/mandos/trunk : revision 24.2.1

55

import logging

56

import logging.handlers

57

import pwd

58

from contextlib import closing

58

import contextlib

59

import struct

60

import fcntl

61

import functools

62

import cPickle as pickle

63

import multiprocessing

62

64

63

65

import dbus

64

66

import dbus.service

96

98

u' %(message)s'))

97

99

logger.addHandler(console)

98

100

101

multiprocessing_manager = multiprocessing.Manager()

102

99

103

class AvahiError(Exception):

100

104

def __init__(self, value, *args, **kwargs):

101

105

self.value = value

242

246

enabled: bool()

243

247

last_checked_ok: datetime.datetime(); (UTC) or None

244

248

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

249

until this client is disabled

246

250

interval: datetime.timedelta(); How often to start a new checker

247

251

disable_hook: If set, called by disable() as disable_hook(self)

248

252

checker: subprocess.Popen(); a running checker process used

256

260

runtime with vars(self) as dict, so that for

257

261

instance %(name)s can be used in the command.

258

262

current_checker_command: string; current running checker_command

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

259

266

"""

260

267

261

268

@staticmethod

272

279

def interval_milliseconds(self):

273

280

"Return the 'interval' attribute in milliseconds"

274

281

return self._timedelta_to_milliseconds(self.interval)

282

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

275

285

276

286

def __init__(self, name = None, disable_hook=None, config=None):

277

287

"""Note: the 'checker' key in 'config' sets the

290

300

if u"secret" in config:

291

301

self.secret = config[u"secret"].decode(u"base64")

292

302

elif u"secfile" in config:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])),

296

"rb")) as secfile:

303

with open(os.path.expanduser(os.path.expandvars

304

(config[u"secfile"])),

305

"rb") as secfile:

297

306

self.secret = secfile.read()

298

307

else:

308

#XXX Need to allow secret on demand!

299

309

raise TypeError(u"No secret or secfile for client %s"

300

310

% self.name)

301

311

self.host = config.get(u"host", u"")

313

323

self.checker_command = config[u"checker"]

314

324

self.current_checker_command = None

315

325

self.last_connect = None

316

326

self.approvals_pending = 0

327

self._approved = None

328

self.approved_by_default = config.get(u"approved_by_default",

329

True)

330

self.approved_delay = string_to_delta(

331

config[u"approved_delay"])

332

self.approved_duration = string_to_delta(

333

config[u"approved_duration"])

334

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

335

336

def send_changedstate(self):

337

self.changedstate.acquire()

338

self.changedstate.notify_all()

339

self.changedstate.release()

340

317

341

def enable(self):

318

342

"""Start this client's checker and timeout hooks"""

319

343

if getattr(self, u"enabled", False):

320

344

# Already enabled

321

345

return

346

self.send_changedstate()

322

347

self.last_enabled = datetime.datetime.utcnow()

323

348

# Schedule a new checker to be started an 'interval' from now,

324

349

# and every interval from then on.

338

363

if not getattr(self, "enabled", False):

339

364

return False

340

365

if not quiet:

366

self.send_changedstate()

367

if not quiet:

341

368

logger.info(u"Disabling client %s", self.name)

342

369

if getattr(self, u"disable_initiator_tag", False):

343

370

gobject.source_remove(self.disable_initiator_tag)

396

423

# client would inevitably timeout, since no checker would get

397

424

# a chance to run to completion. If we instead leave running

398

425

# checkers alone, the checker would have to take more time

399

# than 'timeout' for the client to be declared invalid, which

400

# is as it should be.

426

# than 'timeout' for the client to be disabled, which is as it

427

# should be.

401

428

402

429

# If a checker exists, make sure it is not a zombie

403

430

try:

475

502

if error.errno != errno.ESRCH: # No such process

476

503

raise

477

504

self.checker = None

478

479

def still_valid(self):

480

"""Has the timeout not yet passed for this client?"""

481

if not getattr(self, u"enabled", False):

482

return False

483

now = datetime.datetime.utcnow()

484

if self.last_checked_ok is None:

485

return now < (self.created + self.timeout)

486

else:

487

return now < (self.last_checked_ok + self.timeout)

488

489

505

490

506

def dbus_service_property(dbus_interface, signature=u"v",

491

507

access=u"readwrite", byte_arrays=False):

499

515

dbus.service.method, except there is only "signature", since the

500

516

type from Get() and the type sent to Set() is the same.

