/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2009-01-31 10:33:17 UTC
  • mfrom: (24.1.129 mandos)
  • Revision ID: teddy@fukt.bsnet.se-20090131103317-wzqvyr532sjcjt7u
Merge from Björn:

* mandos-ctl: New option "--remove-client".  Only default to listing
              clients if no clients were given on the command line.
* plugins.d/mandos-client.c: Lower kernel log level while bringing up
                             network interface.  New option "--delay"
                             to control the maximum delay to wait for
                             running interface.
* plugins.d/mandos-client.xml (SYNOPSIS, OPTIONS): New option
                                                   "--delay".

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008 Teddy Hogeborn
15
 
# Copyright © 2008 Björn Påhlsson
 
14
# Copyright © 2008,2009 Teddy Hogeborn
 
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
35
35
 
36
36
import SocketServer
37
37
import socket
38
 
from optparse import OptionParser
 
38
import optparse
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
66
66
import ctypes
67
67
import ctypes.util
68
68
 
69
 
version = "1.0.2"
 
69
version = "1.0.5"
70
70
 
71
71
logger = logging.Logger('mandos')
72
72
syslogger = (logging.handlers.SysLogHandler
82
82
logger.addHandler(console)
83
83
 
84
84
class AvahiError(Exception):
85
 
    def __init__(self, value):
 
85
    def __init__(self, value, *args, **kwargs):
86
86
        self.value = value
87
 
        super(AvahiError, self).__init__()
88
 
    def __str__(self):
89
 
        return repr(self.value)
 
87
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
88
    def __unicode__(self):
 
89
        return unicode(repr(self.value))
90
90
 
91
91
class AvahiServiceError(AvahiError):
92
92
    pass
129
129
            logger.critical(u"No suitable Zeroconf service name found"
130
130
                            u" after %i retries, exiting.",
131
131
                            self.rename_count)
132
 
            raise AvahiServiceError("Too many renames")
 
132
            raise AvahiServiceError(u"Too many renames")
133
133
        self.name = server.GetAlternativeServiceName(self.name)
134
134
        logger.info(u"Changing Zeroconf service name to %r ...",
135
135
                    str(self.name))
178
178
class Client(dbus.service.Object):
179
179
    """A representation of a client host served by this server.
180
180
    Attributes:
181
 
    name:       string; from the config file, used in log messages
 
181
    name:       string; from the config file, used in log messages and
 
182
                        D-Bus identifiers
182
183
    fingerprint: string (40 or 32 hexadecimal digits); used to
183
184
                 uniquely identify the client
184
185
    secret:     bytestring; sent verbatim (over TLS) to client
201
202
                     client lives.  %() expansions are done at
202
203
                     runtime with vars(self) as dict, so that for
203
204
                     instance %(name)s can be used in the command.
204
 
