/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2009-01-29 22:22:32 UTC
  • Revision ID: teddy@fukt.bsnet.se-20090129222232-p9hqnq338nsvxayp
* mandos (main): Bug fix: Do setgid before setuid.  Add verbose GnuTLS
                 debugging messages.
* plugins.d/mandos-client.c (main): Bug fix: Do setgid before setuid.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# methods "add", "remove", "server_state_changed",
10
 
# "entry_group_state_changed", "cleanup", and "activate" in the
11
 
# "AvahiService" class, and some lines in "main".
 
9
# methods "add" and "remove" in the "AvahiService" class, the
 
10
# "server_state_changed" and "entry_group_state_changed" functions,
 
11
# and some lines in "main".
12
12
# 
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
 
34
34
from __future__ import division, with_statement, absolute_import
35
35
 
36
 
import SocketServer as socketserver
 
36
import SocketServer
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
 
import ConfigParser as configparser
 
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
 
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
55
56
import logging
56
57
import logging.handlers
57
58
import pwd
58
 
import contextlib
59
 
import struct
60
 
import fcntl
61
 
import functools
62
 
import cPickle as pickle
 
59
from contextlib import closing
63
60
 
64
61
import dbus
65
62
import dbus.service
68
65
from dbus.mainloop.glib import DBusGMainLoop
69
66
import ctypes
70
67
import ctypes.util
71
 
import xml.dom.minidom
72
 
import inspect
73
 
 
74
 
try:
75
 
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
76
 
except AttributeError:
77
 
    try:
78
 
        from IN import SO_BINDTODEVICE
79
 
    except ImportError:
80
 
        SO_BINDTODEVICE = None
81
 
 
82
 
 
83
 
version = "1.0.14"
84
 
 
85
 
logger = logging.Logger(u'mandos')
 
68
 
 
69
version = "1.0.5"
 
70
 
 
71
logger = logging.Logger('mandos')
86
72
syslogger = (logging.handlers.SysLogHandler
87
73
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
88
74
              address = "/dev/log"))
89
75
syslogger.setFormatter(logging.Formatter
90
 
                       (u'Mandos [%(process)d]: %(levelname)s:'
91
 
                        u' %(message)s'))
 
76
                       ('Mandos: %(levelname)s: %(message)s'))
92
77
logger.addHandler(syslogger)
93
78
 
94
79
console = logging.StreamHandler()
95
 
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
96
 
                                       u' %(levelname)s:'
97
 
                                       u' %(message)s'))
 
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
 
81
                                       ' %(message)s'))
98
82
logger.addHandler(console)
99
83
 
100
84
class AvahiError(Exception):
113
97
 
114
98
class AvahiService(object):
115
99
    """An Avahi (Zeroconf) service.
116
 
    
117
100
    Attributes:
118
101
    interface: integer; avahi.IF_UNSPEC or an interface index.
119
102
               Used to optionally bind to the specified interface.
120
 
    name: string; Example: u'Mandos'
121
 
    type: string; Example: u'_mandos._tcp'.
 
103
    name: string; Example: 'Mandos'
 
104
    type: string; Example: '_mandos._tcp'.
122
105
                  See <http://www.dns-sd.org/ServiceTypes.html>
123
106
    port: integer; what port to announce
124
107
    TXT: list of strings; TXT record for the service
127
110
    max_renames: integer; maximum number of renames
128
111
    rename_count: integer; counter so we only rename after collisions
129
112
                  a sensible number of times
130
 
    group: D-Bus Entry Group
131
 
    server: D-Bus Server
132
 
    bus: dbus.SystemBus()
133
113
    """
134
114
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
135
115
                 servicetype = None, port = None, TXT = None,
136
 
                 domain = u"", host = u"", max_renames = 32768,
137
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
116
                 domain = "", host = "", max_renames = 32768):
138
117
        self.interface = interface
139
118
        self.name = name
140
119
        self.type = servicetype
144
123
        self.host = host
145
124
        self.rename_count = 0
146
125
        self.max_renames = max_renames
147
 
        self.protocol = protocol
148
 
        self.group = None       # our entry group
149
 
        self.server = None
150
 
        self.bus = bus
151
126
    def rename(self):
152
127
        """Derived from the Avahi example code"""
153
128
        if self.rename_count >= self.max_renames:
155
130
                            u" after %i retries, exiting.",
156
131
                            self.rename_count)
157
132
            raise AvahiServiceError(u"Too many renames")
158
 
        self.name = self.server.GetAlternativeServiceName(self.name)
 
133
        self.name = server.GetAlternativeServiceName(self.name)
159
134
        logger.info(u"Changing Zeroconf service name to %r ...",
160
 
                    unicode(self.name))
 
135
                    str(self.name))
161
136
        syslogger.setFormatter(logging.Formatter
162
 
                               (u'Mandos (%s) [%%(process)d]:'
163
 
                                u' %%(levelname)s: %%(message)s'
164
 
                                % self.name))
 
137
                               ('Mandos (%s): %%(levelname)s:'
 
138
                                ' %%(message)s' % self.name))
165
139
        self.remove()
166
140
        self.add()
167
141
        self.rename_count += 1
168
142
    def remove(self):
169
143
        """Derived from the Avahi example code"""
170
 
        if self.group is not None:
171
 
            self.group.Reset()
 
144
        if group is not None:
 
145
            group.Reset()
172
146
    def add(self):
173
147
        """Derived from the Avahi example code"""
174
 
        if self.group is None:
175
 
            self.group = dbus.Interface(
176
 
                self.bus.get_object(avahi.DBUS_NAME,
177
 
                                    self.server.EntryGroupNew()),
178
 
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
179
 
            self.group.connect_to_signal('StateChanged',
180
 
                                         self
181
 
                                         .entry_group_state_changed)
 
148
        global group
 
149
        if group is None:
 
150
            group = dbus.Interface(bus.get_object
 
151
                                   (avahi.DBUS_NAME,
 
152
                                    server.EntryGroupNew()),
 
153
                                   avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
154
            group.connect_to_signal('StateChanged',
 
155
                                    entry_group_state_changed)
182
156
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
183
 
                     self.name, self.type)
184
 
        self.group.AddService(
185
 
            self.interface,
186
 
            self.protocol,
187
 
            dbus.UInt32(0),     # flags
188
 
            self.name, self.type,
189
 
            self.domain, self.host,
190
 
            dbus.UInt16(self.port),
191
 
            avahi.string_array_to_txt_array(self.TXT))
192
 
        self.group.Commit()
193
 
    def entry_group_state_changed(self, state, error):
194
 
        """Derived from the Avahi example code"""
195
 
        logger.debug(u"Avahi state change: %i", state)
196
 
        
197
 
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
198
 
            logger.debug(u"Zeroconf service established.")
199
 
        elif state == avahi.ENTRY_GROUP_COLLISION:
200
 
            logger.warning(u"Zeroconf service name collision.")
201
 
            self.rename()
202
 
        elif state == avahi.ENTRY_GROUP_FAILURE:
203
 
            logger.critical(u"Avahi: Error in group state changed %s",
204
 
                            unicode(error))
205
 
            raise AvahiGroupError(u"State changed: %s"
206
 
                                  % unicode(error))
207
 
    def cleanup(self):
208
 
        """Derived from the Avahi example code"""
209
 
        if self.group is not None:
210
 
            self.group.Free()
211
 
            self.group = None
212
 
    def server_state_changed(self, state):
213
 
        """Derived from the Avahi example code"""
214
 
        if state == avahi.SERVER_COLLISION:
215
 
            logger.error(u"Zeroconf server name collision")
216
 
            self.remove()
217
 
        elif state == avahi.SERVER_RUNNING:
218
 
            self.add()
219
 
    def activate(self):
220
 
        """Derived from the Avahi example code"""
221
 
        if self.server is None:
222
 
            self.server = dbus.Interface(
223
 
                self.bus.get_object(avahi.DBUS_NAME,
224
 
                                    avahi.DBUS_PATH_SERVER),
225
 
                avahi.DBUS_INTERFACE_SERVER)
226
 
        self.server.connect_to_signal(u"StateChanged",
227
 
                                 self.server_state_changed)
228
 
        self.server_state_changed(self.server.GetState())
229
 
 
230
 
 
231
 
class Client(object):
 
157
                     service.name, service.type)
 
158
        group.AddService(
 
159
                self.interface,         # interface
 
160
                avahi.PROTO_INET6,      # protocol
 
161
                dbus.UInt32(0),         # flags
 
162
                self.name, self.type,
 
163
                self.domain, self.host,
 
164
                dbus.UInt16(self.port),
 
165
                avahi.string_array_to_txt_array(self.TXT))
 
166
        group.Commit()
 
167
 
 
168
# From the Avahi example code:
 
169
group = None                            # our entry group
 
170
# End of Avahi example code
 
171
 
 
172
 
 
173
def _datetime_to_dbus(dt, variant_level=0):
 
174
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
175
    return dbus.String(dt.isoformat(), variant_level=variant_level)
 
176
 
 
177
 
 
178
class Client(dbus.service.Object):
232
179
    """A representation of a client host served by this server.
233
 
    
234
180
    Attributes:
235
181
    name:       string; from the config file, used in log messages and
236
182
                        D-Bus identifiers
243
189
    enabled:    bool()
244
190
    last_checked_ok: datetime.datetime(); (UTC) or None
245
191
    timeout:    datetime.timedelta(); How long from last_checked_ok
246
 
                                      until this client is disabled
 
192
                                      until this client is invalid
247
193
    interval:   datetime.timedelta(); How often to start a new checker
248
194
    disable_hook:  If set, called by disable() as disable_hook(self)
249
195
    checker:    subprocess.Popen(); a running checker process used
250
196
                                    to see if the client lives.
251
197
                                    'None' if no process is running.
252
198
    checker_initiator_tag: a gobject event source tag, or None
253
 
    disable_initiator_tag: - '' -
 
199
    disable_initiator_tag:    - '' -
254
200
    checker_callback_tag:  - '' -
255
201
    checker_command: string; External command which is run to check if
256
202
                     client lives.  %() expansions are done at
257
203
                     runtime with vars(self) as dict, so that for
258
204
                     instance %(name)s can be used in the command.
259
 
    current_checker_command: string; current running checker_command
 
205
    use_dbus: bool(); Whether to provide D-Bus interface and signals
 
206
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
260
207
    """
261
 
    
262
 
    @staticmethod
263
 
    def _timedelta_to_milliseconds(td):
264
 
        "Convert a datetime.timedelta() to milliseconds"
265
 
        return ((td.days * 24 * 60 * 60 * 1000)
266
 
                + (td.seconds * 1000)
267
 
                + (td.microseconds // 1000))
268
 
    
269
208
    def timeout_milliseconds(self):
270
209
        "Return the 'timeout' attribute in milliseconds"
271
 
        return self._timedelta_to_milliseconds(self.timeout)
 
210
        return ((self.timeout.days * 24 * 60 * 60 * 1000)
 
211
                + (self.timeout.seconds * 1000)
 
212
                + (self.timeout.microseconds // 1000))
272
213
    
273
214
    def interval_milliseconds(self):
274
215
        "Return the 'interval' attribute in milliseconds"
275
 
        return self._timedelta_to_milliseconds(self.interval)
 
216
        return ((self.interval.days * 24 * 60 * 60 * 1000)
 
217
                + (self.interval.seconds * 1000)
 
218
                + (self.interval.microseconds // 1000))
276
219
    
277
 
    def __init__(self, name = None, disable_hook=None, config=None):
 
220
    def __init__(self, name = None, disable_hook=None, config=None,
 
221
                 use_dbus=True):
278
222
        """Note: the 'checker' key in 'config' sets the
279
223
        'checker_command' attribute and *not* the 'checker'
280
224
        attribute."""
282
226
        if config is None:
283
227
            config = {}
284
228
        logger.debug(u"Creating client %r", self.name)
 
229
        self.use_dbus = False   # During __init__
285
230
        # Uppercase and remove spaces from fingerprint for later
286
231
        # comparison purposes with return value from the fingerprint()
287
232
        # function
288
 
        self.fingerprint = (config[u"fingerprint"].upper()
 