501

517

"""

518

# Encoding deeply encoded byte arrays is not supported yet by the

519

# "Set" method, so we fail early here:

520

if byte_arrays and signature != u"ay":

521

raise ValueError(u"Byte arrays not supported for non-'ay'"

522

u" signature %r" % signature)

502

523

def decorator(func):

503

524

func._dbus_is_property = True

504

525

func._dbus_interface = dbus_interface

590

611

if prop._dbus_access == u"read":

591

612

raise DBusPropertyAccessException(property_name)

592

613

if prop._dbus_get_args_options[u"byte_arrays"]:

614

# The byte_arrays option is not supported yet on

615

# signatures other than "ay".

616

if prop._dbus_signature != u"ay":

617

raise ValueError

593

618

value = dbus.ByteArray(''.join(unichr(byte)

594

619

for byte in value))

595

620

prop(value)

708

733

709

734

def disable(self, quiet = False):

710

735

oldstate = getattr(self, u"enabled", False)

711

r = Client.disable(self, log=signal)

736

r = Client.disable(self, quiet=quiet)

712

737

if not quiet and oldstate != self.enabled:

713

738

# Emit D-Bus signal

714

739

self.PropertyChanged(dbus.String(u"enabled"),

780

805

self.PropertyChanged(dbus.String(u"checker_running"),

781

806

dbus.Boolean(False, variant_level=1))

782

807

return r

783

784

## D-Bus methods & signals

808

809

def _reset_approved(self):

810

self._approved = None

811

return False

812

813

def approve(self, value=True):

814

self._approved = value

815

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))

816

817

def approved_pending(self):

818

return self.approvals_pending > 0

819

820

821

## D-Bus methods, signals & properties

785

822

_interface = u"se.bsnet.fukt.Mandos.Client"

786

823

787

# CheckedOK - method

788

@dbus.service.method(_interface)

789

def CheckedOK(self):

790

return self.checked_ok()

824

## Signals

791

825

792

826

# CheckerCompleted - signal

793

827

@dbus.service.signal(_interface, signature=u"nxs")

811

845

@dbus.service.signal(_interface)

812

846

def GotSecret(self):

813

847

"D-Bus signal"

814

pass

848

if self.approved_pending():

849

self.PropertyChanged(dbus.String(u"checker_running"),

850

dbus.Boolean(False, variant_level=1))

815

851

816

852

# Rejected - signal

817

@dbus.service.signal(_interface)

818

def Rejected(self):

819

"D-Bus signal"

820

pass

853

@dbus.service.signal(_interface, signature=u"s")

854

def Rejected(self, reason):

855

"D-Bus signal"

856

if self.approved_pending():

857

self.PropertyChanged(dbus.String(u"checker_running"),

858

dbus.Boolean(False, variant_level=1))

859

860

# NeedApproval - signal

861

@dbus.service.signal(_interface, signature=u"db")

862

def NeedApproval(self, timeout, default):

863

"D-Bus signal"

864

if not self.approved_pending():

865

self.PropertyChanged(dbus.String(u"approved_pending"),

866

dbus.Boolean(True, variant_level=1))

867

868

## Methods

869

870

# Approve - method

871

@dbus.service.method(_interface, in_signature=u"b")

872

def Approve(self, value):

873

self.approve(value)

874

875

# CheckedOK - method

876

@dbus.service.method(_interface)

877

def CheckedOK(self):

878

return self.checked_ok()

821

879

822

880

# Enable - method

823

881

@dbus.service.method(_interface)

842

900

def StopChecker(self):

843

901

self.stop_checker()

844

902

903

## Properties

904

905

# approved_pending - property

906

@dbus_service_property(_interface, signature=u"b", access=u"read")

907

def approved_pending_dbus_property(self):

908

return dbus.Boolean(self.approved_pending())

909

910

# approved_by_default - property

911

@dbus_service_property(_interface, signature=u"b",

912

access=u"readwrite")

913

def approved_by_default_dbus_property(self):

914

return dbus.Boolean(self.approved_by_default)