    dbus_object_path: dbus.ObjectPath
205
 
    Private attibutes:
206
 
    _timeout: Real variable for 'timeout'
207
 
    _interval: Real variable for 'interval'
208
 
    _timeout_milliseconds: Used when calling gobject.timeout_add()
209
 
    _interval_milliseconds: - '' -
 
205
    use_dbus: bool(); Whether to provide D-Bus interface and signals
 
206
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
210
207
    """
211
 
    def _set_timeout(self, timeout):
212
 
        "Setter function for the 'timeout' attribute"
213
 
        self._timeout = timeout
214
 
        self._timeout_milliseconds = ((self.timeout.days
215
 
                                       * 24 * 60 * 60 * 1000)
216
 
                                      + (self.timeout.seconds * 1000)
217
 
                                      + (self.timeout.microseconds
218
 
                                         // 1000))
219
 
        # Emit D-Bus signal
220
 
        self.PropertyChanged(dbus.String(u"timeout"),
221
 
                             (dbus.UInt64(self._timeout_milliseconds,
222
 
                                          variant_level=1)))
223
 
    timeout = property(lambda self: self._timeout, _set_timeout)
224
 
    del _set_timeout
225
 
    
226
 
    def _set_interval(self, interval):
227
 
        "Setter function for the 'interval' attribute"
228
 
        self._interval = interval
229
 
        self._interval_milliseconds = ((self.interval.days
230
 
                                        * 24 * 60 * 60 * 1000)
231
 
                                       + (self.interval.seconds
232
 
                                          * 1000)
233
 
                                       + (self.interval.microseconds
234
 
                                          // 1000))
235
 
        # Emit D-Bus signal
236
 
        self.PropertyChanged(dbus.String(u"interval"),
237
 
                             (dbus.UInt64(self._interval_milliseconds,
238
 
                                          variant_level=1)))
239
 
    interval = property(lambda self: self._interval, _set_interval)
240
 
    del _set_interval
241
 
    
242
 
    def __init__(self, name = None, disable_hook=None, config=None):
 
208
    def timeout_milliseconds(self):
 
209
        "Return the 'timeout' attribute in milliseconds"
 
210
        return ((self.timeout.days * 24 * 60 * 60 * 1000)
 
211
                + (self.timeout.seconds * 1000)
 
212
                + (self.timeout.microseconds // 1000))
 
213
    
 
214
    def interval_milliseconds(self):
 
215
        "Return the 'interval' attribute in milliseconds"
 
216
        return ((self.interval.days * 24 * 60 * 60 * 1000)
 
217
                + (self.interval.seconds * 1000)
 
218
                + (self.interval.microseconds // 1000))
 
219
    
 
220
    def __init__(self, name = None, disable_hook=None, config=None,
 
221
                 use_dbus=True):
243
222
        """Note: the 'checker' key in 'config' sets the
244
223
        'checker_command' attribute and *not* the 'checker'
245
224
        attribute."""
246
 
        self.dbus_object_path = (dbus.ObjectPath
247
 
                                 ("/Mandos/clients/"
248
 
                                  + name.replace(".", "_")))
249
 
        dbus.service.Object.__init__(self, bus,
250
 
                                     self.dbus_object_path)
 
225
        self.name = name
251
226
        if config is None:
252
227
            config = {}
253
 
        self.name = name
254
228
        logger.debug(u"Creating client %r", self.name)
 
229
        self.use_dbus = False   # During __init__
255
230
        # Uppercase and remove spaces from fingerprint for later
256
231
        # comparison purposes with return value from the fingerprint()
257
232
        # function
281
256
        self.disable_initiator_tag = None
282
257
        self.checker_callback_tag = None
283
258
        self.checker_command = config["checker"]
 
259
        self.last_connect = None
 
260
        # Only now, when this client is initialized, can it show up on
 
261
        # the D-Bus
 
262
        self.use_dbus = use_dbus
 
263
        if self.use_dbus:
 
264
            self.dbus_object_path = (dbus.ObjectPath
 
265
                                     ("/clients/"
 
266
                                      + self.name.replace(".", "_")))
 
267
            dbus.service.Object.__init__(self, bus,
 
268
                                         self.dbus_object_path)
284
269
    
285
270
    def enable(self):
286
271
        """Start this client's checker and timeout hooks"""
288
273
        # Schedule a new checker to be started an 'interval' from now,
289
274
        # and every interval from then on.
290
275
        self.checker_initiator_tag = (gobject.timeout_add
291
 
                                      (self._interval_milliseconds,
 
276
                                      (self.interval_milliseconds(),
292
277
                                       self.start_checker))
293
278
        # Also start a new checker *right now*.
294
279
        self.start_checker()
295
280
        # Schedule a disable() when 'timeout' has passed
296
281
        self.disable_initiator_tag = (gobject.timeout_add
297
 
                                   (self._timeout_milliseconds,
 
282
                                   (self.timeout_milliseconds(),
298
283
                                    self.disable))
299
284
        self.enabled = True
300
 