233
        self.fingerprint = (config["fingerprint"].upper()
289
234
                            .replace(u" ", u""))
290
235
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
291
 
        if u"secret" in config:
292
 
            self.secret = config[u"secret"].decode(u"base64")
293
 
        elif u"secfile" in config:
294
 
            with open(os.path.expanduser(os.path.expandvars
295
 
                                         (config[u"secfile"])),
296
 
                      "rb") as secfile:
 
236
        if "secret" in config:
 
237
            self.secret = config["secret"].decode(u"base64")
 
238
        elif "secfile" in config:
 
239
            with closing(open(os.path.expanduser
 
240
                              (os.path.expandvars
 
241
                               (config["secfile"])))) as secfile:
297
242
                self.secret = secfile.read()
298
243
        else:
299
244
            raise TypeError(u"No secret or secfile for client %s"
300
245
                            % self.name)
301
 
        self.host = config.get(u"host", u"")
 
246
        self.host = config.get("host", "")
302
247
        self.created = datetime.datetime.utcnow()
303
248
        self.enabled = False
304
249
        self.last_enabled = None
305
250
        self.last_checked_ok = None
306
 
        self.timeout = string_to_delta(config[u"timeout"])
307
 
        self.interval = string_to_delta(config[u"interval"])
 
251
        self.timeout = string_to_delta(config["timeout"])
 
252
        self.interval = string_to_delta(config["interval"])
308
253
        self.disable_hook = disable_hook
309
254
        self.checker = None
310
255
        self.checker_initiator_tag = None
311
256
        self.disable_initiator_tag = None
312
257
        self.checker_callback_tag = None
313
 
        self.checker_command = config[u"checker"]
314
 
        self.current_checker_command = None
 
258
        self.checker_command = config["checker"]
315
259
        self.last_connect = None
 
260
        # Only now, when this client is initialized, can it show up on
 
261
        # the D-Bus
 
262
        self.use_dbus = use_dbus
 
263
        if self.use_dbus:
 
264
            self.dbus_object_path = (dbus.ObjectPath
 
265
                                     ("/clients/"
 
266
                                      + self.name.replace(".", "_")))
 
267
            dbus.service.Object.__init__(self, bus,
 
268
                                         self.dbus_object_path)
316
269
    
317
270
    def enable(self):
318
271
        """Start this client's checker and timeout hooks"""
319
 
        if getattr(self, u"enabled", False):
320
 
            # Already enabled
321
 
            return
322
272
        self.last_enabled = datetime.datetime.utcnow()
323
273
        # Schedule a new checker to be started an 'interval' from now,
324
274
        # and every interval from then on.
325
275
        self.checker_initiator_tag = (gobject.timeout_add
326
276
                                      (self.interval_milliseconds(),
327
277
                                       self.start_checker))
 
278
        # Also start a new checker *right now*.
 
279
        self.start_checker()
328
280
        # Schedule a disable() when 'timeout' has passed
329
281
        self.disable_initiator_tag = (gobject.timeout_add
330
282
                                   (self.timeout_milliseconds(),
331
283
                                    self.disable))
332
284
        self.enabled = True
333
 
        # Also start a new checker *right now*.
334
 
        self.start_checker()
 
285
        if self.use_dbus:
 
286
            # Emit D-Bus signals
 
287
            self.PropertyChanged(dbus.String(u"enabled"),
 
288
                                 dbus.Boolean(True, variant_level=1))
 
289
            self.PropertyChanged(dbus.String(u"last_enabled"),
 
290
                                 (_datetime_to_dbus(self.last_enabled,
 
291
                                                    variant_level=1)))
335
292
    
336
 
    def disable(self, quiet=True):
 
293
    def disable(self):
337
294
        """Disable this client."""
338
295
        if not getattr(self, "enabled", False):
339
296
            return False
340
 
        if not quiet:
341
 
            logger.info(u"Disabling client %s", self.name)
342
 
        if getattr(self, u"disable_initiator_tag", False):
 
297
        logger.info(u"Disabling client %s", self.name)
 
298
        if getattr(self, "disable_initiator_tag", False):
343
299
            gobject.source_remove(self.disable_initiator_tag)
344
300
            self.disable_initiator_tag = None
345
 
        if getattr(self, u"checker_initiator_tag", False):
 
301
        if getattr(self, "checker_initiator_tag", False):
346
302
            gobject.source_remove(self.checker_initiator_tag)
347
303
            self.checker_initiator_tag = None
348
304
        self.stop_checker()
349
305
        if self.disable_hook:
350
306
            self.disable_hook(self)
351
307
        self.enabled = False
 
308
        if self.use_dbus:
 
309
            # Emit D-Bus signal
 
310
            self.PropertyChanged(dbus.String(u"enabled"),
 
311
                                 dbus.Boolean(False, variant_level=1))
352
312
        # Do not run this again if called by a gobject.timeout_add
353
313
        return False
354
314
    
360
320
        """The checker has completed, so take appropriate actions."""
361
321
        self.checker_callback_tag = None
362
322
        self.checker = None
 
323
        if self.use_dbus:
 
324
            # Emit D-Bus signal
 
325
            self.PropertyChanged(dbus.String(u"checker_running"),
 
326
                                 dbus.Boolean(False, variant_level=1))
363
327
        if os.WIFEXITED(condition):
364
328
            exitstatus = os.WEXITSTATUS(condition)
365
329
            if exitstatus == 0:
369
333
            else:
370
334
                logger.info(u"Checker for %(name)s failed",
371
335
                            vars(self))
 
336
            if self.use_dbus:
 
337
                # Emit D-Bus signal
 
338
                self.CheckerCompleted(dbus.Int16(exitstatus),
 
339
                                      dbus.Int64(condition),
 
340
                                      dbus.String(command))
372
341
        else:
373
342
            logger.warning(u"Checker for %(name)s crashed?",
374
343
                           vars(self))
 
344
            if self.use_dbus:
 
345
                # Emit D-Bus signal
 
346
                self.CheckerCompleted(dbus.Int16(-1),
 
347
                                      dbus.Int64(condition),
 
348
                                      dbus.String(command))
375
349
    
376
350
    def checked_ok(self):
377
351
        """Bump up the timeout for this client.
378
 
        
379
352
        This should only be called when the client has been seen,
380
353
        alive and well.
381
354
        """
384
357
        self.disable_initiator_tag = (gobject.timeout_add
385
358
                                      (self.timeout_milliseconds(),
386
359
                                       self.disable))
 
360
        if self.use_dbus:
 
361
            # Emit D-Bus signal
 
362
            self.PropertyChanged(
 
363
                dbus.String(u"last_checked_ok"),
 
364
                (_datetime_to_dbus(self.last_checked_ok,
 
365
                                   variant_level=1)))
387
366
    
388
367
    def start_checker(self):
389
368
        """Start a new checker subprocess if one is not running.
390
 
        
391
369
        If a checker already exists, leave it running and do
392
370
        nothing."""
393
371
        # The reason for not killing a running checker is that if we
396
374
        # client would inevitably timeout, since no checker would get
397
375
        # a chance to run to completion.  If we instead leave running
398
376
        # checkers alone, the checker would have to take more time
399
 
        # than 'timeout' for the client to be disabled, which is as it
400
 
        # should be.
401
 
        
402
 
        # If a checker exists, make sure it is not a zombie
403
 
        try:
404
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
405
 
        except (AttributeError, OSError), error:
406
 
            if (isinstance(error, OSError)
407
 
                and error.errno != errno.ECHILD):
408
 
                raise error
409
 
        else:
410
 
            if pid:
411
 
                logger.warning(u"Checker was a zombie")
412
 
                gobject.source_remove(self.checker_callback_tag)
413
 
                self.checker_callback(pid, status,
414
 
                                      self.current_checker_command)
415
 
        # Start a new checker if needed
 
377
        # than 'timeout' for the client to be declared invalid, which
 
378
        # is as it should be.
416
379
        if self.checker is None:
417
380
            try:
418
381
                # In case checker_command has exactly one % operator
419
382
                command = self.checker_command % self.host
420
383
            except TypeError:
421
384
                # Escape attributes for the shell
422
 
                escaped_attrs = dict((key,
423
 
                                      re.escape(unicode(str(val),
424
 
                                                        errors=
425
 
                                                        u'replace')))
 
385
                escaped_attrs = dict((key, re.escape(str(val)))
426
386
                                     for key, val in
427
387
                                     vars(self).iteritems())
428
388
                try:
431
391
                    logger.error(u'Could not format string "%s":'
432
392
                                 u' %s', self.checker_command, error)
433
393
                    return True # Try again later
434
 
            self.current_checker_command = command
435
394
            try:
436
395
                logger.info(u"Starting checker %r for %s",
437
396
                            command, self.name)
441
400
                # always replaced by /dev/null.)
442
401
                self.checker = subprocess.Popen(command,
443
402
                                                close_fds=True,
444
 
                                                shell=True, cwd=u"/")
 
403
                                                shell=True, cwd="/")
 
404
                if self.use_dbus:
 
405
                    # Emit D-Bus signal
 
406
                    self.CheckerStarted(command)
 
407
                    self.PropertyChanged(
 
408
                        dbus.String("checker_running"),
 
409
                        dbus.Boolean(True, variant_level=1))
445
410
                self.checker_callback_tag = (gobject.child_watch_add
446
411
                                             (self.checker.pid,
447
412
                                              self.checker_callback,
448
413
                                              data=command))
449
 
                # The checker may have completed before the gobject
450
 
                # watch was added.  Check for this.
451
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
452
 
                if pid:
453
 
                    gobject.source_remove(self.checker_callback_tag)
454
 
                    self.checker_callback(pid, status, command)
455
414
            except OSError, error:
456
415
                logger.error(u"Failed to start subprocess: %s",
457
416
                             error)
463
422
        if self.checker_callback_tag:
464
423
            gobject.source_remove(self.checker_callback_tag)
465
424
            self.checker_callback_tag = None
466
 
        if getattr(self, u"checker", None) is None:
 
425
        if getattr(self, "checker", None) is None:
467
426
            return
468
427
        logger.debug(u"Stopping checker for %(name)s", vars(self))
469
428
        try:
470
429
            os.kill(self.checker.pid, signal.SIGTERM)
471
 
            #time.sleep(0.5)
 
430
            #os.sleep(0.5)
472
431
            #if self.checker.poll() is None:
473
432
            #    os.kill(self.checker.pid, signal.SIGKILL)
474
433
        except OSError, error:
475
434
            if error.errno != errno.ESRCH: # No such process
476
435
                raise
477
436
        self.checker = None
478
 
 
479
 
 
480
 
def dbus_service_property(dbus_interface, signature=u"v",
481
 
                          access=u"readwrite", byte_arrays=False):
482
 
    """Decorators for marking methods of a DBusObjectWithProperties to
483
 
    become properties on the D-Bus.
484
 
    
485
 
    The decorated method will be called with no arguments by "Get"
486
 
    and with one argument by "Set".
487
 
    
488
 
    The parameters, where they are supported, are the same as
489
 
    dbus.service.method, except there is only "signature", since the
490
 
    type from Get() and the type sent to Set() is the same.
491
 
    """
492
 
    # Encoding deeply encoded byte arrays is not supported yet by the
493
 
    # "Set" method, so we fail early here:
494
 
    if byte_arrays and signature != u"ay":
495
 
        raise ValueError(u"Byte arrays not supported for non-'ay'"
496
 
                         u" signature %r" % signature)
497
 
    def decorator(func):
498
 
        func._dbus_is_property = True
499
 
        func._dbus_interface = dbus_interface
500
 
        func._dbus_signature = signature
501
 
        func._dbus_access = access
502
 
        func._dbus_name = func.__name__
503
 
        if func._dbus_name.endswith(u"_dbus_property"):
504
 
            func._dbus_name = func._dbus_name[:-14]
505
 
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
506
 
        return func
507
 
    return decorator
508
 
 
509
 
 
510
 
class DBusPropertyException(dbus.exceptions.DBusException):
511
 
    """A base class for D-Bus property-related exceptions
512
 
    """
513
 
    def __unicode__(self):
514
 
        return unicode(str(self))
515
 
 
516
 
 
517
 
class DBusPropertyAccessException(DBusPropertyException):
518
 
    """A property's access permissions disallows an operation.
519
 
    """
520
 
    pass
521
 
 
522
 
 
523
 
class DBusPropertyNotFound(DBusPropertyException):
524
 
    """An attempt was made to access a non-existing property.
525
 
    """
526
 
    pass
527
 
 
528
 
 
529
 
class DBusObjectWithProperties(dbus.service.Object):
530
 
    """A D-Bus object with properties.
531
 
 
532
 
    Classes inheriting from this can use the dbus_service_property
533
 
    decorator to expose methods as D-Bus properties.  It exposes the
534
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
535
 
