
1716
            def ClientRemoved(self, objpath, name):
 
1717
                "D-Bus signal"
 
1718
                pass
 
1719
            
 
1720
            @dbus.service.method(_interface, out_signature=u"ao")
 
1721
            def GetAllClients(self):
 
1722
                "D-Bus method"
 
1723
                return dbus.Array(c.dbus_object_path
 
1724
                                  for c in tcp_server.clients)
 
1725
            
 
1726
            @dbus.service.method(_interface,
 
1727
                                 out_signature=u"a{oa{sv}}")
 
1728
            def GetAllClientsWithProperties(self):
 
1729
                "D-Bus method"
 
1730
                return dbus.Dictionary(
 
1731
                    ((c.dbus_object_path, c.GetAll(u""))
 
1732
                     for c in tcp_server.clients),
 
1733
                    signature=u"oa{sv}")
 
1734
            
 
1735
            @dbus.service.method(_interface, in_signature=u"o")
 
1736
            def RemoveClient(self, object_path):
 
1737
                "D-Bus method"
 
1738
                for c in tcp_server.clients:
 
1739
                    if c.dbus_object_path == object_path:
 
1740
                        tcp_server.clients.remove(c)
 
1741
                        c.remove_from_connection()
 
1742
                        # Don't signal anything except ClientRemoved
 
1743
                        c.disable(quiet=True)
 
1744
                        # Emit D-Bus signal
 
1745
                        self.ClientRemoved(object_path, c.name)
 
1746
                        return
 
1747
                raise KeyError(object_path)
 
1748
            
 
1749
            del _interface
 
1750
        
 
1751
        mandos_dbus_service = MandosDBusService()
 
1752
    
862
1753
    def cleanup():
863
1754
        "Cleanup function; run on exit"
864
 
        global group
865
 
        # From the Avahi example code
866
 
        if not group is None:
867
 
            group.Free()
868
 
            group = None
869
 
        # End of Avahi example code
 
1755
        service.cleanup()
870
1756
        
871
 
        while clients:
872
 
            client = clients.pop()
873
 
            client.stop_hook = None
874
 
            client.stop()
 
1757
        while tcp_server.clients:
 
1758
            client = tcp_server.clients.pop()
 
1759
            if use_dbus:
 
1760
                client.remove_from_connection()
 
1761
            client.disable_hook = None
 
1762
            # Don't signal anything except ClientRemoved
 
1763
            client.disable(quiet=True)
 
1764
            if use_dbus:
 
1765
                # Emit D-Bus signal
 
1766
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
1767
                                                  client.name)
875
1768
    
876
1769
    atexit.register(cleanup)
877
1770
    
878
 
    if not debug:
879
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
880
 
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
881
 
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
882
 
    
883
 
    for client in clients:
884
 
        client.start()
 
1771
    for client in tcp_server.clients:
 
1772
        if use_dbus:
 
1773
            # Emit D-Bus signal
 
1774
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
1775
        client.enable()
885
1776
    
886
1777
    tcp_server.enable()
887
1778
    tcp_server.server_activate()
888
1779
    
889
1780
    # Find out what port we got
890
1781
    service.port = tcp_server.socket.getsockname()[1]
891
 
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
892
 
                u" scope_id %d" % tcp_server.socket.getsockname())
 
1782
    if use_ipv6:
 
1783
        logger.info(u"Now listening on address %r, port %d,"
 
1784
                    " flowinfo %d, scope_id %d"
 
1785
                    % tcp_server.socket.getsockname())
 
1786
    else:                       # IPv4
 
1787
        logger.info(u"Now listening on address %r, port %d"
 
1788
                    % tcp_server.socket.getsockname())
893
1789
    
894
1790
    #service.interface = tcp_server.socket.getsockname()[3]
895
1791
    
896
1792
    try:
897
1793
        # From the Avahi example code
898
 
        server.connect_to_signal("StateChanged", server_state_changed)
899
1794
        try:
900
 
            server_state_changed(server.GetState())
 
1795
            service.activate()
901
1796
        except dbus.exceptions.DBusException, error:
902
1797
            logger.critical(u"DBusException: %s", error)
 
1798
            cleanup()
903
1799
            sys.exit(1)
904
1800
        # End of Avahi example code
905
1801
        
906
1802
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
907
1803
                             lambda *args, **kwargs:
908
 
                             tcp_server.handle_request\
909
 
                             (*args[2:], **kwargs) or True)
 
1804
                             (tcp_server.handle_request
 
1805
                              (*args[2:], **kwargs) or True))
910
1806
        
911
1807
        logger.debug(u"Starting main loop")
912
1808
        main_loop.run()
913
1809
    except AvahiError, error:
914
 
        logger.critical(u"AvahiError: %s" + unicode(error))
 
1810
        logger.critical(u"AvahiError: %s", error)
 
1811
        cleanup()
915
1812
        sys.exit(1)
916
1813
    except KeyboardInterrupt:
917
1814
        if debug:
918
 
            print
 
1815
            print >> sys.stderr
 
1816
        logger.debug(u"Server received KeyboardInterrupt")
 
1817
    logger.debug(u"Server exiting")
 
1818
    # Must run before the D-Bus bus name gets deregistered
 
1819
    cleanup()
919
1820
 
920
1821
if __name__ == '__main__':
921
1822
    main()