        # Emit D-Bus signal
301
 
        self.PropertyChanged(dbus.String(u"enabled"),
302
 
                             dbus.Boolean(True, variant_level=1))
303
 
        self.PropertyChanged(dbus.String(u"last_enabled"),
304
 
                             (_datetime_to_dbus(self.last_enabled,
305
 
                                                variant_level=1)))
 
285
        if self.use_dbus:
 
286
            # Emit D-Bus signals
 
287
            self.PropertyChanged(dbus.String(u"enabled"),
 
288
                                 dbus.Boolean(True, variant_level=1))
 
289
            self.PropertyChanged(dbus.String(u"last_enabled"),
 
290
                                 (_datetime_to_dbus(self.last_enabled,
 
291
                                                    variant_level=1)))
306
292
    
307
293
    def disable(self):
308
294
        """Disable this client."""
319
305
        if self.disable_hook:
320
306
            self.disable_hook(self)
321
307
        self.enabled = False
322
 
        # Emit D-Bus signal
323
 
        self.PropertyChanged(dbus.String(u"enabled"),
324
 
                             dbus.Boolean(False, variant_level=1))
 
308
        if self.use_dbus:
 
309
            # Emit D-Bus signal
 
310
            self.PropertyChanged(dbus.String(u"enabled"),
 
311
                                 dbus.Boolean(False, variant_level=1))
325
312
        # Do not run this again if called by a gobject.timeout_add
326
313
        return False
327
314
    
333
320
        """The checker has completed, so take appropriate actions."""
334
321
        self.checker_callback_tag = None
335
322
        self.checker = None
336
 
        # Emit D-Bus signal
337
 
        self.PropertyChanged(dbus.String(u"checker_running"),
338
 
                             dbus.Boolean(False, variant_level=1))
339
 
        if (os.WIFEXITED(condition)
340
 
            and (os.WEXITSTATUS(condition) == 0)):
341
 
            logger.info(u"Checker for %(name)s succeeded",
342
 
                        vars(self))
 
323
        if self.use_dbus:
343
324
            # Emit D-Bus signal
344
 
            self.CheckerCompleted(dbus.Boolean(True),
345
 
                                  dbus.UInt16(condition),
346
 
                                  dbus.String(command))
347
 
            self.bump_timeout()
348
 
        elif not os.WIFEXITED(condition):
 
325
            self.PropertyChanged(dbus.String(u"checker_running"),
 
326
                                 dbus.Boolean(False, variant_level=1))
 
327
        if os.WIFEXITED(condition):
 
328
            exitstatus = os.WEXITSTATUS(condition)
 
329
            if exitstatus == 0:
 
330
                logger.info(u"Checker for %(name)s succeeded",
 
331
                            vars(self))
 
332
                self.checked_ok()
 
333
            else:
 
334
                logger.info(u"Checker for %(name)s failed",
 
335
                            vars(self))
 
336
            if self.use_dbus:
 
337
                # Emit D-Bus signal
 
338
                self.CheckerCompleted(dbus.Int16(exitstatus),
 
339
                                      dbus.Int64(condition),
 
340
                                      dbus.String(command))
 
341
        else:
349
342
            logger.warning(u"Checker for %(name)s crashed?",
350
343
                           vars(self))
351
 
            # Emit D-Bus signal
352
 
            self.CheckerCompleted(dbus.Boolean(False),
353
 
                                  dbus.UInt16(condition),
354
 
                                  dbus.String(command))
355
 
        else:
356
 
            logger.info(u"Checker for %(name)s failed",
357
 
                        vars(self))
358
 
            # Emit D-Bus signal
359
 
            self.CheckerCompleted(dbus.Boolean(False),
360
 
                                  dbus.UInt16(condition),
361
 
                                  dbus.String(command))
 
344
            if self.use_dbus:
 
345
                # Emit D-Bus signal
 
346
                self.CheckerCompleted(dbus.Int16(-1),
 
347
                                      dbus.Int64(condition),
 
348
                                      dbus.String(command))
362
349
    
363
 
    def bump_timeout(self):
 