915

916

# approved_delay - property

917

@dbus_service_property(_interface, signature=u"t",

918

access=u"readwrite")

919

def approved_delay_dbus_property(self):

920

return dbus.UInt64(self.approved_delay_milliseconds())

921

922

# approved_duration - property

923

@dbus_service_property(_interface, signature=u"t",

924

access=u"readwrite")

925

def approved_duration_dbus_property(self):

926

return dbus.UInt64(self._timedelta_to_milliseconds(

927

self.approved_duration))

928

845

929

# name - property

846

930

@dbus_service_property(_interface, signature=u"s", access=u"read")

847

931

def name_dbus_property(self):

981

1065

del _interface

982

1066

983

1067

1068

class ProxyClient(object):

1069

def __init__(self, child_pipe, fpr, address):

1070

self._pipe = child_pipe

1071

self._pipe.send(('init', fpr, address))

1072

if not self._pipe.recv():

1073

raise KeyError()

1074

1075

def __getattribute__(self, name):

1076

if(name == '_pipe'):

1077

return super(ProxyClient, self).__getattribute__(name)

1078

self._pipe.send(('getattr', name))

1079

data = self._pipe.recv()

1080

if data[0] == 'data':

1081

return data[1]

1082

if data[0] == 'function':

1083

def func(*args, **kwargs):

1084

self._pipe.send(('funcall', name, args, kwargs))

1085

return self._pipe.recv()[1]

1086

return func

1087

1088

def __setattr__(self, name, value):

1089

if(name == '_pipe'):

1090

return super(ProxyClient, self).__setattr__(name, value)

1091

self._pipe.send(('setattr', name, value))

1092

1093

984

1094

class ClientHandler(socketserver.BaseRequestHandler, object):

985

1095

"""A class to handle client connections.

986

1096

988

1098

Note: This will run in its own forked process."""

989

1099

990

1100

def handle(self):

991

logger.info(u"TCP connection from: %s",

992

unicode(self.client_address))

993

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

994

# Open IPC pipe to parent process

995

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1101

with contextlib.closing(self.server.child_pipe) as child_pipe:

1102

logger.info(u"TCP connection from: %s",

1103

unicode(self.client_address))

1104

logger.debug(u"Pipe FD: %d",

1105

self.server.child_pipe.fileno())

1106

996

1107

session = (gnutls.connection

997

1108

.ClientSession(self.request,

998

1109

gnutls.connection

999

1110

.X509Credentials()))

1000

1001

line = self.request.makefile().readline()

1002

logger.debug(u"Protocol version: %r", line)

1003

try:

1004

if int(line.strip().split()[0]) > 1:

1005

raise RuntimeError

1006

except (ValueError, IndexError, RuntimeError), error:

1007

logger.error(u"Unknown protocol version: %s", error)

1008

return

1009

1111

1010

1112

# Note: gnutls.connection.X509Credentials is really a

1011

1113

# generic GnuTLS certificate credentials object so long as

1012

1114

# no X.509 keys are added to it. Therefore, we can use it

1013

1115

# here despite using OpenPGP certificates.

1014

1116

1015

1117

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1016

1118

# u"+AES-256-CBC", u"+SHA1",

1017

1119

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1023

1125

(gnutls.library.functions

1024

1126

.gnutls_priority_set_direct(session._c_object,

1025

1127

priority, None))

1026

1128

1129

# Start communication using the Mandos protocol

1130

# Get protocol number

1131

line = self.request.makefile().readline()

1132

logger.debug(u"Protocol version: %r", line)

1133

try:

1134

if int(line.strip().split()[0]) > 1:

1135

raise RuntimeError

1136

except (ValueError, IndexError, RuntimeError), error:

1137

logger.error(u"Unknown protocol version: %s", error)

1138

return

1139

1140

# Start GnuTLS connection

1027

1141

try:

1028

1142

session.handshake()

1029

1143

except gnutls.errors.GNUTLSError, error:

1032

1146

# established. Just abandon the request.

1033

1147

return

1034

1148

logger.debug(u"Handshake succeeded")

1149

1150

approval_required = False

1035

1151

try:

1036

fpr = self.fingerprint(self.peer_certificate(session))

