/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: teddy at bsnet
  • Date: 2010-08-23 19:23:15 UTC
  • mto: (24.1.154 mandos)
  • mto: This revision was merged to the branch mainline in revision 421.
  • Revision ID: teddy@fukt.bsnet.se-20100823192315-pefgye0l6cavcejs
* debian/control (mandos/Depends): Added "python-urwid".
* mandos (Client.approved_by_default): Changed default to "True".
  (Client.approved_delay): Changed default to "0s".
  (ClientDBus.GotSecret, ClientDBus.Rejected,
  ClientDBus.NeedApproval): Emit "PropertyChanged" signal for the
                            "approved_pending" property.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2010 Teddy Hogeborn
15
 
# Copyright © 2008-2010 Björn Påhlsson
 
14
# Copyright © 2008,2009 Teddy Hogeborn
 
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
81
81
        SO_BINDTODEVICE = None
82
82
 
83
83
 
84
 
version = "1.2"
 
84
version = "1.0.14"
85
85
 
86
 
#logger = logging.getLogger(u'mandos')
87
86
logger = logging.Logger(u'mandos')
88
87
syslogger = (logging.handlers.SysLogHandler
89
88
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
99
98
                                       u' %(message)s'))
100
99
logger.addHandler(console)
101
100
 
 
101
multiprocessing_manager = multiprocessing.Manager()
 
102
 
102
103
class AvahiError(Exception):
103
104
    def __init__(self, value, *args, **kwargs):
104
105
        self.value = value
157
158
                            u" after %i retries, exiting.",
158
159
                            self.rename_count)
159
160
            raise AvahiServiceError(u"Too many renames")
160
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
161
        self.name = self.server.GetAlternativeServiceName(self.name)
161
162
        logger.info(u"Changing Zeroconf service name to %r ...",
162
 
                    self.name)
 
163
                    unicode(self.name))
163
164
        syslogger.setFormatter(logging.Formatter
164
165
                               (u'Mandos (%s) [%%(process)d]:'
165
166
                                u' %%(levelname)s: %%(message)s'
166
167
                                % self.name))
167
168
        self.remove()
168
 
        try:
169
 
            self.add()
170
 
        except dbus.exceptions.DBusException, error:
171
 
            logger.critical(u"DBusException: %s", error)
172
 
            self.cleanup()
173
 
            os._exit(1)
 
169
        self.add()
174
170
        self.rename_count += 1
175
171
    def remove(self):
176
172
        """Derived from the Avahi example code"""
199
195
        self.group.Commit()
200
196
    def entry_group_state_changed(self, state, error):
201
197
        """Derived from the Avahi example code"""
202
 
        logger.debug(u"Avahi entry group state change: %i", state)
 
198
        logger.debug(u"Avahi state change: %i", state)
203
199
        
204
200
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
201
            logger.debug(u"Zeroconf service established.")
218
214
            self.group = None
219
215
    def server_state_changed(self, state):
220
216
        """Derived from the Avahi example code"""
221
 
        logger.debug(u"Avahi server state change: %i", state)
222
217
        if state == avahi.SERVER_COLLISION:
223
218
            logger.error(u"Zeroconf server name collision")
224
219
            self.remove()
240
235
    """A representation of a client host served by this server.
241
236
    
242
237
    Attributes:
243
 
    _approved:   bool(); 'None' if not yet approved/disapproved
244
 
    approval_delay: datetime.timedelta(); Time to wait for approval
245
 
    approval_duration: datetime.timedelta(); Duration of one approval
 
238
    name:       string; from the config file, used in log messages and
 
239
                        D-Bus identifiers
 
240
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
241
                 uniquely identify the client
 
242
    secret:     bytestring; sent verbatim (over TLS) to client
 
243
    host:       string; available for use by the checker command
 
244
    created:    datetime.datetime(); (UTC) object creation
 
245
    last_enabled: datetime.datetime(); (UTC)
 
246
    enabled:    bool()
 
247
    last_checked_ok: datetime.datetime(); (UTC) or None
 
248
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
249
                                      until this client is disabled
 
250
    interval:   datetime.timedelta(); How often to start a new checker
 
251
    disable_hook:  If set, called by disable() as disable_hook(self)
246
252
    checker:    subprocess.Popen(); a running checker process used
247
253
                                    to see if the client lives.
248
254
                                    'None' if no process is running.
249
 
    checker_callback_tag: a gobject event source tag, or None
250
 
    checker_command: string; External command which is run to check
251
 
                     if client lives.  %() expansions are done at
 
255
    checker_initiator_tag: a gobject event source tag, or None
 
256
    disable_initiator_tag: - '' -
 
257
    checker_callback_tag:  - '' -
 
258
    checker_command: string; External command which is run to check if
 
259
                     client lives.  %() expansions are done at
252
260
                     runtime with vars(self) as dict, so that for
253
261
                     instance %(name)s can be used in the command.
254
 
    checker_initiator_tag: a gobject event source tag, or None
255
 
    created:    datetime.datetime(); (UTC) object creation
256
262
    current_checker_command: string; current running checker_command
257
 
    disable_hook:  If set, called by disable() as disable_hook(self)
258
 
    disable_initiator_tag: a gobject event source tag, or None
259
 
    enabled:    bool()
260
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
261
 
                 uniquely identify the client
262
 
    host:       string; available for use by the checker command
263
 
    interval:   datetime.timedelta(); How often to start a new checker
264
 
    last_approval_request: datetime.datetime(); (UTC) or None
265
 
    last_checked_ok: datetime.datetime(); (UTC) or None
266
 
    last_enabled: datetime.datetime(); (UTC)
267
 
    name:       string; from the config file, used in log messages and
268
 
                        D-Bus identifiers
269
 
    secret:     bytestring; sent verbatim (over TLS) to client
270
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
271
 
                                      until this client is disabled
272
 
    runtime_expansions: Allowed attributes for runtime expansion.
 
263
    approved_delay: datetime.timedelta(); Time to wait for approval
 
264
    _approved:   bool(); 'None' if not yet approved/disapproved
 
265
    approved_duration: datetime.timedelta(); Duration of one approval
273
266
    """
274
267
    
275
 
    runtime_expansions = (u"approval_delay", u"approval_duration",
276
 
                          u"created", u"enabled", u"fingerprint",
277
 
                          u"host", u"interval", u"last_checked_ok",
278
 
                          u"last_enabled", u"name", u"timeout")
279
 
    
280
268
    @staticmethod
281
269
    def _timedelta_to_milliseconds(td):
282
270
        "Convert a datetime.timedelta() to milliseconds"
292
280
        "Return the 'interval' attribute in milliseconds"
293
281
        return self._timedelta_to_milliseconds(self.interval)
294
282
 
295
 
    def approval_delay_milliseconds(self):
296
 
        return self._timedelta_to_milliseconds(self.approval_delay)
 
283
    def approved_delay_milliseconds(self):
 
284
        return self._timedelta_to_milliseconds(self.approved_delay)
297
285
    
298
286
    def __init__(self, name = None, disable_hook=None, config=None):
299
287
        """Note: the 'checker' key in 'config' sets the
317
305
                      "rb") as secfile:
318
306
                self.secret = secfile.read()
319
307
        else:
 
308
            #XXX Need to allow secret on demand!
320
309
            raise TypeError(u"No secret or secfile for client %s"
321
310
                            % self.name)
322
311
        self.host = config.get(u"host", u"")
323
312
        self.created = datetime.datetime.utcnow()
324
313
        self.enabled = False
325
 
        self.last_approval_request = None
326
314
        self.last_enabled = None
327
315
        self.last_checked_ok = None
328
316
        self.timeout = string_to_delta(config[u"timeout"])
335
323
        self.checker_command = config[u"checker"]
336
324
        self.current_checker_command = None
337
325
        self.last_connect = None
 
326
        self.approvals_pending = 0
338
327
        self._approved = None
339
328
        self.approved_by_default = config.get(u"approved_by_default",
340
329
                                              True)
341
 
        self.approvals_pending = 0
342
 
        self.approval_delay = string_to_delta(
343
 
            config[u"approval_delay"])
344
 
        self.approval_duration = string_to_delta(
345
 
            config[u"approval_duration"])
 
330
        self.approved_delay = string_to_delta(
 
331
            config[u"approved_delay"])
 
332
        self.approved_duration = string_to_delta(
 
333
            config[u"approved_duration"])
346
334
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
347
 
    
 
335
 
348
336
    def send_changedstate(self):
349
337
        self.changedstate.acquire()
350
338
        self.changedstate.notify_all()
424
412
                                      (self.timeout_milliseconds(),
425
413
                                       self.disable))
426
414
    
427
 
    def need_approval(self):
428
 
        self.last_approval_request = datetime.datetime.utcnow()
429
 
    
430
415
    def start_checker(self):
431
416
        """Start a new checker subprocess if one is not running.
432
417
        
461
446
                command = self.checker_command % self.host
462
447
            except TypeError:
463
448
                # Escape attributes for the shell
464
 
                escaped_attrs = dict(
465
 
                    (attr,
466
 
                     re.escape(unicode(str(getattr(self, attr, u"")),
467
 
                                       errors=
468
 
                                       u'replace')))
469
 
                    for attr in
470
 
                    self.runtime_expansions)
471
 
 
 
449
                escaped_attrs = dict((key,
 
450
                                      re.escape(unicode(str(val),
 
451
                                                        errors=
 
452
                                                        u'replace')))
 
453
                                     for key, val in
 
454
                                     vars(self).iteritems())
472
455
                try:
473
456
                    command = self.checker_command % escaped_attrs
474
457
                except TypeError, error:
716
699
    dbus_object_path: dbus.ObjectPath
717
700
    bus: dbus.SystemBus()
718
701
    """
719
 
    
720
 
    runtime_expansions = (Client.runtime_expansions
721
 
                          + (u"dbus_object_path",))
722
 
    
723
702
    # dbus.service.Object doesn't use super(), so we can't either.
724
703
    
725
704
    def __init__(self, bus = None, *args, **kwargs):
726
 
        self._approvals_pending = 0
727
705
        self.bus = bus
728
706
        Client.__init__(self, *args, **kwargs)
729
707
        # Only now, when this client is initialized, can it show up on
730
708
        # the D-Bus
731
 
        client_object_name = unicode(self.name).translate(
732
 
            {ord(u"."): ord(u"_"),
733
 
             ord(u"-"): ord(u"_")})
734
709
        self.dbus_object_path = (dbus.ObjectPath
735
 
                                 (u"/clients/" + client_object_name))
 
710
                                 (u"/clients/"
 
711
                                  + self.name.replace(u".", u"_")))
736
712
        DBusObjectWithProperties.__init__(self, self.bus,
737
713
                                          self.dbus_object_path)
738
 
        
739
 
    def _get_approvals_pending(self):
740
 
        return self._approvals_pending
741
 
    def _set_approvals_pending(self, value):
742
 
        old_value = self._approvals_pending
743
 
        self._approvals_pending = value
744
 
        bval = bool(value)
745
 
        if (hasattr(self, "dbus_object_path")
746
 
            and bval is not bool(old_value)):
747
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
748
 
            self.PropertyChanged(dbus.String(u"ApprovalPending"),
749
 
                                 dbus_bool)
750
 
 
751
 
    approvals_pending = property(_get_approvals_pending,
752
 
                                 _set_approvals_pending)
753
 
    del _get_approvals_pending, _set_approvals_pending
754
714
    
755
715
    @staticmethod
756
716
    def _datetime_to_dbus(dt, variant_level=0):
763
723
        r = Client.enable(self)
764
724
        if oldstate != self.enabled:
765
725
            # Emit D-Bus signals
766
 
            self.PropertyChanged(dbus.String(u"Enabled"),
 
726
            self.PropertyChanged(dbus.String(u"enabled"),
767
727
                                 dbus.Boolean(True, variant_level=1))
768
728
            self.PropertyChanged(
769
 
                dbus.String(u"LastEnabled"),
 
729
                dbus.String(u"last_enabled"),
770
730
                self._datetime_to_dbus(self.last_enabled,
771
731
                                       variant_level=1))
772
732
        return r
776
736
        r = Client.disable(self, quiet=quiet)
777
737
        if not quiet and oldstate != self.enabled:
778
738
            # Emit D-Bus signal
779
 
            self.PropertyChanged(dbus.String(u"Enabled"),
 
739
            self.PropertyChanged(dbus.String(u"enabled"),
780
740
                                 dbus.Boolean(False, variant_level=1))
781
741
        return r
782
742
    
794
754
        self.checker_callback_tag = None
795
755
        self.checker = None
796
756
        # Emit D-Bus signal
797
 
        self.PropertyChanged(dbus.String(u"CheckerRunning"),
 
757
        self.PropertyChanged(dbus.String(u"checker_running"),
798
758
                             dbus.Boolean(False, variant_level=1))
799
759
        if os.WIFEXITED(condition):
800
760
            exitstatus = os.WEXITSTATUS(condition)
815
775
        r = Client.checked_ok(self, *args, **kwargs)
816
776
        # Emit D-Bus signal
817
777
        self.PropertyChanged(
818
 
            dbus.String(u"LastCheckedOK"),
 
778
            dbus.String(u"last_checked_ok"),
819
779
            (self._datetime_to_dbus(self.last_checked_ok,
820
780
                                    variant_level=1)))
821
781
        return r
822
782
    
823
 
    def need_approval(self, *args, **kwargs):
824
 
        r = Client.need_approval(self, *args, **kwargs)
825
 
        # Emit D-Bus signal
826
 
        self.PropertyChanged(
827
 
            dbus.String(u"LastApprovalRequest"),
828
 
            (self._datetime_to_dbus(self.last_approval_request,
829
 
                                    variant_level=1)))
830
 
        return r
831
 
    
832
783
    def start_checker(self, *args, **kwargs):
833
784
        old_checker = self.checker
834
785
        if self.checker is not None:
842
793
            # Emit D-Bus signal
843
794
            self.CheckerStarted(self.current_checker_command)
844
795
            self.PropertyChanged(
845
 
                dbus.String(u"CheckerRunning"),
 
796
                dbus.String(u"checker_running"),
846
797
                dbus.Boolean(True, variant_level=1))
847
798
        return r
848
799
    
851
802
        r = Client.stop_checker(self, *args, **kwargs)
852
803
        if (old_checker is not None
853
804
            and getattr(self, u"checker", None) is None):
854
 
            self.PropertyChanged(dbus.String(u"CheckerRunning"),
 
805
            self.PropertyChanged(dbus.String(u"checker_running"),
855
806
                                 dbus.Boolean(False, variant_level=1))
856
807
        return r
857
808
 
860
811
        return False
861
812
    
862
813
    def approve(self, value=True):
863
 
        self.send_changedstate()
864
814
        self._approved = value
865
 
        gobject.timeout_add(self._timedelta_to_milliseconds
866
 
                            (self.approval_duration),
867
 
                            self._reset_approved)
 
815
        gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))
 
816
 
 
817
    def approved_pending(self):
 
818
        return self.approvals_pending > 0
868
819
    
869
820
    
870
821
    ## D-Bus methods, signals & properties
893
844
    # GotSecret - signal
894
845
    @dbus.service.signal(_interface)
895
846
    def GotSecret(self):
896
 
        """D-Bus signal
897
 
        Is sent after a successful transfer of secret from the Mandos
898
 
        server to mandos-client
899
 
        """
900
 
        pass
 
847
        "D-Bus signal"
 
848
        if self.approved_pending():
 
849
            self.PropertyChanged(dbus.String(u"checker_running"),
 
850
                                 dbus.Boolean(False, variant_level=1))
901
851
    
902
852
    # Rejected - signal
903
853
    @dbus.service.signal(_interface, signature=u"s")
904
854
    def Rejected(self, reason):
905
855
        "D-Bus signal"
906
 
        pass
 
856
        if self.approved_pending():
 
857
            self.PropertyChanged(dbus.String(u"checker_running"),
 
858
                                 dbus.Boolean(False, variant_level=1))
907
859
    
908
860
    # NeedApproval - signal
909
 
    @dbus.service.signal(_interface, signature=u"tb")
 
861
    @dbus.service.signal(_interface, signature=u"db")
910
862
    def NeedApproval(self, timeout, default):
911
863
        "D-Bus signal"
912
 
        return self.need_approval()
 
864
        if not self.approved_pending():
 
865
            self.PropertyChanged(dbus.String(u"approved_pending"),
 
866
                                 dbus.Boolean(True, variant_level=1))
913
867
    
914
868
    ## Methods
915
 
    
 
869
 
916
870
    # Approve - method
917
871
    @dbus.service.method(_interface, in_signature=u"b")
918
872
    def Approve(self, value):
919
873
        self.approve(value)
920
 
    
 
874
 
921
875
    # CheckedOK - method
922
876
    @dbus.service.method(_interface)
923
877
    def CheckedOK(self):
948
902
    
949
903
    ## Properties
950
904
    
951
 
    # ApprovalPending - property
 
905
    # approved_pending - property
952
906
    @dbus_service_property(_interface, signature=u"b", access=u"read")
953
 
    def ApprovalPending_dbus_property(self):
954
 
        return dbus.Boolean(bool(self.approvals_pending))
 
907
    def approved_pending_dbus_property(self):
 
908
        return dbus.Boolean(self.approved_pending())
955
909
    
956
 
    # ApprovedByDefault - property
 
910
    # approved_by_default - property
957
911
    @dbus_service_property(_interface, signature=u"b",
958
912
                           access=u"readwrite")
959
 
    def ApprovedByDefault_dbus_property(self, value=None):
960
 
        if value is None:       # get
961
 
            return dbus.Boolean(self.approved_by_default)
962
 
        self.approved_by_default = bool(value)
963
 
        # Emit D-Bus signal
964
 
        self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
965
 
                             dbus.Boolean(value, variant_level=1))
966
 
    
967
 
    # ApprovalDelay - property
968
 
    @dbus_service_property(_interface, signature=u"t",
969
 
                           access=u"readwrite")
970
 
    def ApprovalDelay_dbus_property(self, value=None):
971
 
        if value is None:       # get
972
 
            return dbus.UInt64(self.approval_delay_milliseconds())
973
 
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
974
 
        # Emit D-Bus signal
975
 
        self.PropertyChanged(dbus.String(u"ApprovalDelay"),
976
 
                             dbus.UInt64(value, variant_level=1))
977
 
    
978
 
    # ApprovalDuration - property
979
 
    @dbus_service_property(_interface, signature=u"t",
980
 
                           access=u"readwrite")
981
 
    def ApprovalDuration_dbus_property(self, value=None):
982
 
        if value is None:       # get
983
 
            return dbus.UInt64(self._timedelta_to_milliseconds(
984
 
                    self.approval_duration))
985
 
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
986
 
        # Emit D-Bus signal
987
 
        self.PropertyChanged(dbus.String(u"ApprovalDuration"),
988
 
                             dbus.UInt64(value, variant_level=1))
989
 
    
990
 
    # Name - property
 
913
    def approved_by_default_dbus_property(self):
 
914
        return dbus.Boolean(self.approved_by_default)
 
915
    
 
916
    # approved_delay - property
 
917
    @dbus_service_property(_interface, signature=u"t",
 
918
                           access=u"readwrite")
 
919
    def approved_delay_dbus_property(self):
 
920
        return dbus.UInt64(self.approved_delay_milliseconds())
 
921
    
 
922
    # approved_duration - property
 
923
    @dbus_service_property(_interface, signature=u"t",
 
924
                           access=u"readwrite")
 
925
    def approved_duration_dbus_property(self):
 
926
        return dbus.UInt64(self._timedelta_to_milliseconds(
 
927
                self.approved_duration))
 
928
    
 
929
    # name - property
991
930
    @dbus_service_property(_interface, signature=u"s", access=u"read")
992
 
    def Name_dbus_property(self):
 
931
    def name_dbus_property(self):
993
932
        return dbus.String(self.name)
994
933
    
995
 
    # Fingerprint - property
 
934
    # fingerprint - property
996
935
    @dbus_service_property(_interface, signature=u"s", access=u"read")
997
 
    def Fingerprint_dbus_property(self):
 
936
    def fingerprint_dbus_property(self):
998
937
        return dbus.String(self.fingerprint)
999
938
    
1000
 
    # Host - property
 
939
    # host - property
1001
940
    @dbus_service_property(_interface, signature=u"s",
1002
941
                           access=u"readwrite")
1003
 
    def Host_dbus_property(self, value=None):
 
942
    def host_dbus_property(self, value=None):
1004
943
        if value is None:       # get
1005
944
            return dbus.String(self.host)
1006
945
        self.host = value
1007
946
        # Emit D-Bus signal
1008
 
        self.PropertyChanged(dbus.String(u"Host"),
 
947
        self.PropertyChanged(dbus.String(u"host"),
1009
948
                             dbus.String(value, variant_level=1))
1010
949
    
1011
 
    # Created - property
 
950
    # created - property
1012
951
    @dbus_service_property(_interface, signature=u"s", access=u"read")
1013
 
    def Created_dbus_property(self):
 
952
    def created_dbus_property(self):
1014
953
        return dbus.String(self._datetime_to_dbus(self.created))
1015
954
    
1016
 
    # LastEnabled - property
 
955
    # last_enabled - property
1017
956
    @dbus_service_property(_interface, signature=u"s", access=u"read")
1018
 
    def LastEnabled_dbus_property(self):
 
957
    def last_enabled_dbus_property(self):
1019
958
        if self.last_enabled is None:
1020
959
            return dbus.String(u"")
1021
960
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
1022
961
    
1023
 
    # Enabled - property
 
962
    # enabled - property
1024
963
    @dbus_service_property(_interface, signature=u"b",
1025
964
                           access=u"readwrite")
1026
 
    def Enabled_dbus_property(self, value=None):
 
965
    def enabled_dbus_property(self, value=None):
1027
966
        if value is None:       # get
1028
967
            return dbus.Boolean(self.enabled)
1029
968
        if value:
1031
970
        else:
1032
971
            self.disable()
1033
972
    
1034
 
    # LastCheckedOK - property
 
973
    # last_checked_ok - property
1035
974
    @dbus_service_property(_interface, signature=u"s",
1036
975
                           access=u"readwrite")
1037
 
    def LastCheckedOK_dbus_property(self, value=None):
 
976
    def last_checked_ok_dbus_property(self, value=None):
1038
977
        if value is not None:
1039
978
            self.checked_ok()
1040
979
            return
1043
982
        return dbus.String(self._datetime_to_dbus(self
1044
983
                                                  .last_checked_ok))
1045
984
    
1046
 
    # LastApprovalRequest - property
1047
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
1048
 
    def LastApprovalRequest_dbus_property(self):
1049
 
        if self.last_approval_request is None:
1050
 
            return dbus.String(u"")
1051
 
        return dbus.String(self.
1052
 
                           _datetime_to_dbus(self
1053
 
                                             .last_approval_request))
1054
 
    
1055
 
    # Timeout - property
 
985
    # timeout - property
1056
986
    @dbus_service_property(_interface, signature=u"t",
1057
987
                           access=u"readwrite")
1058
 
    def Timeout_dbus_property(self, value=None):
 
988
    def timeout_dbus_property(self, value=None):
1059
989
        if value is None:       # get
1060
990
            return dbus.UInt64(self.timeout_milliseconds())
1061
991
        self.timeout = datetime.timedelta(0, 0, 0, value)
1062
992
        # Emit D-Bus signal
1063
 
        self.PropertyChanged(dbus.String(u"Timeout"),
 
993
        self.PropertyChanged(dbus.String(u"timeout"),
1064
994
                             dbus.UInt64(value, variant_level=1))
1065
995
        if getattr(self, u"disable_initiator_tag", None) is None:
1066
996
            return
1080
1010
            self.disable_initiator_tag = (gobject.timeout_add
1081
1011
                                          (time_to_die, self.disable))
1082
1012
    
1083
 
    # Interval - property
 
1013
    # interval - property
1084
1014
    @dbus_service_property(_interface, signature=u"t",
1085
1015
                           access=u"readwrite")
1086
 
    def Interval_dbus_property(self, value=None):
 
1016
    def interval_dbus_property(self, value=None):
1087
1017
        if value is None:       # get
1088
1018
            return dbus.UInt64(self.interval_milliseconds())
1089
1019
        self.interval = datetime.timedelta(0, 0, 0, value)
1090
1020
        # Emit D-Bus signal
1091
 
        self.PropertyChanged(dbus.String(u"Interval"),
 
1021
        self.PropertyChanged(dbus.String(u"interval"),
1092
1022
                             dbus.UInt64(value, variant_level=1))
1093
1023
        if getattr(self, u"checker_initiator_tag", None) is None:
1094
1024
            return
1098
1028
                                      (value, self.start_checker))
1099
1029
        self.start_checker()    # Start one now, too
1100
1030
 
1101
 
    # Checker - property
 
1031
    # checker - property
1102
1032
    @dbus_service_property(_interface, signature=u"s",
1103
1033
                           access=u"readwrite")
1104
 
    def Checker_dbus_property(self, value=None):
 
1034
    def checker_dbus_property(self, value=None):
1105
1035
        if value is None:       # get
1106
1036
            return dbus.String(self.checker_command)
1107
1037
        self.checker_command = value
1108
1038
        # Emit D-Bus signal
1109
 
        self.PropertyChanged(dbus.String(u"Checker"),
 
1039
        self.PropertyChanged(dbus.String(u"checker"),
1110
1040
                             dbus.String(self.checker_command,
1111
1041
                                         variant_level=1))
1112
1042
    
1113
 
    # CheckerRunning - property
 
1043
    # checker_running - property
1114
1044
    @dbus_service_property(_interface, signature=u"b",
1115
1045
                           access=u"readwrite")
1116
 
    def CheckerRunning_dbus_property(self, value=None):
 
1046
    def checker_running_dbus_property(self, value=None):
1117
1047
        if value is None:       # get
1118
1048
            return dbus.Boolean(self.checker is not None)
1119
1049
        if value:
1121
1051
        else:
1122
1052
            self.stop_checker()
1123
1053
    
1124
 
    # ObjectPath - property
 
1054
    # object_path - property
1125
1055
    @dbus_service_property(_interface, signature=u"o", access=u"read")
1126
 
    def ObjectPath_dbus_property(self):
 
1056
    def object_path_dbus_property(self):
1127
1057
        return self.dbus_object_path # is already a dbus.ObjectPath
1128
1058
    
1129
 
    # Secret = property
 
1059
    # secret = property
1130
1060
    @dbus_service_property(_interface, signature=u"ay",
1131
1061
                           access=u"write", byte_arrays=True)
1132
 
    def Secret_dbus_property(self, value):
 
1062
    def secret_dbus_property(self, value):
1133
1063
        self.secret = str(value)
1134
1064
    
1135
1065
    del _interface
1233
1163
                except KeyError:
1234
1164
                    return
1235
1165
                
1236
 
                if client.approval_delay:
1237
 
                    delay = client.approval_delay
 
1166
                if client.approved_delay:
 
1167
                    delay = client.approved_delay
1238
1168
                    client.approvals_pending += 1
1239
1169
                    approval_required = True
1240
1170
                
1247
1177
                            client.Rejected("Disabled")                    
1248
1178
                        return
1249
1179
                    
1250
 
                    if client._approved or not client.approval_delay:
 
1180
                    if client._approved or not client.approved_delay:
1251
1181
                        #We are approved or approval is disabled
1252
1182
                        break
1253
1183
                    elif client._approved is None:
1254
 
                        logger.info(u"Client %s needs approval",
 
1184
                        logger.info(u"Client %s need approval",
1255
1185
                                    client.name)
1256
1186
                        if self.server.use_dbus:
1257
1187
                            # Emit D-Bus signal
1258
1188
                            client.NeedApproval(
1259
 
                                client.approval_delay_milliseconds(),
 
1189
                                client.approved_delay_milliseconds(),
1260
1190
                                client.approved_by_default)
1261
1191
                    else:
1262
1192
                        logger.warning(u"Client %s was not approved",
1263
1193
                                       client.name)
1264
1194
                        if self.server.use_dbus:
1265
1195
                            # Emit D-Bus signal
1266
 
                            client.Rejected("Denied")
 
1196
                            client.Rejected("Disapproved")
1267
1197
                        return
1268
1198
                    
1269
1199
                    #wait until timeout or approved
1280
1210
                                           client.name)
1281
1211
                            if self.server.use_dbus:
1282
1212
                                # Emit D-Bus signal
1283
 
                                client.Rejected("Approval timed out")
 
1213
                                client.Rejected("Time out")
1284
1214
                            return
1285
1215
                        else:
1286
1216
                            break
1289
1219
                
1290
1220
                sent_size = 0
1291
1221
                while sent_size < len(client.secret):
1292
 
                    try:
1293
 
                        sent = session.send(client.secret[sent_size:])
1294
 
                    except (gnutls.errors.GNUTLSError), error:
1295
 
                        logger.warning("gnutls send failed")
1296
 
                        return
 
1222
                    # XXX handle session exception
 
1223
                    sent = session.send(client.secret[sent_size:])
1297
1224
                    logger.debug(u"Sent: %d, remaining: %d",
1298
1225
                                 sent, len(client.secret)
1299
1226
                                 - (sent_size + sent))
1309
1236
            finally:
1310
1237
                if approval_required:
1311
1238
                    client.approvals_pending -= 1
1312
 
                try:
1313
 
                    session.bye()
1314
 
                except (gnutls.errors.GNUTLSError), error:
1315
 
                    logger.warning("GnuTLS bye failed")
 
1239
                session.bye()
1316
1240
    
1317
1241
    @staticmethod
1318
1242
    def peer_certificate(session):
1403
1327
 
1404
1328
        super(MultiprocessingMixInWithPipe,
1405
1329
              self).process_request(request, client_address)
1406
 
        self.child_pipe.close()
1407
1330
        self.add_pipe(parent_pipe)
1408
 
 
1409
1331
    def add_pipe(self, parent_pipe):
1410
1332
        """Dummy function; override as necessary"""
1411
1333
        pass
1524
1446
                                       for cond, name in
1525
1447
                                       condition_names.iteritems()
1526
1448
                                       if cond & condition)
1527
 
        # error or the other end of multiprocessing.Pipe has closed
1528
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1529
 
            return False
 
1449
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
 
1450
                     conditions_string)
1530
1451
        
1531
1452
        # Read a request from the child
1532
1453
        request = parent_pipe.recv()
1545
1466
                               u"dress: %s", fpr, address)
1546
1467
                if self.use_dbus:
1547
1468
                    # Emit D-Bus signal
1548
 
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
1469
                    mandos_dbus_service.ClientNotFound(fpr, address)
1549
1470
                parent_pipe.send(False)
1550
1471
                return False
1551
1472
            
1570
1491
                parent_pipe.send(('function',))
1571
1492
            else:
1572
1493
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1573
 
        
 
1494
 
1574
1495
        if command == 'setattr':
1575
1496
            attrname = request[1]
1576
1497
            value = request[2]
1577
1498
            setattr(client_object, attrname, value)
1578
 
 
 
1499
            
1579
1500
        return True
1580
1501
 
1581
1502
 
1684
1605
    parser.add_option("--debug", action=u"store_true",
1685
1606
                      help=u"Debug mode; run in foreground and log to"
1686
1607
                      u" terminal")
1687
 
    parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
1688
 
                      help=u"Debug level for stdout output")
1689
1608
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
1609
                      u" priority string (see GnuTLS documentation)")
1691
1610
    parser.add_option("--servicename", type=u"string",
1716
1635
                        u"servicename": u"Mandos",
1717
1636
                        u"use_dbus": u"True",
1718
1637
                        u"use_ipv6": u"True",
1719
 
                        u"debuglevel": u"",
1720
1638
                        }
1721
1639
    
1722
1640
    # Parse config file for server-global settings
1739
1657
    # options, if set.
1740
1658
    for option in (u"interface", u"address", u"port", u"debug",
1741
1659
                   u"priority", u"servicename", u"configdir",
1742
 
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
 
1660
                   u"use_dbus", u"use_ipv6"):
1743
1661
        value = getattr(options, option)
1744
1662
        if value is not None:
1745
1663
            server_settings[option] = value
1754
1672
    
1755
1673
    # For convenience
1756
1674
    debug = server_settings[u"debug"]
1757
 
    debuglevel = server_settings[u"debuglevel"]
1758
1675
    use_dbus = server_settings[u"use_dbus"]
1759
1676
    use_ipv6 = server_settings[u"use_ipv6"]
1760
 
 
 
1677
    
 
1678
    if not debug:
 
1679
        syslogger.setLevel(logging.WARNING)
 
1680
        console.setLevel(logging.WARNING)
 
1681
    
1761
1682
    if server_settings[u"servicename"] != u"Mandos":
1762
1683
        syslogger.setFormatter(logging.Formatter
1763
1684
                               (u'Mandos (%s) [%%(process)d]:'
1769
1690
                        u"interval": u"5m",
1770
1691
                        u"checker": u"fping -q -- %%(host)s",
1771
1692
                        u"host": u"",
1772
 
                        u"approval_delay": u"0s",
1773
 
                        u"approval_duration": u"1s",
 
1693
                        u"approved_delay": u"0s",
 
1694
                        u"approved_duration": u"1s",
1774
1695
                        }
1775
1696
    client_config = configparser.SafeConfigParser(client_defaults)
1776
1697
    client_config.read(os.path.join(server_settings[u"configdir"],
1782
1703
    tcp_server = MandosServer((server_settings[u"address"],
1783
1704
                               server_settings[u"port"]),
1784
1705
                              ClientHandler,
1785
 
                              interface=(server_settings[u"interface"]
1786
 
                                         or None),
 
1706
                              interface=server_settings[u"interface"],
1787
1707
                              use_ipv6=use_ipv6,
1788
1708
                              gnutls_priority=
1789
1709
                              server_settings[u"priority"],
1790
1710
                              use_dbus=use_dbus)
1791
 
    if not debug:
1792
 
        pidfilename = u"/var/run/mandos.pid"
1793
 
        try:
1794
 
            pidfile = open(pidfilename, u"w")
1795
 
        except IOError:
1796
 
            logger.error(u"Could not open file %r", pidfilename)
 
1711
    pidfilename = u"/var/run/mandos.pid"
 
1712
    try:
 
1713
        pidfile = open(pidfilename, u"w")
 
1714
    except IOError:
 
1715
        logger.error(u"Could not open file %r", pidfilename)
1797
1716
    
1798
1717
    try:
1799
1718
        uid = pwd.getpwnam(u"_mandos").pw_uid
1816
1735
        if error[0] != errno.EPERM:
1817
1736
            raise error
1818
1737
    
1819
 
    if not debug and not debuglevel:
1820
 
        syslogger.setLevel(logging.WARNING)
1821
 
        console.setLevel(logging.WARNING)
1822
 
    if debuglevel:
1823
 
        level = getattr(logging, debuglevel.upper())
1824
 
        syslogger.setLevel(level)
1825
 
        console.setLevel(level)
1826
 
 
 
1738
    # Enable all possible GnuTLS debugging
1827
1739
    if debug:
1828
 
        # Enable all possible GnuTLS debugging
1829
 
        
1830
1740
        # "Use a log level over 10 to enable all debugging options."
1831
1741
        # - GnuTLS manual
1832
1742
        gnutls.library.functions.gnutls_global_set_log_level(11)
1837
1747
        
1838
1748
        (gnutls.library.functions
1839
1749
         .gnutls_global_set_log_function(debug_gnutls))
1840
 
        
1841
 
        # Redirect stdin so all checkers get /dev/null
1842
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1843
 
        os.dup2(null, sys.stdin.fileno())
1844
 
        if null > 2:
1845
 
            os.close(null)
1846
 
    else:
1847
 
        # No console logging
1848
 
        logger.removeHandler(console)
1849
 
    
1850
1750
    
1851
1751
    global main_loop
1852
1752
    # From the Avahi example code
1870
1770
    if server_settings["interface"]:
1871
1771
        service.interface = (if_nametoindex
1872
1772
                             (str(server_settings[u"interface"])))
1873
 
 
1874
 
    if not debug:
1875
 
        # Close all input and output, do double fork, etc.
1876
 
        daemon()
1877
 
        
1878
 
    global multiprocessing_manager
1879
 
    multiprocessing_manager = multiprocessing.Manager()
1880
1773
    
1881
1774
    client_class = Client
1882
1775
    if use_dbus:
1900
1793
            for section in client_config.sections()))
1901
1794
    if not tcp_server.clients:
1902
1795
        logger.warning(u"No clients defined")
1903
 
        
 
1796
    
 
1797
    if debug:
 
1798
        # Redirect stdin so all checkers get /dev/null
 
1799
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1800
        os.dup2(null, sys.stdin.fileno())
 
1801
        if null > 2:
 
1802
            os.close(null)
 
1803
    else:
 
1804
        # No console logging
 
1805
        logger.removeHandler(console)
 
1806
        # Close all input and output, do double fork, etc.
 
1807
        daemon()
 
1808
    
 
1809
    try:
 
1810
        with pidfile:
 
1811
            pid = os.getpid()
 
1812
            pidfile.write(str(pid) + "\n")
 
1813
        del pidfile
 
1814
    except IOError:
 
1815
        logger.error(u"Could not write to file %r with PID %d",
 
1816
                     pidfilename, pid)
 
1817
    except NameError:
 
1818
        # "pidfile" was never created
 
1819
        pass
 
1820
    del pidfilename
 
1821
    
1904
1822
    if not debug:
1905
 
        try:
1906
 
            with pidfile:
1907
 
                pid = os.getpid()
1908
 
                pidfile.write(str(pid) + "\n")
1909
 
            del pidfile
1910
 
        except IOError:
1911
 
            logger.error(u"Could not write to file %r with PID %d",
1912
 
                         pidfilename, pid)
1913
 
        except NameError:
1914
 
            # "pidfile" was never created
1915
 
            pass
1916
 
        del pidfilename
1917
 
        
1918
1823
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1919
 
 
1920
1824
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1921
1825
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1922
1826