350
    def checked_ok(self):
364
351
        """Bump up the timeout for this client.
365
352
        This should only be called when the client has been seen,
366
353
        alive and well.
368
355
        self.last_checked_ok = datetime.datetime.utcnow()
369
356
        gobject.source_remove(self.disable_initiator_tag)
370
357
        self.disable_initiator_tag = (gobject.timeout_add
371
 
                                      (self._timeout_milliseconds,
 
358
                                      (self.timeout_milliseconds(),
372
359
                                       self.disable))
373
 
        self.PropertyChanged(dbus.String(u"last_checked_ok"),
374
 
                             (_datetime_to_dbus(self.last_checked_ok,
375
 
                                                variant_level=1)))
 
360
        if self.use_dbus:
 
361
            # Emit D-Bus signal
 
362
            self.PropertyChanged(
 
363
                dbus.String(u"last_checked_ok"),
 
364
                (_datetime_to_dbus(self.last_checked_ok,
 
365
                                   variant_level=1)))
376
366
    
377
367
    def start_checker(self):
378
368
        """Start a new checker subprocess if one is not running.
411
401
                self.checker = subprocess.Popen(command,
412
402
                                                close_fds=True,
413
403
                                                shell=True, cwd="/")
414
 
                # Emit D-Bus signal
415
 
                self.CheckerStarted(command)
416
 
                self.PropertyChanged(dbus.String("checker_running"),
417
 
                                     dbus.Boolean(True, variant_level=1))
 
404
                if self.use_dbus:
 
405
                    # Emit D-Bus signal
 
406
                    self.CheckerStarted(command)
 
407
                    self.PropertyChanged(
 
408
                        dbus.String("checker_running"),
 
409
                        dbus.Boolean(True, variant_level=1))
418
410
                self.checker_callback_tag = (gobject.child_watch_add
419
411
                                             (self.checker.pid,
420
412
                                              self.checker_callback,
442
434
            if error.errno != errno.ESRCH: # No such process
443
435
                raise
444
436
        self.checker = None
445
 
        self.PropertyChanged(dbus.String(u"checker_running"),
446
 
                             dbus.Boolean(False, variant_level=1))
 
437
        if self.use_dbus:
 
438
            self.PropertyChanged(dbus.String(u"checker_running"),
 
439
                                 dbus.Boolean(False, variant_level=1))
447
440
    
448
441
    def still_valid(self):
449
442
        """Has the timeout not yet passed for this client?"""
456
449
            return now < (self.last_checked_ok + self.timeout)
457
450
    
458
451
    ## D-Bus methods & signals
459
 
    _interface = u"org.mandos_system.Mandos.Client"
 
452
    _interface = u"se.bsnet.fukt.Mandos.Client"
460
453
    
461
 
    # BumpTimeout - method
462
 
    BumpTimeout = dbus.service.method(_interface)(bump_timeout)
463
 
    BumpTimeout.__name__ = "BumpTimeout"
 
454
    # CheckedOK - method
 
455
    CheckedOK = dbus.service.method(_interface)(checked_ok)
 
456
    CheckedOK.__name__ = "CheckedOK"
464
457
    
465
458
    # CheckerCompleted - signal
466
 
    @dbus.service.signal(_interface, signature="bqs")
467
 
    def CheckerCompleted(self, success, condition, command):
 
459
    @dbus.service.signal(_interface, signature="nxs")
 
460
    def CheckerCompleted(self, exitcode, waitstatus, command):
468
461
        "D-Bus signal"
469
462
        pass
470
463
    
500
493
                     if self.last_checked_ok is not None
501
494
                     else dbus.Boolean (False, variant_level=1)),
502
495
                dbus.String("timeout"):
503
 
                    dbus.UInt64(self._timeout_milliseconds,
 
496
                    dbus.UInt64(self.timeout_milliseconds(),
504
497
                                variant_level=1),
505
498
                dbus.String("interval"):
506
 
                    dbus.UInt64(self._interval_milliseconds,
 
499
                    dbus.UInt64(self.interval_milliseconds(),
507
500
                                variant_level=1),
508
501
                dbus.String("checker"):
509
502
                    dbus.String(self.checker_command,
511
504
                dbus.String("checker_running"):
512
505
                    dbus.Boolean(self.checker is not None,
513
506
                                 variant_level=1),
 