1037

except (TypeError, gnutls.errors.GNUTLSError), error:

1038

logger.warning(u"Bad certificate: %s", error)

1039

session.bye()

1040

return

1041

logger.debug(u"Fingerprint: %s", fpr)

1152

try:

1153

fpr = self.fingerprint(self.peer_certificate

1154

(session))

1155

except (TypeError, gnutls.errors.GNUTLSError), error:

1156

logger.warning(u"Bad certificate: %s", error)

1157

return

1158

logger.debug(u"Fingerprint: %s", fpr)

1159

1160

try:

1161

client = ProxyClient(child_pipe, fpr,

1162

self.client_address)

1163

except KeyError:

1164

return

1165

1166

if client.approved_delay:

1167

delay = client.approved_delay

1168

client.approvals_pending += 1

1169

approval_required = True

1170

1171

while True:

1172

if not client.enabled:

1173

logger.warning(u"Client %s is disabled",

1174

client.name)

1175

if self.server.use_dbus:

1176

# Emit D-Bus signal

1177

client.Rejected("Disabled")

1178

return

1179

1180

if client._approved or not client.approved_delay:

1181

#We are approved or approval is disabled

1182

break

1183

elif client._approved is None:

1184

logger.info(u"Client %s need approval",

1185

client.name)

1186

if self.server.use_dbus:

1187

# Emit D-Bus signal

1188

client.NeedApproval(

1189

client.approved_delay_milliseconds(),

1190

client.approved_by_default)

1191

else:

1192

logger.warning(u"Client %s was not approved",

1193

client.name)

1194

if self.server.use_dbus:

1195

# Emit D-Bus signal

1196

client.Rejected("Disapproved")

1197

return

1198

1199

#wait until timeout or approved

1200

#x = float(client._timedelta_to_milliseconds(delay))

1201

time = datetime.datetime.now()

1202

client.changedstate.acquire()

1203

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1204

client.changedstate.release()

1205

time2 = datetime.datetime.now()

1206

if (time2 - time) >= delay:

1207

if not client.approved_by_default:

1208

logger.warning("Client %s timed out while"

1209

" waiting for approval",

1210

client.name)

1211

if self.server.use_dbus:

1212

# Emit D-Bus signal

1213

client.Rejected("Time out")

1214

return

1215

else:

1216

break

1217

else:

1218

delay -= time2 - time

1219

1220

sent_size = 0

1221

while sent_size < len(client.secret):

1222

# XXX handle session exception

1223

sent = session.send(client.secret[sent_size:])

1224

logger.debug(u"Sent: %d, remaining: %d",

1225

sent, len(client.secret)

1226

- (sent_size + sent))

1227

sent_size += sent

1228

1229

logger.info(u"Sending secret to %s", client.name)

1230

# bump the timeout as if seen

1231

client.checked_ok()

1232

if self.server.use_dbus:

1233

# Emit D-Bus signal

1234

client.GotSecret()

1042

1235

1043

for c in self.server.clients:

1044

if c.fingerprint == fpr:

1045

client = c

1046

break

1047

else:

1048

ipc.write(u"NOTFOUND %s %s\n"

1049

% (fpr, unicode(self.client_address)))

1050

session.bye()

1051

return

1052

# Have to check if client.still_valid(), since it is

1053

# possible that the client timed out while establishing

1054

# the GnuTLS session.

1055

if not client.still_valid():

1056

ipc.write(u"INVALID %s\n" % client.name)

1057

session.bye()

1058

return

1059

ipc.write(u"SENDING %s\n" % client.name)

1060

sent_size = 0

1061

while sent_size < len(client.secret):

1062

sent = session.send(client.secret[sent_size:])

1063

logger.debug(u"Sent: %d, remaining: %d",

1064

sent, len(client.secret)

1065

- (sent_size + sent))

1066

sent_size += sent

1067

session.bye()

1236

finally:

1237

if approval_required:

1238

client.approvals_pending -= 1

1239

session.bye()

1068

1240

1069

1241

@staticmethod

1070

1242

def peer_certificate(session):

1130

1302

return hex_fpr

1131

1303

1132

1304

1133

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1134

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1305

class MultiprocessingMixIn(object):

1306

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1307

def sub_process_main(self, request, address):

1308

try:

1309

self.finish_request(request, address)

1310

except:

1311

self.handle_error(request, address)

1312

self.close_request(request)

1313

1314

def process_request(self, request, address):

1315

"""Start a new process to process the request."""