    """
536
 
    
537
 
    @staticmethod
538
 
    def _is_dbus_property(obj):
539
 
        return getattr(obj, u"_dbus_is_property", False)
540
 
    
541
 
    def _get_all_dbus_properties(self):
542
 
        """Returns a generator of (name, attribute) pairs
543
 
        """
544
 
        return ((prop._dbus_name, prop)
545
 
                for name, prop in
546
 
                inspect.getmembers(self, self._is_dbus_property))
547
 
    
548
 
    def _get_dbus_property(self, interface_name, property_name):
549
 
        """Returns a bound method if one exists which is a D-Bus
550
 
        property with the specified name and interface.
551
 
        """
552
 
        for name in (property_name,
553
 
                     property_name + u"_dbus_property"):
554
 
            prop = getattr(self, name, None)
555
 
            if (prop is None
556
 
                or not self._is_dbus_property(prop)
557
 
                or prop._dbus_name != property_name
558
 
                or (interface_name and prop._dbus_interface
559
 
                    and interface_name != prop._dbus_interface)):
560
 
                continue
561
 
            return prop
562
 
        # No such property
563
 
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
564
 
                                   + interface_name + u"."
565
 
                                   + property_name)
566
 
    
567
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
568
 
                         out_signature=u"v")
569
 
    def Get(self, interface_name, property_name):
570
 
        """Standard D-Bus property Get() method, see D-Bus standard.
571
 
        """
572
 
        prop = self._get_dbus_property(interface_name, property_name)
573
 
        if prop._dbus_access == u"write":
574
 
            raise DBusPropertyAccessException(property_name)
575
 
        value = prop()
576
 
        if not hasattr(value, u"variant_level"):
577
 
            return value
578
 
        return type(value)(value, variant_level=value.variant_level+1)
579
 
    
580
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
581
 
    def Set(self, interface_name, property_name, value):
582
 
        """Standard D-Bus property Set() method, see D-Bus standard.
583
 
        """
584
 
        prop = self._get_dbus_property(interface_name, property_name)
585
 
        if prop._dbus_access == u"read":
586
 
            raise DBusPropertyAccessException(property_name)
587
 
        if prop._dbus_get_args_options[u"byte_arrays"]:
588
 
            # The byte_arrays option is not supported yet on
589
 
            # signatures other than "ay".
590
 
            if prop._dbus_signature != u"ay":
591
 
                raise ValueError
592
 
            value = dbus.ByteArray(''.join(unichr(byte)
593
 
                                           for byte in value))
594
 
        prop(value)
595
 
    
596
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
597
 
                         out_signature=u"a{sv}")
598
 
    def GetAll(self, interface_name):
599
 
        """Standard D-Bus property GetAll() method, see D-Bus
600
 
        standard.
601
 
 
602
 
        Note: Will not include properties with access="write".
603
 
        """
604
 
        all = {}
605
 
        for name, prop in self._get_all_dbus_properties():
606
 
            if (interface_name
607
 
                and interface_name != prop._dbus_interface):
608
 
                # Interface non-empty but did not match
609
 
                continue
610
 
            # Ignore write-only properties
611
 
            if prop._dbus_access == u"write":
612
 
                continue
613
 
            value = prop()
614
 
            if not hasattr(value, u"variant_level"):
615
 
                all[name] = value
616
 
                continue
617
 
            all[name] = type(value)(value, variant_level=
618
 
                                    value.variant_level+1)
619
 
        return dbus.Dictionary(all, signature=u"sv")
620
 
    
621
 
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
622
 
                         out_signature=u"s",
623
 
                         path_keyword='object_path',
624
 
                         connection_keyword='connection')
625
 
    def Introspect(self, object_path, connection):
626
 
        """Standard D-Bus method, overloaded to insert property tags.
627
 
        """
628
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
629
 
                                                   connection)
630
 
        try:
631
 
            document = xml.dom.minidom.parseString(xmlstring)
632
 
            def make_tag(document, name, prop):
633
 
                e = document.createElement(u"property")
634
 
                e.setAttribute(u"name", name)
635
 
                e.setAttribute(u"type", prop._dbus_signature)
636
 
                e.setAttribute(u"access", prop._dbus_access)
637
 
                return e
638
 
            for if_tag in document.getElementsByTagName(u"interface"):
639
 
                for tag in (make_tag(document, name, prop)
640
 
                            for name, prop
641
 
                            in self._get_all_dbus_properties()
642
 
                            if prop._dbus_interface
643
 
                            == if_tag.getAttribute(u"name")):
644
 
                    if_tag.appendChild(tag)
645
 
                # Add the names to the return values for the
646
 
                # "org.freedesktop.DBus.Properties" methods
647
 
                if (if_tag.getAttribute(u"name")
648
 
                    == u"org.freedesktop.DBus.Properties"):
649
 
                    for cn in if_tag.getElementsByTagName(u"method"):
650
 
                        if cn.getAttribute(u"name") == u"Get":
651
 
                            for arg in cn.getElementsByTagName(u"arg"):
652
 
                                if (arg.getAttribute(u"direction")
653
 
                                    == u"out"):
654
 
                                    arg.setAttribute(u"name", u"value")
655
 
                        elif cn.getAttribute(u"name") == u"GetAll":
656
 
                            for arg in cn.getElementsByTagName(u"arg"):
657
 
                                if (arg.getAttribute(u"direction")
658
 
                                    == u"out"):
659
 
                                    arg.setAttribute(u"name", u"props")
660
 
            xmlstring = document.toxml(u"utf-8")
661
 
            document.unlink()
662
 
        except (AttributeError, xml.dom.DOMException,
663
 
                xml.parsers.expat.ExpatError), error:
664
 
            logger.error(u"Failed to override Introspection method",
665
 
                         error)
666
 
        return xmlstring
667
 
 
668
 
 
669
 
class ClientDBus(Client, DBusObjectWithProperties):
670
 
    """A Client class using D-Bus
671
 
    
672
 
    Attributes:
673
 
    dbus_object_path: dbus.ObjectPath
674
 
    bus: dbus.SystemBus()
675
 
    """
676
 
    # dbus.service.Object doesn't use super(), so we can't either.
677
 
    
678
 
    def __init__(self, bus = None, *args, **kwargs):
679
 
        self.bus = bus
680
 
        Client.__init__(self, *args, **kwargs)
681
 
        # Only now, when this client is initialized, can it show up on
682
 
        # the D-Bus
683
 
        self.dbus_object_path = (dbus.ObjectPath
684
 
                                 (u"/clients/"
685
 
                                  + self.name.replace(u".", u"_")))
686
 
        DBusObjectWithProperties.__init__(self, self.bus,
687
 
                                          self.dbus_object_path)
688
 
    
689
 
    @staticmethod
690
 
    def _datetime_to_dbus(dt, variant_level=0):
691
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
692
 
        return dbus.String(dt.isoformat(),
693
 
                           variant_level=variant_level)
694
 
    
695
 
    def enable(self):
696
 
        oldstate = getattr(self, u"enabled", False)
697
 
        r = Client.enable(self)
698
 
        if oldstate != self.enabled:
699
 
            # Emit D-Bus signals
700
 
            self.PropertyChanged(dbus.String(u"enabled"),
701
 
                                 dbus.Boolean(True, variant_level=1))
702
 
            self.PropertyChanged(
703
 
                dbus.String(u"last_enabled"),
704
 
                self._datetime_to_dbus(self.last_enabled,
705
 
                                       variant_level=1))
706
 
        return r
707
 
    
708
 
    def disable(self, quiet = False):
709
 
        oldstate = getattr(self, u"enabled", False)
710
 
        r = Client.disable(self, quiet=quiet)
711
 
        if not quiet and oldstate != self.enabled:
712
 
            # Emit D-Bus signal
713
 
            self.PropertyChanged(dbus.String(u"enabled"),
714
 
                                 dbus.Boolean(False, variant_level=1))
715
 
        return r
716
 
    
717
 
    def __del__(self, *args, **kwargs):
718
 
        try:
719
 
            self.remove_from_connection()
720
 
        except LookupError:
721
 
            pass
722
 
        if hasattr(DBusObjectWithProperties, u"__del__"):
723
 
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
724
 
        Client.__del__(self, *args, **kwargs)
725
 
    
726
 
    def checker_callback(self, pid, condition, command,
727
 
                         *args, **kwargs):
728
 
        self.checker_callback_tag = None
729
 
        self.checker = None
730
 
        # Emit D-Bus signal
731
 
        self.PropertyChanged(dbus.String(u"checker_running"),
732
 
                             dbus.Boolean(False, variant_level=1))
733
 
        if os.WIFEXITED(condition):
734
 
            exitstatus = os.WEXITSTATUS(condition)
735
 
            # Emit D-Bus signal
736
 
            self.CheckerCompleted(dbus.Int16(exitstatus),
737
 
                                  dbus.Int64(condition),
738
 
                                  dbus.String(command))
739
 
        else:
740
 
            # Emit D-Bus signal
741
 
            self.CheckerCompleted(dbus.Int16(-1),
742
 
                                  dbus.Int64(condition),
743
 
                                  dbus.String(command))
744
 
        
745
 
        return Client.checker_callback(self, pid, condition, command,
746
 
                                       *args, **kwargs)
747
 
    
748
 
    def checked_ok(self, *args, **kwargs):
749
 
        r = Client.checked_ok(self, *args, **kwargs)
750
 
        # Emit D-Bus signal
751
 
        self.PropertyChanged(
752
 
            dbus.String(u"last_checked_ok"),
753
 
            (self._datetime_to_dbus(self.last_checked_ok,
754
 
                                    variant_level=1)))
755
 
        return r
756
 
    
757
 
    def start_checker(self, *args, **kwargs):
758
 
        old_checker = self.checker
759
 
        if self.checker is not None:
760
 
            old_checker_pid = self.checker.pid
761
 
        else:
762
 
            old_checker_pid = None
763
 
        r = Client.start_checker(self, *args, **kwargs)
764
 
        # Only if new checker process was started
765
 
        if (self.checker is not None
766
 
            and old_checker_pid != self.checker.pid):
767
 
            # Emit D-Bus signal
768
 
            self.CheckerStarted(self.current_checker_command)
769
 
            self.PropertyChanged(
770
 
                dbus.String(u"checker_running"),
771
 
                dbus.Boolean(True, variant_level=1))
772
 
        return r
773
 
    
774
 
    def stop_checker(self, *args, **kwargs):
775
 
        old_checker = getattr(self, u"checker", None)
776
 
        r = Client.stop_checker(self, *args, **kwargs)
777
 
        if (old_checker is not None
778
 
            and getattr(self, u"checker", None) is None):
 
437
        if self.use_dbus:
779
438
            self.PropertyChanged(dbus.String(u"checker_running"),
780
439
                                 dbus.Boolean(False, variant_level=1))
781
 
        return r
782
 
    
783
 
    ## D-Bus methods, signals & properties
 
440
    
 
441
    def still_valid(self):
 
442
        """Has the timeout not yet passed for this client?"""
 
443
        if not getattr(self, "enabled", False):
 
444
            return False
 
445
        now = datetime.datetime.utcnow()
 
446
        if self.last_checked_ok is None:
 
447
            return now < (self.created + self.timeout)
 
448
        else:
 
449
            return now < (self.last_checked_ok + self.timeout)
 
450
    
 
451
    ## D-Bus methods & signals
784
452
    _interface = u"se.bsnet.fukt.Mandos.Client"
785
453
    
786
 
    ## Signals
 
454
    # CheckedOK - method
 
455
    CheckedOK = dbus.service.method(_interface)(checked_ok)
 
456
    CheckedOK.__name__ = "CheckedOK"
787
457
    
788
458
    # CheckerCompleted - signal
789
 
    @dbus.service.signal(_interface, signature=u"nxs")
 
459
    @dbus.service.signal(_interface, signature="nxs")
790
460
    def CheckerCompleted(self, exitcode, waitstatus, command):
791
461
        "D-Bus signal"
792
462
        pass
793
463
    
794
464
    # CheckerStarted - signal
795
 
    @dbus.service.signal(_interface, signature=u"s")
 
465
    @dbus.service.signal(_interface, signature="s")
796
466
    def CheckerStarted(self, command):
797
467
        "D-Bus signal"
798
468
        pass
799
469
    
 
470
    # GetAllProperties - method
 
471
    @dbus.service.method(_interface, out_signature="a{sv}")
 
472
    def GetAllProperties(self):
 
473
        "D-Bus method"
 
474
        return dbus.Dictionary({
 
475
                dbus.String("name"):
 
476
                    dbus.String(self.name, variant_level=1),
 
477
                dbus.String("fingerprint"):
 
478
                    dbus.String(self.fingerprint, variant_level=1),
 
479
                dbus.String("host"):
 
480
                    dbus.String(self.host, variant_level=1),
 
481
                dbus.String("created"):
 
482
                    _datetime_to_dbus(self.created, variant_level=1),
 
483
                dbus.String("last_enabled"):
 
484
                    (_datetime_to_dbus(self.last_enabled,
 
485
                                       variant_level=1)
 
486
                     if self.last_enabled is not None
 
487
                     else dbus.Boolean(False, variant_level=1)),
 
488
                dbus.String("enabled"):
 
489
                    dbus.Boolean(self.enabled, variant_level=1),
 
490
                dbus.String("last_checked_ok"):
 
491
                    (_datetime_to_dbus(self.last_checked_ok,
 
492
                                       variant_level=1)
 
493
                     if self.last_checked_ok is not None
 
494
                     else dbus.Boolean (False, variant_level=1)),
 
495
                dbus.String("timeout"):
 
496
                    dbus.UInt64(self.timeout_milliseconds(),
 
497
                                variant_level=1),
 
498
                dbus.String("interval"):
 
499
                    dbus.UInt64(self.interval_milliseconds(),
 
500
                                variant_level=1),
 
501
                dbus.String("checker"):
 
502
                    dbus.String(self.checker_command,
 
503
                                variant_level=1),
 
504
                dbus.String("checker_running"):
 
505
                    dbus.Boolean(self.checker is not None,
 
506
                                 variant_level=1),
 
507
                dbus.String("object_path"):
 
508
                    dbus.ObjectPath(self.dbus_object_path,
 
509
                                    variant_level=1)
 
510
                }, signature="sv")
 
511
    
 
512
    # IsStillValid - method
 
513
    IsStillValid = (dbus.service.method(_interface, out_signature="b")
 
514
                    (still_valid))
 
515
    IsStillValid.__name__ = "IsStillValid"
 
516
    
800
517
    # PropertyChanged - signal
801
 
    @dbus.service.signal(_interface, signature=u"sv")
 
518
    @dbus.service.signal(_interface, signature="sv")
802
519
    def PropertyChanged(self, property, value):
803
520
        "D-Bus signal"
804
521
        pass
805
522
    
806
 
    # GotSecret - signal
807
 
    @dbus.service.signal(_interface)
808
 
    def GotSecret(self):
809
 
        "D-Bus signal"
810
 
        pass
811
 
    
812
 
    # Rejected - signal
813
 
    @dbus.service.signal(_interface)
814
 
    def Rejected(self):
815
 
        "D-Bus signal"
816
 
        pass
817
 
    
818
 
    ## Methods
819
 
    
820
 
    # CheckedOK - method
821
 
    @dbus.service.method(_interface)
822
 
    def CheckedOK(self):
823
 
        return self.checked_ok()
 
523
    # SetChecker - method
 
524
    @dbus.service.method(_interface, in_signature="s")
 
525
    def SetChecker(self, checker):
 
526
        "D-Bus setter method"
 
527
        self.checker_command = checker
 
528
        # Emit D-Bus signal
 
529
        self.PropertyChanged(dbus.String(u"checker"),
 
530
                             dbus.String(self.checker_command,
 
531
                                         variant_level=1))
 
532
    
 
533
    # SetHost - method
 
534
    @dbus.service.method(_interface, in_signature="s")
 
535
    def SetHost(self, host):
 
536
        "D-Bus setter method"
 
537
        self.host = host
 
538
        # Emit D-Bus signal
 
539
        self.PropertyChanged(dbus.String(u"host"),
 
540
                             dbus.String(self.host, variant_level=1))
 
541
    
 
542
    # SetInterval - method
 
543
    @dbus.service.method(_interface, in_signature="t")
 
544
    def SetInterval(self, milliseconds):
 
545
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
 
546
        # Emit D-Bus signal
 
547
        self.PropertyChanged(dbus.String(u"interval"),
 
548
                             (dbus.UInt64(self.interval_milliseconds(),
 
549
                                          variant_level=1)))
 
550
    
 
551
    # SetSecret - method
 
552
    @dbus.service.method(_interface, in_signature="ay",
 
553
                         byte_arrays=True)
 
554
    def SetSecret(self, secret):
 
555
        "D-Bus setter method"
 
556
        self.secret = str(secret)
 
557
    
 
558
    # SetTimeout - method
 
559
    @dbus.service.method(_interface, in_signature="t")
 
560
    def SetTimeout(self, milliseconds):
 
561
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
 
562
        # Emit D-Bus signal
 
563
        self.PropertyChanged(dbus.String(u"timeout"),
 
564
                             (dbus.UInt64(self.timeout_milliseconds(),
 
565
                                          variant_level=1)))
824
566
    
825
567
    # Enable - method
826
 
    @dbus.service.method(_interface)
827
 
    def Enable(self):
828
 
        "D-Bus method"
829
 
        self.enable()
 
568
    Enable = dbus.service.method(_interface)(enable)
 
569
    Enable.__name__ = "Enable"
830
570
    
831
571
    # StartChecker - method
832
572
    @dbus.service.method(_interface)
841
581
        self.disable()
842
582
    
843
583
    # StopChecker - method
844
 
    @dbus.service.method(_interface)
845
 
    def StopChecker(self):
846
 
        self.stop_checker()
847
 
    
848
 
    ## Properties
849
 
    
850
 
    # name - property
851
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
852
 
    def name_dbus_property(self):
853
 
        return dbus.String(self.name)
854
 
    
855
 
    # fingerprint - property
856
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
857
 
    def fingerprint_dbus_property(self):
858
 
        return dbus.String(self.fingerprint)
859
 
    
860
 
    # host - property
861
 
    @dbus_service_property(_interface, signature=u"s",
862
 
                           access=u"readwrite")
863
 
    def host_dbus_property(self, value=None):
864
 
        if value is None:       # get
865
 
            return dbus.String(self.host)
866
 
        self.host = value
867
 
        # Emit D-Bus signal
868
 
        self.PropertyChanged(dbus.String(u"host"),
869
 
                             dbus.String(value, variant_level=1))
870
 
    
871
 
    # created - property
872
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
873
 
    def created_dbus_property(self):
874
 
        return dbus.String(self._datetime_to_dbus(self.created))
875
 
    
876
 
    # last_enabled - property
877
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
878
 
    def last_enabled_dbus_property(self):
879
 
        if self.last_enabled is None:
880
 
            return dbus.String(u"")
881
 
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
882
 
    
883
 
    # enabled - property
884
 
    @dbus_service_property(_interface, signature=u"b",
885
 
                           access=u"readwrite")
886
 
    def enabled_dbus_property(self, value=None):
887
 
        if value is None:       # get
888
 
            return dbus.Boolean(self.enabled)
889
 
        if value:
890
 
            self.enable()
891
 
        else:
892
 
            self.disable()
893
 
    
894
 
    # last_checked_ok - property
895
 
    @dbus_service_property(_interface, signature=u"s",
896
 
                           access=u"readwrite")
897
 
    def last_checked_ok_dbus_property(self, value=None):
898
 
        if value is not None:
899
 
            self.checked_ok()
900
 
            return
901
 
        if self.last_checked_ok is None:
902
 
            return dbus.String(u"")
903
 
        return dbus.String(self._datetime_to_dbus(self
904
 
                                                  .last_checked_ok))
905
 
    
906
 
    # timeout - property
907
 
    @dbus_service_property(_interface, signature=u"t",
908
 
                           access=u"readwrite")
909
 
    def timeout_dbus_property(self, value=None):
910
 
        if value is None:       # get
911
 
            return dbus.UInt64(self.timeout_milliseconds())
912
 
        self.timeout = datetime.timedelta(0, 0, 0, value)
913
 
        # Emit D-Bus signal
914
 
        self.PropertyChanged(dbus.String(u"timeout"),
915
 
                             dbus.UInt64(value, variant_level=1))
916
 
        if getattr(self, u"disable_initiator_tag", None) is None:
917
 
            return
918
 
        # Reschedule timeout
919
 
        gobject.source_remove(self.disable_initiator_tag)
920
 
        self.disable_initiator_tag = None
921
 
        time_to_die = (self.
922
 
                       _timedelta_to_milliseconds((self
923
 
                                                   .last_checked_ok
924
 
                                                   + self.timeout)
925
 
                                                  - datetime.datetime
926
 
                                                  .utcnow()))
927
 
        if time_to_die <= 0:
928
 
            # The timeout has passed
929
 
            self.disable()
930
 
        else:
931
 
            self.disable_initiator_tag = (gobject.timeout_add
932
 
                                          (time_to_die, self.disable))
933
 
    
934
 
    # interval - property
935
 
    @dbus_service_property(_interface, signature=u"t",
936
 
                           access=u"readwrite")
937
 
    def interval_dbus_property(self, value=None):
938
 
        if value is None:       # get
939
 
            return dbus.UInt64(self.interval_milliseconds())
940
 
        self.interval = datetime.timedelta(0, 0, 0, value)
941
 
        # Emit D-Bus signal
942
 
        self.PropertyChanged(dbus.String(u"interval"),
943
 
                             dbus.UInt64(value, variant_level=1))
944
 
        if getattr(self, u"checker_initiator_tag", None) is None:
945
 
            return
946
 
        # Reschedule checker run
947
 
        gobject.source_remove(self.checker_initiator_tag)
948
 
        self.checker_initiator_tag = (gobject.timeout_add
949
 
                                      (value, self.start_checker))
950
 
        self.start_checker()    # Start one now, too
951
 
 
952
 
    # checker - property
953
 
    @dbus_service_property(_interface, signature=u"s",
954
 
                           access=u"readwrite")
955
 
    def checker_dbus_property(self, value=None):
956
 
        if value is None:       # get
957
 
            return dbus.String(self.checker_command)
958
 
        self.checker_command = value
959
 
        # Emit D-Bus signal
960
 
        self.PropertyChanged(dbus.String(u"checker"),
961
 
                             dbus.String(self.checker_command,
962
 
                                         variant_level=1))
963
 
    
964
 
    # checker_running - property
965
 
    @dbus_service_property(_interface, signature=u"b",
966
 
                           access=u"readwrite")
967
 
    def checker_running_dbus_property(self, value=None):
968
 
        if value is None:       # get
969
 
            return dbus.Boolean(self.checker is not None)
970
 
        if value:
971
 
            self.start_checker()
972
 
        else:
973
 
            self.stop_checker()
974
 
    
975
 
    # object_path - property
976
 
    @dbus_service_property(_interface, signature=u"o", access=u"read")
977
 
    def object_path_dbus_property(self):
978
 
        return self.dbus_object_path # is already a dbus.ObjectPath
979
 
    
980
 
    # secret = property
981
 
    @dbus_service_property(_interface, signature=u"ay",
982
 
                           access=u"write", byte_arrays=True)
983
 
    def secret_dbus_property(self, value):
984
 
        self.secret = str(value)
 
584
    StopChecker = dbus.service.method(_interface)(stop_checker)
 
585
    StopChecker.__name__ = "StopChecker"
985
586
    
986
587
    del _interface
987
588
 
988
589
 
989
 
class ClientHandler(socketserver.BaseRequestHandler, object):
990
 
    """A class to handle client connections.
991
 
    
992
 
    Instantiated once for each connection to handle it.
 
590
def peer_certificate(session):
 
591
    "Return the peer's OpenPGP certificate as a bytestring"
 
592
    # If not an OpenPGP certificate...
 
593
    if (gnutls.library.functions
 
594
        .gnutls_certificate_type_get(session._c_object)
 
595
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
596
        # ...do the normal thing
 
597
        return session.peer_certificate
 
598
    list_size = ctypes.c_uint(1)
 
599
    cert_list = (gnutls.library.functions
 
600
                 .gnutls_certificate_get_peers
 
601
                 (session._c_object, ctypes.byref(list_size)))
 
602
    if not bool(cert_list) and list_size.value != 0:
 
603
        raise gnutls.errors.GNUTLSError("error getting peer"
 
604
                                        " certificate")
 
605
    if list_size.value == 0:
 
606
        return None
 
607
    cert = cert_list[0]
 
608
    return ctypes.string_at(cert.data, cert.size)
 
609
 
 
610
 
 
611
def fingerprint(openpgp):
 
612
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
 
613
    # New GnuTLS "datum" with the OpenPGP public key
 
614
    datum = (gnutls.library.types
 
615
             .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
616
                                         ctypes.POINTER
 
617
                                         (ctypes.c_ubyte)),
 
618
                             ctypes.c_uint(len(openpgp))))
 
619
    # New empty GnuTLS certificate
 
620
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
621
    (gnutls.library.functions
 
622
     .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
623
    # Import the OpenPGP public key into the certificate
 
624
    (gnutls.library.functions
 
625
     .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
626
                                gnutls.library.constants
 
627
                                .GNUTLS_OPENPGP_FMT_RAW))
 
628
    # Verify the self signature in the key
 
629
    crtverify = ctypes.c_uint()
 
630
    (gnutls.library.functions
 
631
     .gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
 
632
    if crtverify.value != 0:
 
633
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
634
        raise gnutls.errors.CertificateSecurityError("Verify failed")
 
635
    # New buffer for the fingerprint
 
636
    buf = ctypes.create_string_buffer(20)
 
637
    buf_len = ctypes.c_size_t()
 
638
    # Get the fingerprint from the certificate into the buffer
 
639
    (gnutls.library.functions
 
640
     .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
641
                                         ctypes.byref(buf_len)))
 
642
    # Deinit the certificate
 
643
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
644
    # Convert the buffer to a Python bytestring
 
645
    fpr = ctypes.string_at(buf, buf_len.value)
 
646
    # Convert the bytestring to hexadecimal notation
 
647
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
648
    return hex_fpr
 
649
 
 
650
 
 
651
class TCP_handler(SocketServer.BaseRequestHandler, object):
 
652
    """A TCP request handler class.
 
653
    Instantiated by IPv6_TCPServer for each request to handle it.
993
654
    Note: This will run in its own forked process."""
994
655
    
995
656
    def handle(self):
996
657
        logger.info(u"TCP connection from: %s",
997
658
                    unicode(self.client_address))
998
 
        logger.debug(u"IPC Pipe FD: %d",
999
 
                     self.server.child_pipe[1].fileno())
1000
 
        # Open IPC pipe to parent process
1001
 
        with contextlib.nested(self.server.child_pipe[1],
1002
 
                               self.server.parent_pipe[0]
1003
 
                               ) as (ipc, ipc_return):
1004
 
            session = (gnutls.connection
1005
 
                       .ClientSession(self.request,
1006
 
                                      gnutls.connection
1007
 
                                      .X509Credentials()))
1008
 
            
1009
 
            line = self.request.makefile().readline()
1010
 
            logger.debug(u"Protocol version: %r", line)
1011
 
            try:
1012
 
                if int(line.strip().split()[0]) > 1:
1013
 
                    raise RuntimeError
1014
 
            except (ValueError, IndexError, RuntimeError), error:
1015
 
                logger.error(u"Unknown protocol version: %s", error)
1016
 
                return
1017
 
            
1018
 
            # Note: gnutls.connection.X509Credentials is really a
1019
 
            # generic GnuTLS certificate credentials object so long as
1020
 
            # no X.509 keys are added to it.  Therefore, we can use it
1021
 
            # here despite using OpenPGP certificates.
1022
 
            
1023
 
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1024
 
            #                      u"+AES-256-CBC", u"+SHA1",
1025
 
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
1026
 
            #                      u"+DHE-DSS"))
1027
 
            # Use a fallback default, since this MUST be set.
1028
 
            priority = self.server.gnutls_priority
1029
 
            if priority is None:
1030
 
                priority = u"NORMAL"
1031
 
            (gnutls.library.functions
1032
 
             .gnutls_priority_set_direct(session._c_object,
1033
 
                                         priority, None))
1034
 
            
1035
 
            try:
1036
 
                session.handshake()
1037
 
            except gnutls.errors.GNUTLSError, error:
1038
 
                logger.warning(u"Handshake failed: %s", error)
1039
 
                # Do not run session.bye() here: the session is not
1040
 
                # established.  Just abandon the request.
1041
 
                return
1042
 
            logger.debug(u"Handshake succeeded")
1043
 
            try:
1044
 
                try:
1045
 
                    fpr = self.fingerprint(self.peer_certificate
1046
 
                                           (session))
1047
 
                except (TypeError, gnutls.errors.GNUTLSError), error:
1048
 
                    logger.warning(u"Bad certificate: %s", error)
1049
 
                    return
1050
 
                logger.debug(u"Fingerprint: %s", fpr)
1051
 
 
1052
 
                for c in self.server.clients:
1053
 
                    if c.fingerprint == fpr:
1054
 
                        client = c
1055
 
                        break
1056
 
                else:
1057
 
                    ipc.write(u"NOTFOUND %s %s\n"
1058
 
                              % (fpr, unicode(self.client_address)))
1059
 
                    return
1060
 
                # Have to check if client.enabled, since it is
1061
 
                # possible that the client was disabled since the
1062
 
                # GnuTLS session was established.
1063
 
                ipc.write(u"GETATTR enabled %s\n" % fpr)
1064
 
                enabled = pickle.load(ipc_return)
1065
 
                if not enabled:
1066
 
                    ipc.write(u"DISABLED %s\n" % client.name)
1067
 
                    return
1068
 
                ipc.write(u"SENDING %s\n" % client.name)
1069
 
                sent_size = 0
1070
 
                while sent_size < len(client.secret):
1071
 
                    sent = session.send(client.secret[sent_size:])
1072
 
                    logger.debug(u"Sent: %d, remaining: %d",
1073
 
                                 sent, len(client.secret)
1074
 
                                 - (sent_size + sent))
1075
 
                    sent_size += sent
1076
 
            finally:
1077
 
                session.bye()
1078
 
    
1079
 
    @staticmethod
1080
 
    def peer_certificate(session):
1081
 
        "Return the peer's OpenPGP certificate as a bytestring"
1082
 
        # If not an OpenPGP certificate...
1083
 
        if (gnutls.library.functions
1084
 
            .gnutls_certificate_type_get(session._c_object)
1085
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1086
 
            # ...do the normal thing
1087
 
            return session.peer_certificate
1088
 
        list_size = ctypes.c_uint(1)
1089
 
        cert_list = (gnutls.library.functions
1090
 
                     .gnutls_certificate_get_peers
1091
 
                     (session._c_object, ctypes.byref(list_size)))
1092
 
        if not bool(cert_list) and list_size.value != 0:
1093
 
            raise gnutls.errors.GNUTLSError(u"error getting peer"
1094
 
                                            u" certificate")
1095
 
        if list_size.value == 0:
1096
 
            return None
1097
 
        cert = cert_list[0]
1098
 
        return ctypes.string_at(cert.data, cert.size)
1099
 
    
1100
 
    @staticmethod
1101
 
    def fingerprint(openpgp):
1102
 
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1103
 
        # New GnuTLS "datum" with the OpenPGP public key
1104
 
        datum = (gnutls.library.types
1105
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1106
 
                                             ctypes.POINTER
1107
 
                                             (ctypes.c_ubyte)),
1108
 
                                 ctypes.c_uint(len(openpgp))))
1109
 
        # New empty GnuTLS certificate
1110
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1111
 
        (gnutls.library.functions
1112
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1113
 
        # Import the OpenPGP public key into the certificate
1114
 
        (gnutls.library.functions
1115
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1116
 
                                    gnutls.library.constants
1117
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
1118
 
        # Verify the self signature in the key
1119
 
        crtverify = ctypes.c_uint()
1120
 
        (gnutls.library.functions
1121
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1122
 
                                         ctypes.byref(crtverify)))
1123
 
        if crtverify.value != 0:
1124
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1125
 
            raise (gnutls.errors.CertificateSecurityError
1126
 
                   (u"Verify failed"))
1127
 
        # New buffer for the fingerprint
1128
 
        buf = ctypes.create_string_buffer(20)
1129
 
        buf_len = ctypes.c_size_t()
1130
 
        # Get the fingerprint from the certificate into the buffer
1131
 
        (gnutls.library.functions
1132
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1133
 
                                             ctypes.byref(buf_len)))
1134
 
        # Deinit the certificate
1135
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1136
 
        # Convert the buffer to a Python bytestring
1137
 
        fpr = ctypes.string_at(buf, buf_len.value)
1138
 
        # Convert the bytestring to hexadecimal notation
1139
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1140
 
        return hex_fpr
1141
 
 
1142
 
 
1143
 
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
1144
 
    """Like socketserver.ForkingMixIn, but also pass a pipe pair."""
1145
 
    def process_request(self, request, client_address):
1146
 
        """Overrides and wraps the original process_request().
1147
 
        
1148
 
        This function creates a new pipe in self.pipe
1149
 
        """
1150
 
        # Child writes to child_pipe
1151
 
        self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1152
 
        # Parent writes to parent_pipe
1153
 
        self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1154
 
        super(ForkingMixInWithPipes,
1155
 
              self).process_request(request, client_address)
1156
 
        # Close unused ends for parent
1157
 
        self.parent_pipe[0].close() # close read end
1158
 
        self.child_pipe[1].close()  # close write end
1159
 
        self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
1160
 
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1161
 
        """Dummy function; override as necessary"""
1162
 
        child_pipe_fd.close()
1163
 
        parent_pipe_fd.close()
1164
 
 
1165
 
 
1166
 
class IPv6_TCPServer(ForkingMixInWithPipes,
1167
 
                     socketserver.TCPServer, object):
1168
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1169
 
    
 
659
        session = (gnutls.connection
 
660
                   .ClientSession(self.request,
 
661
                                  gnutls.connection
 
662
                                  .X509Credentials()))
 
663
        
 
664
        line = self.request.makefile().readline()
 
665
        logger.debug(u"Protocol version: %r", line)
 
666
        try:
 
667
            if int(line.strip().split()[0]) > 1:
 
668
                raise RuntimeError
 
669
        except (ValueError, IndexError, RuntimeError), error:
 
670
            logger.error(u"Unknown protocol version: %s", error)
 
671
            return
 
672
        
 
673
        # Note: gnutls.connection.X509Credentials is really a generic
 
674
        # GnuTLS certificate credentials object so long as no X.509
 
675
        # keys are added to it.  Therefore, we can use it here despite
 
676
        # using OpenPGP certificates.
 
677
        
 
678
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
 
679
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
 
680
        #                "+DHE-DSS"))
 
681
        # Use a fallback default, since this MUST be set.
 
682
        priority = self.server.settings.get("priority", "NORMAL")
 
683
        (gnutls.library.functions
 
684
         .gnutls_priority_set_direct(session._c_object,
 
685
                                     priority, None))
 
686
        
 
687
        try:
 
688
            session.handshake()
 
689
        except gnutls.errors.GNUTLSError, error:
 
690
            logger.warning(u"Handshake failed: %s", error)
 
691
            # Do not run session.bye() here: the session is not
 
692
            # established.  Just abandon the request.
 
693
            return
 
694
        logger.debug(u"Handshake succeeded")
 
695
        try:
 
696
            fpr = fingerprint(peer_certificate(session))
 
697
        except (TypeError, gnutls.errors.GNUTLSError), error:
 
698
            logger.warning(u"Bad certificate: %s", error)
 
699
            session.bye()
 
700
            return
 
701
        logger.debug(u"Fingerprint: %s", fpr)
 
702
        
 
703
        for c in self.server.clients:
 
704
            if c.fingerprint == fpr:
 
705
                client = c
 
706
                break
 
707
        else:
 
708
            logger.warning(u"Client not found for fingerprint: %s",
 
709
                           fpr)
 
710
            session.bye()
 
711
            return
 
712
        # Have to check if client.still_valid(), since it is possible
 
713
        # that the client timed out while establishing the GnuTLS
 
714
        # session.
 
715
        if not client.still_valid():
 
716
            logger.warning(u"Client %(name)s is invalid",
 
717
                           vars(client))
 
718
            session.bye()
 
719
            return
 
720
        ## This won't work here, since we're in a fork.
 
721
        # client.checked_ok()
 
722
        sent_size = 0
 
723
        while sent_size < len(client.secret):
 
724
            sent = session.send(client.secret[sent_size:])
 
725
            logger.debug(u"Sent: %d, remaining: %d",
 
726
                         sent, len(client.secret)
 
727
                         - (sent_size + sent))
 
728
            sent_size += sent
 
729
        session.bye()
 
730
 
 
731
 
 
732
class IPv6_TCPServer(SocketServer.ForkingMixIn,
 
733
                     SocketServer.TCPServer, object):
 
734
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
1170
735
    Attributes:
 
736
        settings:       Server settings
 
737
        clients:        Set() of Client objects
1171
738
        enabled:        Boolean; whether this server is activated yet
1172
 
        interface:      None or a network interface name (string)
1173
 
        use_ipv6:       Boolean; to use IPv6 or not
1174
739
    """
1175
 
    def __init__(self, server_address, RequestHandlerClass,
1176
 
                 interface=None, use_ipv6=True):
1177
 
        self.interface = interface
1178
 
        if use_ipv6:
1179
 
            self.address_family = socket.AF_INET6
1180
 
        socketserver.TCPServer.__init__(self, server_address,
1181
 
                                        RequestHandlerClass)
 
740
    address_family = socket.AF_INET6
 
741
    def __init__(self, *args, **kwargs):
 
742
        if "settings" in kwargs:
 
743
            self.settings = kwargs["settings"]
 
744
            del kwargs["settings"]
 
745
        if "clients" in kwargs:
 
746
            self.clients = kwargs["clients"]
 
747
            del kwargs["clients"]
 
748
        self.enabled = False
 
749
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1182
750
    def server_bind(self):
1183
751
        """This overrides the normal server_bind() function
1184
752
        to bind to an interface if one was specified, and also NOT to
1185
753
        bind to an address or port if they were not specified."""
1186
 
        if self.interface is not None:
1187
 
            if SO_BINDTODEVICE is None:
1188
 
                logger.error(u"SO_BINDTODEVICE does not exist;"
1189
 
                             u" cannot bind to interface %s",
1190
 
                             self.interface)
1191
 
            else:
1192
 
                try:
1193
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1194
 
                                           SO_BINDTODEVICE,
1195
 
                                           str(self.interface
1196
 
                                               + u'\0'))
1197
 
                except socket.error, error:
1198
 
                    if error[0] == errno.EPERM:
1199
 
                        logger.error(u"No permission to"
1200
 
                                     u" bind to interface %s",
1201
 
                                     self.interface)
1202
 
                    elif error[0] == errno.ENOPROTOOPT:
1203
 
                        logger.error(u"SO_BINDTODEVICE not available;"
1204
 
                                     u" cannot bind to interface %s",
1205
 
                                     self.interface)
1206
 
                    else:
1207
 
                        raise
 
754
        if self.settings["interface"]:
 
755
            # 25 is from /usr/include/asm-i486/socket.h
 
756
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
 
757
            try:
 
758
                self.socket.setsockopt(socket.SOL_SOCKET,
 
759
                                       SO_BINDTODEVICE,
 
760
                                       self.settings["interface"])
 
761
            except socket.error, error:
 
762
                if error[0] == errno.EPERM:
 
763
                    logger.error(u"No permission to"
 
764
                                 u" bind to interface %s",
 
765
                                 self.settings["interface"])
 
766
                else:
 
767
                    raise error
1208
768
        # Only bind(2) the socket if we really need to.
1209
769
        if self.server_address[0] or self.server_address[1]:
1210
770
            if not self.server_address[0]:
1211
 
                if self.address_family == socket.AF_INET6:
1212
 
                    any_address = u"::" # in6addr_any
1213
 
                else:
1214
 
                    any_address = socket.INADDR_ANY
1215
 
                self.server_address = (any_address,
 
771
                in6addr_any = "::"
 
772
                self.server_address = (in6addr_any,
1216
773
                                       self.server_address[1])
1217
774
            elif not self.server_address[1]:
1218
775
                self.server_address = (self.server_address[0],
1219
776
                                       0)
1220
 
#                 if self.interface:
 
777
#                 if self.settings["interface"]:
1221
778
#                     self.server_address = (self.server_address[0],
1222
779
#                                            0, # port
1223
780
#                                            0, # flowinfo
1224
781
#                                            if_nametoindex
1225
 
#                                            (self.interface))
1226
 
            return socketserver.TCPServer.server_bind(self)
1227
 
 
1228
 
 
1229
 
class MandosServer(IPv6_TCPServer):
1230
 
    """Mandos server.
1231
 
    
1232
 
    Attributes:
1233
 
        clients:        set of Client objects
1234
 
        gnutls_priority GnuTLS priority string
1235
 
        use_dbus:       Boolean; to emit D-Bus signals or not
1236
 
    
1237
 
    Assumes a gobject.MainLoop event loop.
1238
 
    """
1239
 
    def __init__(self, server_address, RequestHandlerClass,
1240
 
                 interface=None, use_ipv6=True, clients=None,
1241
 
                 gnutls_priority=None, use_dbus=True):
1242
 
        self.enabled = False
1243
 
        self.clients = clients
1244
 
        if self.clients is None:
1245
 
            self.clients = set()
1246
 
        self.use_dbus = use_dbus
1247
 
        self.gnutls_priority = gnutls_priority
1248
 
        IPv6_TCPServer.__init__(self, server_address,
1249
 
                                RequestHandlerClass,
1250
 
                                interface = interface,
1251
 
                                use_ipv6 = use_ipv6)
 
782
#                                            (self.settings
 
783
#                                             ["interface"]))
 
784
            return super(IPv6_TCPServer, self).server_bind()
1252
785
    def server_activate(self):
1253
786
        if self.enabled:
1254
 
            return socketserver.TCPServer.server_activate(self)
 
787
            return super(IPv6_TCPServer, self).server_activate()
1255
788
    def enable(self):
1256
789
        self.enabled = True
1257
 
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1258
 
        # Call "handle_ipc" for both data and EOF events
1259
 
        gobject.io_add_watch(child_pipe_fd.fileno(),
1260
 
                             gobject.IO_IN | gobject.IO_HUP,
1261
 
                             functools.partial(self.handle_ipc,
1262
 
                                               reply = parent_pipe_fd,
1263
 
                                               sender= child_pipe_fd))
1264
 
    def handle_ipc(self, source, condition, reply=None, sender=None):
1265
 
        condition_names = {
1266
 
            gobject.IO_IN: u"IN",   # There is data to read.
1267
 
            gobject.IO_OUT: u"OUT", # Data can be written (without
1268
 
                                    # blocking).
1269
 
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
1270
 
            gobject.IO_ERR: u"ERR", # Error condition.
1271
 
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
1272
 
                                    # broken, usually for pipes and
1273
 
                                    # sockets).
1274
 
            }
1275
 
        conditions_string = ' | '.join(name
1276
 
                                       for cond, name in
1277
 
                                       condition_names.iteritems()
1278
 
                                       if cond & condition)
1279
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1280
 
                     conditions_string)
1281
 
        
1282
 
        # Read a line from the file object
1283
 
        cmdline = sender.readline()
1284
 
        if not cmdline:             # Empty line means end of file
1285
 
            # close the IPC pipes
1286
 
            sender.close()
1287
 
            reply.close()
1288
 
            
1289
 
            # Stop calling this function
1290
 
            return False
1291
 
        
1292
 
        logger.debug(u"IPC command: %r", cmdline)
1293
 
        
1294
 
        # Parse and act on command
1295
 
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1296
 
        
1297
 
        if cmd == u"NOTFOUND":
1298
 
            fpr, address = args.split(None, 1)
1299
 
            logger.warning(u"Client not found for fingerprint: %s, ad"
1300
 
                           u"dress: %s", fpr, address)
1301
 
            if self.use_dbus:
1302
 
                # Emit D-Bus signal
1303
 
                mandos_dbus_service.ClientNotFound(fpr, address)
1304
 
        elif cmd == u"DISABLED":
1305
 
            for client in self.clients:
1306
 
                if client.name == args:
1307
 
                    logger.warning(u"Client %s is disabled", args)
1308
 
                    if self.use_dbus:
1309
 
                        # Emit D-Bus signal
1310
 
                        client.Rejected()
1311
 
                    break
1312
 
            else:
1313
 
                logger.error(u"Unknown client %s is disabled", args)
1314
 
        elif cmd == u"SENDING":
1315
 
            for client in self.clients:
1316
 
                if client.name == args:
1317
 
                    logger.info(u"Sending secret to %s", client.name)
1318
 
                    client.checked_ok()
1319
 
                    if self.use_dbus:
1320
 
                        # Emit D-Bus signal
1321
 
                        client.GotSecret()
1322
 
                    break
1323
 
            else:
1324
 
                logger.error(u"Sending secret to unknown client %s",
1325
 
                             args)
1326
 
        elif cmd == u"GETATTR":
1327
 
            attr_name, fpr = args.split(None, 1)
1328
 
            for client in self.clients:
1329
 
                if client.fingerprint == fpr:
1330
 
                    attr_value = getattr(client, attr_name, None)
1331
 
                    logger.debug("IPC reply: %r", attr_value)
1332
 
                    pickle.dump(attr_value, reply)
1333
 
                    break
1334
 
            else:
1335
 
                logger.error(u"Client %s on address %s requesting "
1336
 
                             u"attribute %s not found", fpr, address,
1337
 
                             attr_name)
1338
 
                pickle.dump(None, reply)
1339
 
        else:
1340
 
            logger.error(u"Unknown IPC command: %r", cmdline)
1341
 
        
1342
 
        # Keep calling this function
1343
 
        return True
1344
790
 
1345
791
 
1346
792
def string_to_delta(interval):
1347
793
    """Parse a string and return a datetime.timedelta
1348
794
    
1349
 
    >>> string_to_delta(u'7d')
 
795
    >>> string_to_delta('7d')
1350
796
    datetime.timedelta(7)
1351
 
    >>> string_to_delta(u'60s')
 
797
    >>> string_to_delta('60s')
1352
798
    datetime.timedelta(0, 60)
1353
 
    >>> string_to_delta(u'60m')
 
799
    >>> string_to_delta('60m')
1354
800
    datetime.timedelta(0, 3600)
1355
 
    >>> string_to_delta(u'24h')
 
801
    >>> string_to_delta('24h')
1356
802
    datetime.timedelta(1)
1357
803
    >>> string_to_delta(u'1w')
1358
804
    datetime.timedelta(7)
1359
 
    >>> string_to_delta(u'5m 30s')
 
805
    >>> string_to_delta('5m 30s')
1360
806
    datetime.timedelta(0, 330)
1361
807
    """
1362
808
    timevalue = datetime.timedelta(0)
1375
821
            elif suffix == u"w":
1376
822
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1377
823
            else:
1378
 
                raise ValueError(u"Unknown suffix %r" % suffix)
1379
 
        except (ValueError, IndexError), e:
1380
 
            raise ValueError(e.message)
 
824
                raise ValueError
 
825
        except (ValueError, IndexError):
 
826
            raise ValueError
1381
827
        timevalue += delta
1382
828
    return timevalue
1383
829
 
1384
830
 
 
831
def server_state_changed(state):
 
832
    """Derived from the Avahi example code"""
 
833
    if state == avahi.SERVER_COLLISION:
 
834
        logger.error(u"Zeroconf server name collision")
 
835
        service.remove()
 
836
    elif state == avahi.SERVER_RUNNING:
 
837
        service.add()
 
838
 
 
839
 
 
840
def entry_group_state_changed(state, error):
 
841
    """Derived from the Avahi example code"""
 
842
    logger.debug(u"Avahi state change: %i", state)
 
843
    
 
844
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
845
        logger.debug(u"Zeroconf service established.")
 
846
    elif state == avahi.ENTRY_GROUP_COLLISION:
 
847
        logger.warning(u"Zeroconf service name collision.")
 
848
        service.rename()
 
849
    elif state == avahi.ENTRY_GROUP_FAILURE:
 
850
        logger.critical(u"Avahi: Error in group state changed %s",
 
851
                        unicode(error))
 
852
        raise AvahiGroupError(u"State changed: %s" % unicode(error))
 
853
 
1385
854
def if_nametoindex(interface):
1386
 
    """Call the C function if_nametoindex(), or equivalent
1387
 
    
1388
 
    Note: This function cannot accept a unicode string."""
 
855
    """Call the C function if_nametoindex(), or equivalent"""
1389
856
    global if_nametoindex
1390
857
    try:
1391
858
        if_nametoindex = (ctypes.cdll.LoadLibrary
1392
 
                          (ctypes.util.find_library(u"c"))
 
859
                          (ctypes.util.find_library("c"))
1393
860
                          .if_nametoindex)
1394
861
    except (OSError, AttributeError):
1395
 
        logger.warning(u"Doing if_nametoindex the hard way")
 
862
        if "struct" not in sys.modules:
 
863
            import struct
 
864
        if "fcntl" not in sys.modules:
 
865
            import fcntl
1396
866
        def if_nametoindex(interface):
1397
867
            "Get an interface index the hard way, i.e. using fcntl()"
1398
868
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1399
 
            with contextlib.closing(socket.socket()) as s:
 
869
            with closing(socket.socket()) as s:
1400
870
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1401
 
                                    struct.pack(str(u"16s16x"),
1402
 
                                                interface))
1403
 
            interface_index = struct.unpack(str(u"I"),
1404
 
                                            ifreq[16:20])[0]
 
871
                                    struct.pack("16s16x", interface))
 
872
            interface_index = struct.unpack("I", ifreq[16:20])[0]
1405
873
            return interface_index
1406
874
    return if_nametoindex(interface)
1407
875
 
1408
876
 
1409
877
def daemon(nochdir = False, noclose = False):
1410
878
    """See daemon(3).  Standard BSD Unix function.
1411
 
    
1412
879
    This should really exist as os.daemon, but it doesn't (yet)."""
1413
880
    if os.fork():
1414
881
        sys.exit()
1415
882
    os.setsid()
1416
883
    if not nochdir:
1417
 
        os.chdir(u"/")
 
884
        os.chdir("/")
1418
885
    if os.fork():
1419
886
        sys.exit()
1420
887
    if not noclose:
1422
889
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1423
890
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1424
891
            raise OSError(errno.ENODEV,
1425
 
                          u"%s not a character device"
1426
 
                          % os.path.devnull)
 
892
                          "/dev/null not a character device")
1427
893
        os.dup2(null, sys.stdin.fileno())
1428
894
        os.dup2(null, sys.stdout.fileno())
1429
895
        os.dup2(null, sys.stderr.fileno())
1432
898
 
1433
899
 
1434
900
def main():
1435
 
    
1436
 
    ##################################################################
1437
 
    # Parsing of options, both command line and config file
1438
 
    
1439
901
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1440
 
    parser.add_option("-i", u"--interface", type=u"string",
1441
 
                      metavar="IF", help=u"Bind to interface IF")
1442
 
    parser.add_option("-a", u"--address", type=u"string",
1443
 
                      help=u"Address to listen for requests on")
1444
 
    parser.add_option("-p", u"--port", type=u"int",
1445
 
                      help=u"Port number to receive requests on")
1446
 
    parser.add_option("--check", action=u"store_true",
1447
 
                      help=u"Run self-test")
1448
 
    parser.add_option("--debug", action=u"store_true",
1449
 
                      help=u"Debug mode; run in foreground and log to"
1450
 
                      u" terminal")
1451
 
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1452
 
                      u" priority string (see GnuTLS documentation)")
1453
 
    parser.add_option("--servicename", type=u"string",
1454
 
                      metavar=u"NAME", help=u"Zeroconf service name")
1455
 
    parser.add_option("--configdir", type=u"string",
1456
 
                      default=u"/etc/mandos", metavar=u"DIR",
1457
 
                      help=u"Directory to search for configuration"
1458
 
                      u" files")
1459
 
    parser.add_option("--no-dbus", action=u"store_false",
1460
 
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
1461
 
                      u" system bus interface")
1462
 
    parser.add_option("--no-ipv6", action=u"store_false",
1463
 
                      dest=u"use_ipv6", help=u"Do not use IPv6")
 
902
    parser.add_option("-i", "--interface", type="string",
 
903
                      metavar="IF", help="Bind to interface IF")
 
904
    parser.add_option("-a", "--address", type="string",
 
905
                      help="Address to listen for requests on")
 
906
    parser.add_option("-p", "--port", type="int",
 
907
                      help="Port number to receive requests on")
 
908
    parser.add_option("--check", action="store_true",
 
909
                      help="Run self-test")
 
910
    parser.add_option("--debug", action="store_true",
 
911
                      help="Debug mode; run in foreground and log to"
 
912
                      " terminal")
 
913
    parser.add_option("--priority", type="string", help="GnuTLS"
 
914
                      " priority string (see GnuTLS documentation)")
 
915
    parser.add_option("--servicename", type="string", metavar="NAME",
 
916
                      help="Zeroconf service name")
 
917
    parser.add_option("--configdir", type="string",
 
918
                      default="/etc/mandos", metavar="DIR",
 
919
                      help="Directory to search for configuration"
 
920
                      " files")
 
921
    parser.add_option("--no-dbus", action="store_false",
 
922
                      dest="use_dbus",
 
923
                      help="Do not provide D-Bus system bus"
 
924
                      " interface")
1464
925
    options = parser.parse_args()[0]
1465
926
    
1466
927
    if options.check:
1469
930
        sys.exit()
1470
931
    
1471
932
    # Default values for config file for server-global settings
1472
 
    server_defaults = { u"interface": u"",
1473
 
                        u"address": u"",
1474
 
                        u"port": u"",
1475
 
                        u"debug": u"False",
1476
 
                        u"priority":
1477
 
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1478
 
                        u"servicename": u"Mandos",
1479
 
                        u"use_dbus": u"True",
1480
 
                        u"use_ipv6": u"True",
 
933
    server_defaults = { "interface": "",
 
934
                        "address": "",
 
935
                        "port": "",
 
936
                        "debug": "False",
 
937
                        "priority":
 
938
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
939
                        "servicename": "Mandos",
 
940
                        "use_dbus": "True",
1481
941
                        }
1482
942
    
1483
943
    # Parse config file for server-global settings
1484
 
    server_config = configparser.SafeConfigParser(server_defaults)
 
944
    server_config = ConfigParser.SafeConfigParser(server_defaults)
1485
945
    del server_defaults
1486
 
    server_config.read(os.path.join(options.configdir,
1487
 
                                    u"mandos.conf"))
 
946
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
1488
947
    # Convert the SafeConfigParser object to a dict
1489
948
    server_settings = server_config.defaults()
1490
949
    # Use the appropriate methods on the non-string config options
1491
 
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
1492
 
        server_settings[option] = server_config.getboolean(u"DEFAULT",
1493
 
                                                           option)
 
950
    server_settings["debug"] = server_config.getboolean("DEFAULT",
 
951
                                                        "debug")
 
952
    server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
 
953
                                                           "use_dbus")
1494
954
    if server_settings["port"]:
1495
 
        server_settings["port"] = server_config.getint(u"DEFAULT",
1496
 
                                                       u"port")
 
955
        server_settings["port"] = server_config.getint("DEFAULT",
 
956
                                                       "port")
1497
957
    del server_config
1498
958
    
1499
959
    # Override the settings from the config file with command line
1500
960
    # options, if set.
1501
 
    for option in (u"interface", u"address", u"port", u"debug",
1502
 
                   u"priority", u"servicename", u"configdir",
1503
 
                   u"use_dbus", u"use_ipv6"):
 
961
    for option in ("interface", "address", "port", "debug",
 
962
                   "priority", "servicename", "configdir",
 
963
                   "use_dbus"):
1504
964
        value = getattr(options, option)
1505
965
        if value is not None:
1506
966
            server_settings[option] = value
1507
967
    del options
1508
 
    # Force all strings to be unicode
1509
 
    for option in server_settings.keys():
1510
 
        if type(server_settings[option]) is str:
1511
 
            server_settings[option] = unicode(server_settings[option])
1512
968
    # Now we have our good server settings in "server_settings"
1513
969
    
1514
 
    ##################################################################
1515
 
    
1516
970
    # For convenience
1517
 
    debug = server_settings[u"debug"]
1518
 
    use_dbus = server_settings[u"use_dbus"]
1519
 
    use_ipv6 = server_settings[u"use_ipv6"]
 
971
    debug = server_settings["debug"]
 
972
    use_dbus = server_settings["use_dbus"]
 
973
 
 
974
    def sigsegvhandler(signum, frame):
 
975
        raise RuntimeError('Segmentation fault')
1520
976
    
1521
977
    if not debug:
1522
978
        syslogger.setLevel(logging.WARNING)
1523
979
        console.setLevel(logging.WARNING)
 
980
    else:
 
981
        signal.signal(signal.SIGSEGV, sigsegvhandler)
1524
982
    
1525
 
    if server_settings[u"servicename"] != u"Mandos":
 
983
    if server_settings["servicename"] != "Mandos":
1526
984
        syslogger.setFormatter(logging.Formatter
1527
 
                               (u'Mandos (%s) [%%(process)d]:'
1528
 
                                u' %%(levelname)s: %%(message)s'
1529
 
                                % server_settings[u"servicename"]))
 
985
                               ('Mandos (%s): %%(levelname)s:'
 
986
                                ' %%(message)s'
 
987
                                % server_settings["servicename"]))
1530
988
    
1531
989
    # Parse config file with clients
1532
 
    client_defaults = { u"timeout": u"1h",
1533
 
                        u"interval": u"5m",
1534
 
                        u"checker": u"fping -q -- %%(host)s",
1535
 
                        u"host": u"",
 
990
    client_defaults = { "timeout": "1h",
 
991
                        "interval": "5m",
 
992
                        "checker": "fping -q -- %%(host)s",
 
993
                        "host": "",
1536
994
                        }
1537
 
    client_config = configparser.SafeConfigParser(client_defaults)
1538
 
    client_config.read(os.path.join(server_settings[u"configdir"],
1539
 
                                    u"clients.conf"))
1540
 
    
1541
 
    global mandos_dbus_service
1542
 
    mandos_dbus_service = None
1543
 
    
1544
 
    tcp_server = MandosServer((server_settings[u"address"],
1545
 
                               server_settings[u"port"]),
1546
 
                              ClientHandler,
1547
 
                              interface=server_settings[u"interface"],
1548
 
                              use_ipv6=use_ipv6,
1549
 
                              gnutls_priority=
1550
 
                              server_settings[u"priority"],
1551
 
                              use_dbus=use_dbus)
1552
 
    pidfilename = u"/var/run/mandos.pid"
1553
 
    try:
1554
 
        pidfile = open(pidfilename, u"w")
1555
 
    except IOError:
1556
 
        logger.error(u"Could not open file %r", pidfilename)
1557
 
    
1558
 
    try:
1559
 
        uid = pwd.getpwnam(u"_mandos").pw_uid
1560
 
        gid = pwd.getpwnam(u"_mandos").pw_gid
 
995
    client_config = ConfigParser.SafeConfigParser(client_defaults)
 
996
    client_config.read(os.path.join(server_settings["configdir"],
 
997
                                    "clients.conf"))
 
998
    
 
999
    clients = Set()
 
1000
    tcp_server = IPv6_TCPServer((server_settings["address"],
 
1001
                                 server_settings["port"]),
 
1002
                                TCP_handler,
 
1003
                                settings=server_settings,
 
1004
                                clients=clients)
 
1005
    pidfilename = "/var/run/mandos.pid"
 
1006
    try:
 
1007
        pidfile = open(pidfilename, "w")
 
1008
    except IOError, error:
 
1009
        logger.error("Could not open file %r", pidfilename)
 
1010
    
 
1011
    try:
 
1012
        uid = pwd.getpwnam("_mandos").pw_uid
 
1013
        gid = pwd.getpwnam("_mandos").pw_gid
1561
1014
    except KeyError:
1562
1015
        try:
1563
 
            uid = pwd.getpwnam(u"mandos").pw_uid
1564
 
            gid = pwd.getpwnam(u"mandos").pw_gid
 
1016
            uid = pwd.getpwnam("mandos").pw_uid
 
1017
            gid = pwd.getpwnam("mandos").pw_gid
1565
1018
        except KeyError:
1566
1019
            try:
1567
 
                uid = pwd.getpwnam(u"nobody").pw_uid
1568
 
                gid = pwd.getpwnam(u"nobody").pw_gid
 
1020
                uid = pwd.getpwnam("nobody").pw_uid
 
1021
                gid = pwd.getpwnam("nogroup").pw_gid
1569
1022
            except KeyError:
1570
1023
                uid = 65534
1571
1024
                gid = 65534
1584
1037
        
1585
1038
        @gnutls.library.types.gnutls_log_func
1586
1039
        def debug_gnutls(level, string):
1587
 
            logger.debug(u"GnuTLS: %s", string[:-1])
 
1040
            logger.debug("GnuTLS: %s", string[:-1])
1588
1041
        
1589
1042
        (gnutls.library.functions
1590
1043
         .gnutls_global_set_log_function(debug_gnutls))
1591
1044
    
 
1045
    global service
 
1046
    service = AvahiService(name = server_settings["servicename"],
 
1047
                           servicetype = "_mandos._tcp", )
 
1048
    if server_settings["interface"]:
 
1049
        service.interface = (if_nametoindex
 
1050
                             (server_settings["interface"]))
 
1051
    
1592
1052
    global main_loop
 
1053
    global bus
 
1054
    global server
1593
1055
    # From the Avahi example code
1594
1056
    DBusGMainLoop(set_as_default=True )
1595
1057
    main_loop = gobject.MainLoop()
1596
1058
    bus = dbus.SystemBus()
 
1059
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
 
1060
                                           avahi.DBUS_PATH_SERVER),
 
1061
                            avahi.DBUS_INTERFACE_SERVER)
1597
1062
    # End of Avahi example code
1598
1063
    if use_dbus:
1599
 
        try:
1600
 
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1601
 
                                            bus, do_not_queue=True)
1602
 
        except dbus.exceptions.NameExistsException, e:
1603
 
            logger.error(unicode(e) + u", disabling D-Bus")
1604
 
            use_dbus = False
1605
 
            server_settings[u"use_dbus"] = False
1606
 
            tcp_server.use_dbus = False
1607
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1608
 
    service = AvahiService(name = server_settings[u"servicename"],
1609
 
                           servicetype = u"_mandos._tcp",
1610
 
                           protocol = protocol, bus = bus)
1611
 
    if server_settings["interface"]:
1612
 
        service.interface = (if_nametoindex
1613
 
                             (str(server_settings[u"interface"])))
 
1064
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1614
1065
    
1615
 
    client_class = Client
1616
 
    if use_dbus:
1617
 
        client_class = functools.partial(ClientDBus, bus = bus)
1618
 
    tcp_server.clients.update(set(
1619
 
            client_class(name = section,
1620
 
                         config= dict(client_config.items(section)))
1621
 
            for section in client_config.sections()))
1622
 
    if not tcp_server.clients:
 
1066
    clients.update(Set(Client(name = section,
 
1067
                              config
 
1068
                              = dict(client_config.items(section)),
 
1069
                              use_dbus = use_dbus)
 
1070
                       for section in client_config.sections()))
 
1071
    if not clients:
1623
1072
        logger.warning(u"No clients defined")
1624
1073
    
1625
1074
    if debug:
1635
1084
        daemon()
1636
1085
    
1637
1086
    try:
1638
 
        with pidfile:
1639
 
            pid = os.getpid()
1640
 
            pidfile.write(str(pid) + "\n")
 
1087
        pid = os.getpid()
 
1088
        pidfile.write(str(pid) + "\n")
 
1089
        pidfile.close()
1641
1090
        del pidfile
1642
1091
    except IOError:
1643
1092
        logger.error(u"Could not write to file %r with PID %d",
1647
1096
        pass
1648
1097
    del pidfilename
1649
1098
    
 
1099
    def cleanup():
 
1100
        "Cleanup function; run on exit"
 
1101
        global group
 
1102
        # From the Avahi example code
 
1103
        if not group is None:
 
1104
            group.Free()
 
1105
            group = None
 
1106
        # End of Avahi example code
 
1107
        
 
1108
        while clients:
 
1109
            client = clients.pop()
 
1110
            client.disable_hook = None
 
1111
            client.disable()
 
1112
    
 
1113
    atexit.register(cleanup)
 
1114
    
1650
1115
    if not debug:
1651
1116
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1652
1117
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1653
1118
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1654
1119
    
1655
1120
    if use_dbus:
1656
 
        class MandosDBusService(dbus.service.Object):
 
1121
        class MandosServer(dbus.service.Object):
1657
1122
            """A D-Bus proxy object"""
1658
1123
            def __init__(self):
1659
 
                dbus.service.Object.__init__(self, bus, u"/")
 
1124
                dbus.service.Object.__init__(self, bus, "/")
1660
1125
            _interface = u"se.bsnet.fukt.Mandos"
1661
1126
            
1662
 
            @dbus.service.signal(_interface, signature=u"o")
1663
 
            def ClientAdded(self, objpath):
1664
 
                "D-Bus signal"
1665
 
                pass
1666
 
            
1667
 
            @dbus.service.signal(_interface, signature=u"ss")
1668
 
            def ClientNotFound(self, fingerprint, address):
1669
 
                "D-Bus signal"
1670
 
                pass
1671
 
            
1672
 
            @dbus.service.signal(_interface, signature=u"os")
 
1127
            @dbus.service.signal(_interface, signature="oa{sv}")
 
1128
            def ClientAdded(self, objpath, properties):
 
1129
                "D-Bus signal"
 
1130
                pass
 
1131
            
 
1132
            @dbus.service.signal(_interface, signature="os")
1673
1133
            def ClientRemoved(self, objpath, name):
1674
1134
                "D-Bus signal"
1675
1135
                pass
1676
1136
            
1677
 
            @dbus.service.method(_interface, out_signature=u"ao")
 
1137
            @dbus.service.method(_interface, out_signature="ao")
1678
1138
            def GetAllClients(self):
1679
1139
                "D-Bus method"
1680
 
                return dbus.Array(c.dbus_object_path
1681
 
                                  for c in tcp_server.clients)
 
1140
                return dbus.Array(c.dbus_object_path for c in clients)
1682
1141
            
1683
 
            @dbus.service.method(_interface,
1684
 
                                 out_signature=u"a{oa{sv}}")
 
1142
            @dbus.service.method(_interface, out_signature="a{oa{sv}}")
1685
1143
            def GetAllClientsWithProperties(self):
1686
1144
                "D-Bus method"
1687
1145
                return dbus.Dictionary(
1688
 
                    ((c.dbus_object_path, c.GetAll(u""))
1689
 
                     for c in tcp_server.clients),
1690
 
                    signature=u"oa{sv}")
 
1146
                    ((c.dbus_object_path, c.GetAllProperties())
 
1147
                     for c in clients),
 
1148
                    signature="oa{sv}")
1691
1149
            
1692
 
            @dbus.service.method(_interface, in_signature=u"o")
 
1150
            @dbus.service.method(_interface, in_signature="o")
1693
1151
            def RemoveClient(self, object_path):
1694
1152
                "D-Bus method"
1695
 
                for c in tcp_server.clients:
 
1153
                for c in clients:
1696
1154
                    if c.dbus_object_path == object_path:
1697
 
                        tcp_server.clients.remove(c)
1698
 
                        c.remove_from_connection()
 
1155
                        clients.remove(c)
1699
1156
                        # Don't signal anything except ClientRemoved
1700
 
                        c.disable(quiet=True)
 
1157
                        c.use_dbus = False
 
1158
                        c.disable()
1701
1159
                        # Emit D-Bus signal
1702
1160
                        self.ClientRemoved(object_path, c.name)
1703
1161
                        return
1704
 
                raise KeyError(object_path)
 
1162
                raise KeyError
1705
1163
            
1706
1164
            del _interface
1707
1165
        
1708
 
        mandos_dbus_service = MandosDBusService()
1709
 
    
1710
 
    def cleanup():
1711
 
        "Cleanup function; run on exit"
1712
 
        service.cleanup()
1713
 
        
1714
 
        while tcp_server.clients:
1715
 
            client = tcp_server.clients.pop()
1716
 
            if use_dbus:
1717
 
                client.remove_from_connection()
1718
 
            client.disable_hook = None
1719
 
            # Don't signal anything except ClientRemoved
1720
 
            client.disable(quiet=True)
1721
 
            if use_dbus:
1722
 
                # Emit D-Bus signal
1723
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1724
 
                                                  client.name)
1725
 
    
1726
 
    atexit.register(cleanup)
1727
 
    
1728
 
    for client in tcp_server.clients:
 
1166
        mandos_server = MandosServer()
 
1167
    
 
1168
    for client in clients:
1729
1169
        if use_dbus:
1730
1170
            # Emit D-Bus signal
1731
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
1171
            mandos_server.ClientAdded(client.dbus_object_path,
 
1172
                                      client.GetAllProperties())
1732
1173
        client.enable()
1733
1174
    
1734
1175
    tcp_server.enable()
1736
1177
    
1737
1178
    # Find out what port we got
1738
1179
    service.port = tcp_server.socket.getsockname()[1]
1739
 
    if use_ipv6:
1740
 
        logger.info(u"Now listening on address %r, port %d,"
1741
 
                    " flowinfo %d, scope_id %d"
1742
 
                    % tcp_server.socket.getsockname())
1743
 
    else:                       # IPv4
1744
 
        logger.info(u"Now listening on address %r, port %d"
1745
 
                    % tcp_server.socket.getsockname())
 
1180
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
 
1181
                u" scope_id %d" % tcp_server.socket.getsockname())
1746
1182
    
1747
1183
    #service.interface = tcp_server.socket.getsockname()[3]
1748
1184
    
1749
1185
    try:
1750
1186
        # From the Avahi example code
 
1187
        server.connect_to_signal("StateChanged", server_state_changed)
1751
1188
        try:
1752
 
            service.activate()
 
1189
            server_state_changed(server.GetState())
1753
1190
        except dbus.exceptions.DBusException, error:
1754
1191
            logger.critical(u"DBusException: %s", error)
1755
 
            cleanup()
1756
1192
            sys.exit(1)
1757
1193
        # End of Avahi example code
1758
1194
        
1765
1201
        main_loop.run()
1766
1202
    except AvahiError, error:
1767
1203
        logger.critical(u"AvahiError: %s", error)
1768
 
        cleanup()
1769
1204
        sys.exit(1)
1770
1205
    except KeyboardInterrupt:
1771
1206
        if debug:
1772
 
            print >> sys.stderr
1773
 
        logger.debug(u"Server received KeyboardInterrupt")
1774
 
    logger.debug(u"Server exiting")
1775
 
    # Must run before the D-Bus bus name gets deregistered
1776
 
    cleanup()
 
1207
            print
1777
1208
 
1778
1209
if __name__ == '__main__':
1779
1210
    main()