507
                dbus.String("object_path"):
 
508
                    dbus.ObjectPath(self.dbus_object_path,
 
509
                                    variant_level=1)
514
510
                }, signature="sv")
515
511
    
516
512
    # IsStillValid - method
529
525
    def SetChecker(self, checker):
530
526
        "D-Bus setter method"
531
527
        self.checker_command = checker
 
528
        # Emit D-Bus signal
 
529
        self.PropertyChanged(dbus.String(u"checker"),
 
530
                             dbus.String(self.checker_command,
 
531
                                         variant_level=1))
532
532
    
533
533
    # SetHost - method
534
534
    @dbus.service.method(_interface, in_signature="s")
535
535
    def SetHost(self, host):
536
536
        "D-Bus setter method"
537
537
        self.host = host
 
538
        # Emit D-Bus signal
 
539
        self.PropertyChanged(dbus.String(u"host"),
 
540
                             dbus.String(self.host, variant_level=1))
538
541
    
539
542
    # SetInterval - method
540
543
    @dbus.service.method(_interface, in_signature="t")
541
544
    def SetInterval(self, milliseconds):
542
 
        self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
 
545
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
 
546
        # Emit D-Bus signal
 
547
        self.PropertyChanged(dbus.String(u"interval"),
 
548
                             (dbus.UInt64(self.interval_milliseconds(),
 
549
                                          variant_level=1)))
543
550
    
544
551
    # SetSecret - method
545
552
    @dbus.service.method(_interface, in_signature="ay",
552
559
    @dbus.service.method(_interface, in_signature="t")
553
560
    def SetTimeout(self, milliseconds):
554
561
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
 
562
        # Emit D-Bus signal
 
563
        self.PropertyChanged(dbus.String(u"timeout"),
 
564
                             (dbus.UInt64(self.timeout_milliseconds(),
 
565
                                          variant_level=1)))
555
566
    
556
567
    # Enable - method
557
568
    Enable = dbus.service.method(_interface)(enable)
584
595
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
585
596
        # ...do the normal thing
586
597
        return session.peer_certificate
587
 
    list_size = ctypes.c_uint()
 
598
    list_size = ctypes.c_uint(1)
588
599
    cert_list = (gnutls.library.functions
589
600
                 .gnutls_certificate_get_peers
590
601
                 (session._c_object, ctypes.byref(list_size)))
 
602
    if not bool(cert_list) and list_size.value != 0:
 
603
        raise gnutls.errors.GNUTLSError("error getting peer"
 
604
                                        " certificate")
591
605
    if list_size.value == 0:
592
606
        return None
593
607
    cert = cert_list[0]
677
691
            # Do not run session.bye() here: the session is not
678
692
            # established.  Just abandon the request.
679
693
            return
 
694
        logger.debug(u"Handshake succeeded")
680
695
        try:
681
696
            fpr = fingerprint(peer_certificate(session))
682
697
        except (TypeError, gnutls.errors.GNUTLSError), error:
684
699
            session.bye()
685
700
            return
686
701
        logger.debug(u"Fingerprint: %s", fpr)
 
702
        
687
703
        for c in self.server.clients:
688
704
            if c.fingerprint == fpr:
689
705
                client = c
702
718
            session.bye()
703
719
            return
704
720
        ## This won't work here, since we're in a fork.
705
 
        # client.bump_timeout()
 
721
        # client.checked_ok()
706
722
        sent_size = 0
707
723
        while sent_size < len(client.secret):
708
724
            sent = session.send(client.secret[sent_size:])
775
791
 
776
792
def string_to_delta(interval):
777
793
    """Parse a string and return a datetime.timedelta
778
 
 
 