1316

multiprocessing.Process(target = self.sub_process_main,

1317

args = (request, address)).start()

1318

1319

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1320

""" adds a pipe to the MixIn """

1135

1321

def process_request(self, request, client_address):

1136

1322

"""Overrides and wraps the original process_request().

1137

1323

1138

1324

This function creates a new pipe in self.pipe

1139

1325

"""

1140

self.pipe = os.pipe()

1141

super(ForkingMixInWithPipe,

1326

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1327

1328

super(MultiprocessingMixInWithPipe,

1142

1329

self).process_request(request, client_address)

1143

os.close(self.pipe[1]) # close write end

1144

self.add_pipe(self.pipe[0])

1145

def add_pipe(self, pipe):

1330

self.add_pipe(parent_pipe)

1331

def add_pipe(self, parent_pipe):

1146

1332

"""Dummy function; override as necessary"""

1147

os.close(pipe)

1148

1149

1150

class IPv6_TCPServer(ForkingMixInWithPipe,

1333

pass

1334

1335

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1151

1336

socketserver.TCPServer, object):

1152

1337

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1153

1338

1238

1423

return socketserver.TCPServer.server_activate(self)

1239

1424

def enable(self):

1240

1425

self.enabled = True

1241

def add_pipe(self, pipe):

1426

def add_pipe(self, parent_pipe):

1242

1427

# Call "handle_ipc" for both data and EOF events

1243

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1244

self.handle_ipc)

1245

def handle_ipc(self, source, condition, file_objects={}):

1428

gobject.io_add_watch(parent_pipe.fileno(),

1429

gobject.IO_IN | gobject.IO_HUP,

1430

functools.partial(self.handle_ipc,

1431

parent_pipe = parent_pipe))

1432

1433

def handle_ipc(self, source, condition, parent_pipe=None,

1434

client_object=None):

1246

1435

condition_names = {

1247

1436

gobject.IO_IN: u"IN", # There is data to read.

1248

1437

gobject.IO_OUT: u"OUT", # Data can be written (without

1260

1449

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1261

1450

conditions_string)

1262

1451

1263

# Turn the pipe file descriptor into a Python file object

1264

if source not in file_objects:

1265

file_objects[source] = os.fdopen(source, u"r", 1)

1452

# Read a request from the child

1453

request = parent_pipe.recv()

1454

command = request[0]

1266

1455

1267

# Read a line from the file object

1268

cmdline = file_objects[source].readline()

1269

if not cmdline: # Empty line means end of file

1270

# close the IPC pipe

1271

file_objects[source].close()

1272

del file_objects[source]

1273

1274

# Stop calling this function

1456

if command == 'init':

1457

fpr = request[1]

1458

address = request[2]

1459

1460

for c in self.clients:

1461

if c.fingerprint == fpr:

1462

client = c

1463

break

1464

else:

1465

logger.warning(u"Client not found for fingerprint: %s, ad"

1466

u"dress: %s", fpr, address)

1467

if self.use_dbus:

1468

# Emit D-Bus signal

1469

mandos_dbus_service.ClientNotFound(fpr, address)

1470

parent_pipe.send(False)

1471

return False

1472

1473

gobject.io_add_watch(parent_pipe.fileno(),

1474

gobject.IO_IN | gobject.IO_HUP,

1475

functools.partial(self.handle_ipc,

1476

parent_pipe = parent_pipe,

1477

client_object = client))

1478

parent_pipe.send(True)

1479

# remove the old hook in favor of the new above hook on same fileno

1275

1480

return False

1276

1277

logger.debug(u"IPC command: %r", cmdline)

1278

1279

# Parse and act on command

1280

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1281

1282

if cmd == u"NOTFOUND":

1283

logger.warning(u"Client not found for fingerprint: %s",

1284

args)

1285

if self.use_dbus:

1286

# Emit D-Bus signal

1287

mandos_dbus_service.ClientNotFound(args)

1288

elif cmd == u"INVALID":

1289

for client in self.clients:

1290

if client.name == args:

1291

logger.warning(u"Client %s is invalid", args)

1292

if self.use_dbus:

1293

# Emit D-Bus signal

1294

client.Rejected()

1295

break

1296

else:

1297

logger.error(u"Unknown client %s is invalid", args)

1298

elif cmd == u"SENDING":

1299

for client in self.clients:

1300

if client.name == args:

1301

logger.info(u"Sending secret to %s", client.name)

1302

client.checked_ok()

1303

if self.use_dbus:

1304

# Emit D-Bus signal

1305

client.GotSecret()

1306

break

1307

else:

1308

logger.error(u"Sending secret to unknown client %s",

1309

args)

1310

else:

1311

logger.error(u"Unknown IPC command: %r", cmdline)

1312

1313

# Keep calling this function

1481

if command == 'funcall':

1482

funcname = request[1]

1483

args = request[2]

1484

kwargs = request[3]

1485

1486

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1487

1488

if command == 'getattr':

1489

attrname = request[1]

1490

if callable(client_object.__getattribute__(attrname)):

1491

parent_pipe.send(('function',))

1492

else:

1493

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1494

1495

if command == 'setattr':

1496

attrname = request[1]

1497

value = request[2]

1498

setattr(client_object, attrname, value)

1499

1314

1500

return True

1315

1501

1316

1502

1367

1553

def if_nametoindex(interface):

1368

1554

"Get an interface index the hard way, i.e. using fcntl()"

1369

1555

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1370

with closing(socket.socket()) as s:

1556

with contextlib.closing(socket.socket()) as s:

1371

1557

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1372

1558

struct.pack(str(u"16s16x"),

1373

1559

interface))

1504

1690

u"interval": u"5m",

1505

1691

u"checker": u"fping -q -- %%(host)s",

1506

1692

u"host": u"",

1693

u"approved_delay": u"0s",

1694

u"approved_duration": u"1s",

1507

1695

}

1508

1696

client_config = configparser.SafeConfigParser(client_defaults)

1509

1697

client_config.read(os.path.join(server_settings[u"configdir"],

1586

1774

client_class = Client

1587

1775

if use_dbus:

1588

1776

client_class = functools.partial(ClientDBus, bus = bus)

1777

def client_config_items(config, section):

1778

special_settings = {

1779

"approved_by_default":

1780

lambda: config.getboolean(section,

1781

"approved_by_default"),

1782

}

1783

for name, value in config.items(section):

1784

try:

1785

yield (name, special_settings[name]())

1786

except KeyError:

1787

yield (name, value)

1788

1589

1789

tcp_server.clients.update(set(

1590

1790

client_class(name = section,

1591

config= dict(client_config.items(section)))

1791

config= dict(client_config_items(

1792

client_config, section)))

1592

1793

for section in client_config.sections()))

1593

1794

if not tcp_server.clients:

1594

1795

logger.warning(u"No clients defined")

1606

1807

daemon()

1607

1808

1608

1809

try:

1609

with closing(pidfile):

1810

with pidfile:

1610

1811

pid = os.getpid()

1611

1812

pidfile.write(str(pid) + "\n")

1612

1813

del pidfile

1630

1831

dbus.service.Object.__init__(self, bus, u"/")

1631

1832

_interface = u"se.bsnet.fukt.Mandos"

1632

1833

1633

@dbus.service.signal(_interface, signature=u"oa{sv}")

1634

def ClientAdded(self, objpath, properties):

1834

@dbus.service.signal(_interface, signature=u"o")

1835

def ClientAdded(self, objpath):

1635

1836

"D-Bus signal"

1636

1837

pass

1637

1838

1638

@dbus.service.signal(_interface, signature=u"s")

1639

def ClientNotFound(self, fingerprint):

1839

@dbus.service.signal(_interface, signature=u"ss")

1840

def ClientNotFound(self, fingerprint, address):

1640

1841

"D-Bus signal"

1641

1842

pass

1642

1843

1699

1900

for client in tcp_server.clients:

1700

1901

if use_dbus:

1701

1902

# Emit D-Bus signal

1702

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1703

client.GetAll(u""))

1903

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1704

1904

client.enable()

1705

1905

1706

1906

tcp_server.enable()