794
    
779
795
    >>> string_to_delta('7d')
780
796
    datetime.timedelta(7)
781
797
    >>> string_to_delta('60s')
833
849
    elif state == avahi.ENTRY_GROUP_FAILURE:
834
850
        logger.critical(u"Avahi: Error in group state changed %s",
835
851
                        unicode(error))
836
 
        raise AvahiGroupError("State changed: %s", str(error))
 
852
        raise AvahiGroupError(u"State changed: %s" % unicode(error))
837
853
 
838
854
def if_nametoindex(interface):
839
855
    """Call the C function if_nametoindex(), or equivalent"""
882
898
 
883
899
 
884
900
def main():
885
 
    parser = OptionParser(version = "%%prog %s" % version)
 
901
    parser = optparse.OptionParser(version = "%%prog %s" % version)
886
902
    parser.add_option("-i", "--interface", type="string",
887
903
                      metavar="IF", help="Bind to interface IF")
888
904
    parser.add_option("-a", "--address", type="string",
889
905
                      help="Address to listen for requests on")
890
906
    parser.add_option("-p", "--port", type="int",
891
907
                      help="Port number to receive requests on")
892
 
    parser.add_option("--check", action="store_true", default=False,
 
908
    parser.add_option("--check", action="store_true",
893
909
                      help="Run self-test")
894
910
    parser.add_option("--debug", action="store_true",
895
911
                      help="Debug mode; run in foreground and log to"
902
918
                      default="/etc/mandos", metavar="DIR",
903
919
                      help="Directory to search for configuration"
904
920
                      " files")
 
921
    parser.add_option("--no-dbus", action="store_false",
 
922
                      dest="use_dbus",
 
923
                      help="Do not provide D-Bus system bus"
 
924
                      " interface")
905
925
    options = parser.parse_args()[0]
906
926
    
907
927
    if options.check:
917
937
                        "priority":
918
938
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
919
939
                        "servicename": "Mandos",
 
940
                        "use_dbus": "True",
920
941
                        }
921
942
    
922
943
    # Parse config file for server-global settings
925
946
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
926
947
    # Convert the SafeConfigParser object to a dict
927
948
    server_settings = server_config.defaults()
928
 
    # Use getboolean on the boolean config option
929
 
    server_settings["debug"] = (server_config.getboolean
930
 
                                ("DEFAULT", "debug"))
 
949
    # Use the appropriate methods on the non-string config options
 
950
    server_settings["debug"] = server_config.getboolean("DEFAULT",
 
951
                                                        "debug")
 
952
    server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
 
953
                                                           "use_dbus")
 
954
    if server_settings["port"]:
 
955
        server_settings["port"] = server_config.getint("DEFAULT",
 
956
                                                       "port")
931
957
    del server_config
932
958
    
933
959
    # Override the settings from the config file with command line
934
960
    # options, if set.
935
961
    for option in ("interface", "address", "port", "debug",
936
 
                   "priority", "servicename", "configdir"):
 
962
                   "priority", "servicename", "configdir",
 
963
                   "use_dbus"):
937
964
        value = getattr(options, option)
938
965
        if value is not None:
939
966
            server_settings[option] = value
940
967
    del options
941
968
    # Now we have our good server settings in "server_settings"
942
969
    
 
970
    # For convenience
943
971
    debug = server_settings["debug"]
 
972
    use_dbus = server_settings["use_dbus"]
 
973
 
 
974
    def sigsegvhandler(signum, frame):
 
975
        raise RuntimeError('Segmentation fault')
944
976
    
945
977
    if not debug:
946
978
        syslogger.setLevel(logging.WARNING)
947
979
        console.setLevel(logging.WARNING)
 
980
    else:
 
981
        signal.signal(signal.SIGSEGV, sigsegvhandler)
948
982
    
949
983
    if server_settings["servicename"] != "Mandos":
950
984
        syslogger.setFormatter(logging.Formatter
955
989
    # Parse config file with clients
956
990
    client_defaults = { "timeout": "1h",
957
991
                        "interval": "5m",
958
 
                        "checker": "fping -q -- %(host)s",
 
992
                        "checker": "fping -q -- %%(host)s",
959
993
                        "host": "",
960
994
                        }
961
995
    client_config = ConfigParser.SafeConfigParser(client_defaults)
976
1010
    
977
1011
    try:
978
1012
        uid = pwd.getpwnam("_mandos").pw_uid
 
1013
        gid = pwd.getpwnam("_mandos").pw_gid
979
1014
    except KeyError:
980
1015
        try:
981
1016
            uid = pwd.getpwnam("mandos").pw_uid
 
1017
            gid = pwd.getpwnam("mandos").pw_gid
982
1018
        except KeyError:
983
1019
            try:
984
1020
                uid = pwd.getpwnam("nobody").pw_uid
 
1021
                gid = pwd.getpwnam("nogroup").pw_gid
985
1022
            except KeyError:
986
1023
                uid = 65534
987
 
    try:
988
 
        gid = pwd.getpwnam("_mandos").pw_gid
989
 
    except KeyError:
990
 
        try:
991
 
            gid = pwd.getpwnam("mandos").pw_gid
992
 
        except KeyError:
993
 
            try:
994
 
                gid = pwd.getpwnam("nogroup").pw_gid
995
 
            except KeyError:
996
1024
                gid = 65534
997
1025
    try:
 
1026
        os.setgid(gid)
998
1027
        os.setuid(uid)
999
 
        os.setgid(gid)
1000
1028
    except OSError, error:
1001
1029
        if error[0] != errno.EPERM:
1002
1030
            raise error
1003
1031
    
 
1032
    # Enable all possible GnuTLS debugging
 
1033
    if debug:
 
1034
        # "Use a log level over 10 to enable all debugging options."
 
1035
        # - GnuTLS manual
 
1036
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
1037
        
 
1038
        @gnutls.library.types.gnutls_log_func
 
1039
        def debug_gnutls(level, string):
 
1040
            logger.debug("GnuTLS: %s", string[:-1])
 
1041
        
 
1042
        (gnutls.library.functions
 
1043
         .gnutls_global_set_log_function(debug_gnutls))
 
1044
    
1004
1045
    global service
1005
1046
    service = AvahiService(name = server_settings["servicename"],
1006
1047
                           servicetype = "_mandos._tcp", )
1019
1060
                                           avahi.DBUS_PATH_SERVER),
1020
1061
                            avahi.DBUS_INTERFACE_SERVER)
1021
1062
    # End of Avahi example code
1022
 
    bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
 
1063
    if use_dbus:
 
1064
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1023
1065
    
1024
1066
    clients.update(Set(Client(name = section,
1025
1067
                              config
1026
 
                              = dict(client_config.items(section)))
 
1068
                              = dict(client_config.items(section)),
 
1069
                              use_dbus = use_dbus)
1027
1070
                       for section in client_config.sections()))
1028
1071
    if not clients:
1029
 
        logger.critical(u"No clients defined")
1030
 
        sys.exit(1)
 
1072
        logger.warning(u"No clients defined")
1031
1073
    
1032
1074
    if debug:
1033
1075
        # Redirect stdin so all checkers get /dev/null
1075
1117
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1076
1118
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1077
1119
    
1078
 
    class MandosServer(dbus.service.Object):
1079
 
        """A D-Bus proxy object"""
1080
 
        def __init__(self):
1081
 
            dbus.service.Object.__init__(self, bus,
1082
 
                                         "/Mandos")
1083
 
        _interface = u"org.mandos_system.Mandos"
1084
 
        
1085
 
        @dbus.service.signal(_interface, signature="oa{sv}")
1086
 
        def ClientAdded(self, objpath, properties):
1087
 
            "D-Bus signal"
1088
 
            pass
1089
 
        
1090
 
        @dbus.service.signal(_interface, signature="o")
1091
 
        def ClientRemoved(self, objpath):
1092
 
            "D-Bus signal"
1093
 
            pass
1094
 
        
1095
 
        @dbus.service.method(_interface, out_signature="ao")
1096
 
        def GetAllClients(self):
1097
 
            return dbus.Array(c.dbus_object_path for c in clients)
1098
 
        
1099
 
        @dbus.service.method(_interface, out_signature="a{oa{sv}}")
1100
 
        def GetAllClientsWithProperties(self):
1101
 
            return dbus.Dictionary(
1102
 
                ((c.dbus_object_path, c.GetAllProperties())
1103
 
                 for c in clients),
1104
 
                signature="oa{sv}")
1105
 
        
1106
 
        @dbus.service.method(_interface, in_signature="o")
1107
 
        def RemoveClient(self, object_path):
1108
 
            for c in clients:
1109
 
                if c.dbus_object_path == object_path:
1110
 
                    c.disable()
1111
 
                    clients.remove(c)
1112
 
                    return
1113
 
            raise KeyError
1114
 
        
1115
 
        del _interface
1116
 
    
1117
 
    mandos_server = MandosServer()
 
1120
    if use_dbus:
 
1121
        class MandosServer(dbus.service.Object):
 
1122
            """A D-Bus proxy object"""
 
1123
            def __init__(self):
 
1124
                dbus.service.Object.__init__(self, bus, "/")
 
1125
            _interface = u"se.bsnet.fukt.Mandos"
 
1126
            
 
1127
            @dbus.service.signal(_interface, signature="oa{sv}")
 
1128
            def ClientAdded(self, objpath, properties):
 
1129
                "D-Bus signal"
 
1130
                pass
 
1131
            
 
1132
            @dbus.service.signal(_interface, signature="os")
 
1133
            def ClientRemoved(self, objpath, name):
 
1134
                "D-Bus signal"
 
1135
                pass
 
1136
            
 
1137
            @dbus.service.method(_interface, out_signature="ao")
 
1138
            def GetAllClients(self):
 
1139
                "D-Bus method"
 
1140
                return dbus.Array(c.dbus_object_path for c in clients)
 
1141
            
 
1142
            @dbus.service.method(_interface, out_signature="a{oa{sv}}")
 
1143
            def GetAllClientsWithProperties(self):
 
1144
                "D-Bus method"
 
1145
                return dbus.Dictionary(
 
1146
                    ((c.dbus_object_path, c.GetAllProperties())
 
1147
                     for c in clients),
 
1148
                    signature="oa{sv}")
 
1149
            
 
1150
            @dbus.service.method(_interface, in_signature="o")
 
1151
            def RemoveClient(self, object_path):
 
1152
                "D-Bus method"
 
1153
                for c in clients:
 
1154
                    if c.dbus_object_path == object_path:
 
1155
                        clients.remove(c)
 
1156
                        # Don't signal anything except ClientRemoved
 
1157
                        c.use_dbus = False
 
1158
                        c.disable()
 
1159
                        # Emit D-Bus signal
 
1160
                        self.ClientRemoved(object_path, c.name)
 
1161
                        return
 
1162
                raise KeyError
 
1163
            
 
1164
            del _interface
 
1165
        
 
1166
        mandos_server = MandosServer()
1118
1167
    
1119
1168
    for client in clients:
1120
 
        # Emit D-Bus signal
1121
 
        mandos_server.ClientAdded(client.dbus_object_path,
1122
 
                                  client.GetAllProperties())
 
1169
        if use_dbus:
 
1170
            # Emit D-Bus signal
 
1171
            mandos_server.ClientAdded(client.dbus_object_path,
 
1172
                                      client.GetAllProperties())
1123
1173
        client.enable()
1124
1174
    
1125
1175
    tcp_server.enable()
1150
1200
        logger.debug(u"Starting main loop")
1151
1201
        main_loop.run()
1152
1202
    except AvahiError, error:
1153
 
        logger.critical(u"AvahiError: %s" + unicode(error))
 
1203
        logger.critical(u"AvahiError: %s", error)
1154
1204
        sys.exit(1)
1155
1205
    except KeyboardInterrupt:
1156
1206
        if debug: