/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2009-02-07 04:50:39 UTC
  • Revision ID: teddy@fukt.bsnet.se-20090207045039-xkr6b80vtqwqrq8l
* Makefile (install-client-nokey): Move "initramfs-tools-script" from
                                   "/scripts/local-top/mandos" to
                                   "/scripts/init-premount/mandos".
  (uninstall-client): - '' -
* debian/mandos-client.dirs: - '' -
* initramfs-tools-script (PREREQ): Added "udev".

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
33
33
 
34
34
from __future__ import division, with_statement, absolute_import
35
35
 
36
 
import SocketServer as socketserver
 
36
import SocketServer
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
 
import ConfigParser as configparser
 
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
 
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
56
57
import logging.handlers
57
58
import pwd
58
59
from contextlib import closing
59
 
import struct
60
 
import fcntl
61
60
 
62
61
import dbus
63
62
import dbus.service
67
66
import ctypes
68
67
import ctypes.util
69
68
 
70
 
try:
71
 
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
72
 
except AttributeError:
73
 
    try:
74
 
        from IN import SO_BINDTODEVICE
75
 
    except ImportError:
76
 
        # From /usr/include/asm/socket.h
77
 
        SO_BINDTODEVICE = 25
78
 
 
79
 
 
80
 
version = "1.0.8"
81
 
 
82
 
logger = logging.Logger(u'mandos')
 
69
version = "1.0.5"
 
70
 
 
71
logger = logging.Logger('mandos')
83
72
syslogger = (logging.handlers.SysLogHandler
84
73
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
74
              address = "/dev/log"))
86
75
syslogger.setFormatter(logging.Formatter
87
 
                       (u'Mandos [%(process)d]: %(levelname)s:'
88
 
                        u' %(message)s'))
 
76
                       ('Mandos [%(process)d]: %(levelname)s:'
 
77
                        ' %(message)s'))
89
78
logger.addHandler(syslogger)
90
79
 
91
80
console = logging.StreamHandler()
92
 
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
 
                                       u' %(levelname)s:'
94
 
                                       u' %(message)s'))
 
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
 
82
                                       ' %(levelname)s: %(message)s'))
95
83
logger.addHandler(console)
96
84
 
97
85
class AvahiError(Exception):
110
98
 
111
99
class AvahiService(object):
112
100
    """An Avahi (Zeroconf) service.
113
 
    
114
101
    Attributes:
115
102
    interface: integer; avahi.IF_UNSPEC or an interface index.
116
103
               Used to optionally bind to the specified interface.
117
 
    name: string; Example: u'Mandos'
118
 
    type: string; Example: u'_mandos._tcp'.
 
104
    name: string; Example: 'Mandos'
 
105
    type: string; Example: '_mandos._tcp'.
119
106
                  See <http://www.dns-sd.org/ServiceTypes.html>
120
107
    port: integer; what port to announce
121
108
    TXT: list of strings; TXT record for the service
127
114
    """
128
115
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
129
116
                 servicetype = None, port = None, TXT = None,
130
 
                 domain = u"", host = u"", max_renames = 32768,
131
 
                 protocol = avahi.PROTO_UNSPEC):
 
117
                 domain = "", host = "", max_renames = 32768):
132
118
        self.interface = interface
133
119
        self.name = name
134
120
        self.type = servicetype
138
124
        self.host = host
139
125
        self.rename_count = 0
140
126
        self.max_renames = max_renames
141
 
        self.protocol = protocol
142
127
    def rename(self):
143
128
        """Derived from the Avahi example code"""
144
129
        if self.rename_count >= self.max_renames:
148
133
            raise AvahiServiceError(u"Too many renames")
149
134
        self.name = server.GetAlternativeServiceName(self.name)
150
135
        logger.info(u"Changing Zeroconf service name to %r ...",
151
 
                    self.name)
 
136
                    str(self.name))
152
137
        syslogger.setFormatter(logging.Formatter
153
 
                               (u'Mandos (%s) [%%(process)d]:'
154
 
                                u' %%(levelname)s: %%(message)s'
155
 
                                % self.name))
 
138
                               ('Mandos (%s): %%(levelname)s:'
 
139
                                ' %%(message)s' % self.name))
156
140
        self.remove()
157
141
        self.add()
158
142
        self.rename_count += 1
174
158
                     service.name, service.type)
175
159
        group.AddService(
176
160
                self.interface,         # interface
177
 
                self.protocol,          # protocol
 
161
                avahi.PROTO_INET6,      # protocol
178
162
                dbus.UInt32(0),         # flags
179
163
                self.name, self.type,
180
164
                self.domain, self.host,
192
176
    return dbus.String(dt.isoformat(), variant_level=variant_level)
193
177
 
194
178
 
195
 
class Client(object):
 
179
class Client(dbus.service.Object):
196
180
    """A representation of a client host served by this server.
197
 
    
198
181
    Attributes:
199
182
    name:       string; from the config file, used in log messages and
200
183
                        D-Bus identifiers
220
203
                     client lives.  %() expansions are done at
221
204
                     runtime with vars(self) as dict, so that for
222
205
                     instance %(name)s can be used in the command.
223
 
    current_checker_command: string; current running checker_command
 
206
    use_dbus: bool(); Whether to provide D-Bus interface and signals
 
207
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
224
208
    """
225
 
    
226
 
    @staticmethod
227
 
    def _datetime_to_milliseconds(dt):
228
 
        "Convert a datetime.datetime() to milliseconds"
229
 
        return ((dt.days * 24 * 60 * 60 * 1000)
230
 
                + (dt.seconds * 1000)
231
 
                + (dt.microseconds // 1000))
232
 
    
233
209
    def timeout_milliseconds(self):
234
210
        "Return the 'timeout' attribute in milliseconds"
235
 
        return self._datetime_to_milliseconds(self.timeout)
 
211
        return ((self.timeout.days * 24 * 60 * 60 * 1000)
 
212
                + (self.timeout.seconds * 1000)
 
213
                + (self.timeout.microseconds // 1000))
236
214
    
237
215
    def interval_milliseconds(self):
238
216
        "Return the 'interval' attribute in milliseconds"
239
 
        return self._datetime_to_milliseconds(self.interval)
 
217
        return ((self.interval.days * 24 * 60 * 60 * 1000)
 
218
                + (self.interval.seconds * 1000)
 
219
                + (self.interval.microseconds // 1000))
240
220
    
241
 
    def __init__(self, name = None, disable_hook=None, config=None):
 
221
    def __init__(self, name = None, disable_hook=None, config=None,
 
222
                 use_dbus=True):
242
223
        """Note: the 'checker' key in 'config' sets the
243
224
        'checker_command' attribute and *not* the 'checker'
244
225
        attribute."""
246
227
        if config is None:
247
228
            config = {}
248
229
        logger.debug(u"Creating client %r", self.name)
 
230
        self.use_dbus = False   # During __init__
249
231
        # Uppercase and remove spaces from fingerprint for later
250
232
        # comparison purposes with return value from the fingerprint()
251
233
        # function
252
 
        self.fingerprint = (config[u"fingerprint"].upper()
 
234
        self.fingerprint = (config["fingerprint"].upper()
253
235
                            .replace(u" ", u""))
254
236
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
255
 
        if u"secret" in config:
256
 
            self.secret = config[u"secret"].decode(u"base64")
257
 
        elif u"secfile" in config:
 
237
        if "secret" in config:
 
238
            self.secret = config["secret"].decode(u"base64")
 
239
        elif "secfile" in config:
258
240
            with closing(open(os.path.expanduser
259
241
                              (os.path.expandvars
260
 
                               (config[u"secfile"])))) as secfile:
 
242
                               (config["secfile"])))) as secfile:
261
243
                self.secret = secfile.read()
262
244
        else:
263
245
            raise TypeError(u"No secret or secfile for client %s"
264
246
                            % self.name)
265
 
        self.host = config.get(u"host", u"")
 
247
        self.host = config.get("host", "")
266
248
        self.created = datetime.datetime.utcnow()
267
249
        self.enabled = False
268
250
        self.last_enabled = None
269
251
        self.last_checked_ok = None
270
 
        self.timeout = string_to_delta(config[u"timeout"])
271
 
        self.interval = string_to_delta(config[u"interval"])
 
252
        self.timeout = string_to_delta(config["timeout"])
 
253
        self.interval = string_to_delta(config["interval"])
272
254
        self.disable_hook = disable_hook
273
255
        self.checker = None
274
256
        self.checker_initiator_tag = None
275
257
        self.disable_initiator_tag = None
276
258
        self.checker_callback_tag = None
277
 
        self.checker_command = config[u"checker"]
278
 
        self.current_checker_command = None
 
259
        self.checker_command = config["checker"]
279
260
        self.last_connect = None
 
261
        # Only now, when this client is initialized, can it show up on
 
262
        # the D-Bus
 
263
        self.use_dbus = use_dbus
 
264
        if self.use_dbus:
 
265
            self.dbus_object_path = (dbus.ObjectPath
 
266
                                     ("/clients/"
 
267
                                      + self.name.replace(".", "_")))
 
268
            dbus.service.Object.__init__(self, bus,
 
269
                                         self.dbus_object_path)
280
270
    
281
271
    def enable(self):
282
272
        """Start this client's checker and timeout hooks"""
293
283
                                   (self.timeout_milliseconds(),
294
284
                                    self.disable))
295
285
        self.enabled = True
 
286
        if self.use_dbus:
 
287
            # Emit D-Bus signals
 
288
            self.PropertyChanged(dbus.String(u"enabled"),
 
289
                                 dbus.Boolean(True, variant_level=1))
 
290
            self.PropertyChanged(dbus.String(u"last_enabled"),
 
291
                                 (_datetime_to_dbus(self.last_enabled,
 
292
                                                    variant_level=1)))
296
293
    
297
294
    def disable(self):
298
295
        """Disable this client."""
299
296
        if not getattr(self, "enabled", False):
300
297
            return False
301
298
        logger.info(u"Disabling client %s", self.name)
302
 
        if getattr(self, u"disable_initiator_tag", False):
 
299
        if getattr(self, "disable_initiator_tag", False):
303
300
            gobject.source_remove(self.disable_initiator_tag)
304
301
            self.disable_initiator_tag = None
305
 
        if getattr(self, u"checker_initiator_tag", False):
 
302
        if getattr(self, "checker_initiator_tag", False):
306
303
            gobject.source_remove(self.checker_initiator_tag)
307
304
            self.checker_initiator_tag = None
308
305
        self.stop_checker()
309
306
        if self.disable_hook:
310
307
            self.disable_hook(self)
311
308
        self.enabled = False
 
309
        if self.use_dbus:
 
310
            # Emit D-Bus signal
 
311
            self.PropertyChanged(dbus.String(u"enabled"),
 
312
                                 dbus.Boolean(False, variant_level=1))
312
313
        # Do not run this again if called by a gobject.timeout_add
313
314
        return False
314
315
    
320
321
        """The checker has completed, so take appropriate actions."""
321
322
        self.checker_callback_tag = None
322
323
        self.checker = None
 
324
        if self.use_dbus:
 
325
            # Emit D-Bus signal
 
326
            self.PropertyChanged(dbus.String(u"checker_running"),
 
327
                                 dbus.Boolean(False, variant_level=1))
323
328
        if os.WIFEXITED(condition):
324
329
            exitstatus = os.WEXITSTATUS(condition)
325
330
            if exitstatus == 0:
329
334
            else:
330
335
                logger.info(u"Checker for %(name)s failed",
331
336
                            vars(self))
 
337
            if self.use_dbus:
 
338
                # Emit D-Bus signal
 
339
                self.CheckerCompleted(dbus.Int16(exitstatus),
 
340
                                      dbus.Int64(condition),
 
341
                                      dbus.String(command))
332
342
        else:
333
343
            logger.warning(u"Checker for %(name)s crashed?",
334
344
                           vars(self))
 
345
            if self.use_dbus:
 
346
                # Emit D-Bus signal
 
347
                self.CheckerCompleted(dbus.Int16(-1),
 
348
                                      dbus.Int64(condition),
 
349
                                      dbus.String(command))
335
350
    
336
351
    def checked_ok(self):
337
352
        """Bump up the timeout for this client.
338
 
        
339
353
        This should only be called when the client has been seen,
340
354
        alive and well.
341
355
        """
344
358
        self.disable_initiator_tag = (gobject.timeout_add
345
359
                                      (self.timeout_milliseconds(),
346
360
                                       self.disable))
 
361
        if self.use_dbus:
 
362
            # Emit D-Bus signal
 
363
            self.PropertyChanged(
 
364
                dbus.String(u"last_checked_ok"),
 
365
                (_datetime_to_dbus(self.last_checked_ok,
 
366
                                   variant_level=1)))
347
367
    
348
368
    def start_checker(self):
349
369
        """Start a new checker subprocess if one is not running.
350
 
        
351
370
        If a checker already exists, leave it running and do
352
371
        nothing."""
353
372
        # The reason for not killing a running checker is that if we
358
377
        # checkers alone, the checker would have to take more time
359
378
        # than 'timeout' for the client to be declared invalid, which
360
379
        # is as it should be.
361
 
        
362
 
        # If a checker exists, make sure it is not a zombie
363
 
        if self.checker is not None:
364
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
365
 
            if pid:
366
 
                logger.warning(u"Checker was a zombie")
367
 
                gobject.source_remove(self.checker_callback_tag)
368
 
                self.checker_callback(pid, status,
369
 
                                      self.current_checker_command)
370
 
        # Start a new checker if needed
371
380
        if self.checker is None:
372
381
            try:
373
382
                # In case checker_command has exactly one % operator
374
383
                command = self.checker_command % self.host
375
384
            except TypeError:
376
385
                # Escape attributes for the shell
377
 
                escaped_attrs = dict((key,
378
 
                                      re.escape(unicode(str(val),
379
 
                                                        errors=
380
 
                                                        u'replace')))
 
386
                escaped_attrs = dict((key, re.escape(str(val)))
381
387
                                     for key, val in
382
388
                                     vars(self).iteritems())
383
389
                try:
386
392
                    logger.error(u'Could not format string "%s":'
387
393
                                 u' %s', self.checker_command, error)
388
394
                    return True # Try again later
389
 
            self.current_checker_command = command
390
395
            try:
391
396
                logger.info(u"Starting checker %r for %s",
392
397
                            command, self.name)
396
401
                # always replaced by /dev/null.)
397
402
                self.checker = subprocess.Popen(command,
398
403
                                                close_fds=True,
399
 
                                                shell=True, cwd=u"/")
 
404
                                                shell=True, cwd="/")
 
405
                if self.use_dbus:
 
406
                    # Emit D-Bus signal
 
407
                    self.CheckerStarted(command)
 
408
                    self.PropertyChanged(
 
409
                        dbus.String("checker_running"),
 
410
                        dbus.Boolean(True, variant_level=1))
400
411
                self.checker_callback_tag = (gobject.child_watch_add
401
412
                                             (self.checker.pid,
402
413
                                              self.checker_callback,
403
414
                                              data=command))
404
 
                # The checker may have completed before the gobject
405
 
                # watch was added.  Check for this.
406
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
407
 
                if pid:
408
 
                    gobject.source_remove(self.checker_callback_tag)
409
 
                    self.checker_callback(pid, status, command)
410
415
            except OSError, error:
411
416
                logger.error(u"Failed to start subprocess: %s",
412
417
                             error)
418
423
        if self.checker_callback_tag:
419
424
            gobject.source_remove(self.checker_callback_tag)
420
425
            self.checker_callback_tag = None
421
 
        if getattr(self, u"checker", None) is None:
 
426
        if getattr(self, "checker", None) is None:
422
427
            return
423
428
        logger.debug(u"Stopping checker for %(name)s", vars(self))
424
429
        try:
430
435
            if error.errno != errno.ESRCH: # No such process
431
436
                raise
432
437
        self.checker = None
 
438
        if self.use_dbus:
 
439
            self.PropertyChanged(dbus.String(u"checker_running"),
 
440
                                 dbus.Boolean(False, variant_level=1))
433
441
    
434
442
    def still_valid(self):
435
443
        """Has the timeout not yet passed for this client?"""
436
 
        if not getattr(self, u"enabled", False):
 
444
        if not getattr(self, "enabled", False):
437
445
            return False
438
446
        now = datetime.datetime.utcnow()
439
447
        if self.last_checked_ok is None:
440
448
            return now < (self.created + self.timeout)
441
449
        else:
442
450
            return now < (self.last_checked_ok + self.timeout)
443
 
 
444
 
 
445
 
class ClientDBus(Client, dbus.service.Object):
446
 
    """A Client class using D-Bus
447
 
    
448
 
    Attributes:
449
 
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
450
 
    """
451
 
    # dbus.service.Object doesn't use super(), so we can't either.
452
 
    
453
 
    def __init__(self, *args, **kwargs):
454
 
        Client.__init__(self, *args, **kwargs)
455
 
        # Only now, when this client is initialized, can it show up on
456
 
        # the D-Bus
457
 
        self.dbus_object_path = (dbus.ObjectPath
458
 
                                 (u"/clients/"
459
 
                                  + self.name.replace(u".", u"_")))
460
 
        dbus.service.Object.__init__(self, bus,
461
 
                                     self.dbus_object_path)
462
 
    def enable(self):
463
 
        oldstate = getattr(self, u"enabled", False)
464
 
        r = Client.enable(self)
465
 
        if oldstate != self.enabled:
466
 
            # Emit D-Bus signals
467
 
            self.PropertyChanged(dbus.String(u"enabled"),
468
 
                                 dbus.Boolean(True, variant_level=1))
469
 
            self.PropertyChanged(dbus.String(u"last_enabled"),
470
 
                                 (_datetime_to_dbus(self.last_enabled,
471
 
                                                    variant_level=1)))
472
 
        return r
473
 
    
474
 
    def disable(self, signal = True):
475
 
        oldstate = getattr(self, u"enabled", False)
476
 
        r = Client.disable(self)
477
 
        if signal and oldstate != self.enabled:
478
 
            # Emit D-Bus signal
479
 
            self.PropertyChanged(dbus.String(u"enabled"),
480
 
                                 dbus.Boolean(False, variant_level=1))
481
 
        return r
482
 
    
483
 
    def __del__(self, *args, **kwargs):
484
 
        try:
485
 
            self.remove_from_connection()
486
 
        except LookupError:
487
 
            pass
488
 
        if hasattr(dbus.service.Object, u"__del__"):
489
 
            dbus.service.Object.__del__(self, *args, **kwargs)
490
 
        Client.__del__(self, *args, **kwargs)
491
 
    
492
 
    def checker_callback(self, pid, condition, command,
493
 
                         *args, **kwargs):
494
 
        self.checker_callback_tag = None
495
 
        self.checker = None
496
 
        # Emit D-Bus signal
497
 
        self.PropertyChanged(dbus.String(u"checker_running"),
498
 
                             dbus.Boolean(False, variant_level=1))
499
 
        if os.WIFEXITED(condition):
500
 
            exitstatus = os.WEXITSTATUS(condition)
501
 
            # Emit D-Bus signal
502
 
            self.CheckerCompleted(dbus.Int16(exitstatus),
503
 
                                  dbus.Int64(condition),
504
 
                                  dbus.String(command))
505
 
        else:
506
 
            # Emit D-Bus signal
507
 
            self.CheckerCompleted(dbus.Int16(-1),
508
 
                                  dbus.Int64(condition),
509
 
                                  dbus.String(command))
510
 
        
511
 
        return Client.checker_callback(self, pid, condition, command,
512
 
                                       *args, **kwargs)
513
 
    
514
 
    def checked_ok(self, *args, **kwargs):
515
 
        r = Client.checked_ok(self, *args, **kwargs)
516
 
        # Emit D-Bus signal
517
 
        self.PropertyChanged(
518
 
            dbus.String(u"last_checked_ok"),
519
 
            (_datetime_to_dbus(self.last_checked_ok,
520
 
                               variant_level=1)))
521
 
        return r
522
 
    
523
 
    def start_checker(self, *args, **kwargs):
524
 
        old_checker = self.checker
525
 
        if self.checker is not None:
526
 
            old_checker_pid = self.checker.pid
527
 
        else:
528
 
            old_checker_pid = None
529
 
        r = Client.start_checker(self, *args, **kwargs)
530
 
        # Only if new checker process was started
531
 
        if (self.checker is not None
532
 
            and old_checker_pid != self.checker.pid):
533
 
            # Emit D-Bus signal
534
 
            self.CheckerStarted(self.current_checker_command)
535
 
            self.PropertyChanged(
536
 
                dbus.String(u"checker_running"),
537
 
                dbus.Boolean(True, variant_level=1))
538
 
        return r
539
 
    
540
 
    def stop_checker(self, *args, **kwargs):
541
 
        old_checker = getattr(self, u"checker", None)
542
 
        r = Client.stop_checker(self, *args, **kwargs)
543
 
        if (old_checker is not None
544
 
            and getattr(self, u"checker", None) is None):
545
 
            self.PropertyChanged(dbus.String(u"checker_running"),
546
 
                                 dbus.Boolean(False, variant_level=1))
547
 
        return r
548
451
    
549
452
    ## D-Bus methods & signals
550
453
    _interface = u"se.bsnet.fukt.Mandos.Client"
551
454
    
552
455
    # CheckedOK - method
553
 
    @dbus.service.method(_interface)
554
 
    def CheckedOK(self):
555
 
        return self.checked_ok()
 
456
    CheckedOK = dbus.service.method(_interface)(checked_ok)
 
457
    CheckedOK.__name__ = "CheckedOK"
556
458
    
557
459
    # CheckerCompleted - signal
558
 
    @dbus.service.signal(_interface, signature=u"nxs")
 
460
    @dbus.service.signal(_interface, signature="nxs")
559
461
    def CheckerCompleted(self, exitcode, waitstatus, command):
560
462
        "D-Bus signal"
561
463
        pass
562
464
    
563
465
    # CheckerStarted - signal
564
 
    @dbus.service.signal(_interface, signature=u"s")
 
466
    @dbus.service.signal(_interface, signature="s")
565
467
    def CheckerStarted(self, command):
566
468
        "D-Bus signal"
567
469
        pass
568
470
    
569
471
    # GetAllProperties - method
570
 
    @dbus.service.method(_interface, out_signature=u"a{sv}")
 
472
    @dbus.service.method(_interface, out_signature="a{sv}")
571
473
    def GetAllProperties(self):
572
474
        "D-Bus method"
573
475
        return dbus.Dictionary({
574
 
                dbus.String(u"name"):
 
476
                dbus.String("name"):
575
477
                    dbus.String(self.name, variant_level=1),
576
 
                dbus.String(u"fingerprint"):
 
478
                dbus.String("fingerprint"):
577
479
                    dbus.String(self.fingerprint, variant_level=1),
578
 
                dbus.String(u"host"):
 
480
                dbus.String("host"):
579
481
                    dbus.String(self.host, variant_level=1),
580
 
                dbus.String(u"created"):
 
482
                dbus.String("created"):
581
483
                    _datetime_to_dbus(self.created, variant_level=1),
582
 
                dbus.String(u"last_enabled"):
 
484
                dbus.String("last_enabled"):
583
485
                    (_datetime_to_dbus(self.last_enabled,
584
486
                                       variant_level=1)
585
487
                     if self.last_enabled is not None
586
488
                     else dbus.Boolean(False, variant_level=1)),
587
 
                dbus.String(u"enabled"):
 
489
                dbus.String("enabled"):
588
490
                    dbus.Boolean(self.enabled, variant_level=1),
589
 
                dbus.String(u"last_checked_ok"):
 
491
                dbus.String("last_checked_ok"):
590
492
                    (_datetime_to_dbus(self.last_checked_ok,
591
493
                                       variant_level=1)
592
494
                     if self.last_checked_ok is not None
593
495
                     else dbus.Boolean (False, variant_level=1)),
594
 
                dbus.String(u"timeout"):
 
496
                dbus.String("timeout"):
595
497
                    dbus.UInt64(self.timeout_milliseconds(),
596
498
                                variant_level=1),
597
 
                dbus.String(u"interval"):
 
499
                dbus.String("interval"):
598
500
                    dbus.UInt64(self.interval_milliseconds(),
599
501
                                variant_level=1),
600
 
                dbus.String(u"checker"):
 
502
                dbus.String("checker"):
601
503
                    dbus.String(self.checker_command,
602
504
                                variant_level=1),
603
 
                dbus.String(u"checker_running"):
 
505
                dbus.String("checker_running"):
604
506
                    dbus.Boolean(self.checker is not None,
605
507
                                 variant_level=1),
606
 
                dbus.String(u"object_path"):
 
508
                dbus.String("object_path"):
607
509
                    dbus.ObjectPath(self.dbus_object_path,
608
510
                                    variant_level=1)
609
 
                }, signature=u"sv")
 
511
                }, signature="sv")
610
512
    
611
513
    # IsStillValid - method
612
 
    @dbus.service.method(_interface, out_signature=u"b")
613
 
    def IsStillValid(self):
614
 
        return self.still_valid()
 
514
    IsStillValid = (dbus.service.method(_interface, out_signature="b")
 
515
                    (still_valid))
 
516
    IsStillValid.__name__ = "IsStillValid"
615
517
    
616
518
    # PropertyChanged - signal
617
 
    @dbus.service.signal(_interface, signature=u"sv")
 
519
    @dbus.service.signal(_interface, signature="sv")
618
520
    def PropertyChanged(self, property, value):
619
521
        "D-Bus signal"
620
522
        pass
621
523
    
622
 
    # ReceivedSecret - signal
623
 
    @dbus.service.signal(_interface)
624
 
    def ReceivedSecret(self):
625
 
        "D-Bus signal"
626
 
        pass
627
 
    
628
 
    # Rejected - signal
629
 
    @dbus.service.signal(_interface)
630
 
    def Rejected(self):
631
 
        "D-Bus signal"
632
 
        pass
633
 
    
634
524
    # SetChecker - method
635
 
    @dbus.service.method(_interface, in_signature=u"s")
 
525
    @dbus.service.method(_interface, in_signature="s")
636
526
    def SetChecker(self, checker):
637
527
        "D-Bus setter method"
638
528
        self.checker_command = checker
642
532
                                         variant_level=1))
643
533
    
644
534
    # SetHost - method
645
 
    @dbus.service.method(_interface, in_signature=u"s")
 
535
    @dbus.service.method(_interface, in_signature="s")
646
536
    def SetHost(self, host):
647
537
        "D-Bus setter method"
648
538
        self.host = host
651
541
                             dbus.String(self.host, variant_level=1))
652
542
    
653
543
    # SetInterval - method
654
 
    @dbus.service.method(_interface, in_signature=u"t")
 
544
    @dbus.service.method(_interface, in_signature="t")
655
545
    def SetInterval(self, milliseconds):
656
546
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
657
547
        # Emit D-Bus signal
660
550
                                          variant_level=1)))
661
551
    
662
552
    # SetSecret - method
663
 
    @dbus.service.method(_interface, in_signature=u"ay",
 
553
    @dbus.service.method(_interface, in_signature="ay",
664
554
                         byte_arrays=True)
665
555
    def SetSecret(self, secret):
666
556
        "D-Bus setter method"
667
557
        self.secret = str(secret)
668
558
    
669
559
    # SetTimeout - method
670
 
    @dbus.service.method(_interface, in_signature=u"t")
 
560
    @dbus.service.method(_interface, in_signature="t")
671
561
    def SetTimeout(self, milliseconds):
672
562
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
673
563
        # Emit D-Bus signal
676
566
                                          variant_level=1)))
677
567
    
678
568
    # Enable - method
679
 
    @dbus.service.method(_interface)
680
 
    def Enable(self):
681
 
        "D-Bus method"
682
 
        self.enable()
 
569
    Enable = dbus.service.method(_interface)(enable)
 
570
    Enable.__name__ = "Enable"
683
571
    
684
572
    # StartChecker - method
685
573
    @dbus.service.method(_interface)
694
582
        self.disable()
695
583
    
696
584
    # StopChecker - method
697
 
    @dbus.service.method(_interface)
698
 
    def StopChecker(self):
699
 
        self.stop_checker()
 
585
    StopChecker = dbus.service.method(_interface)(stop_checker)
 
586
    StopChecker.__name__ = "StopChecker"
700
587
    
701
588
    del _interface
702
589
 
703
590
 
704
 
class ClientHandler(socketserver.BaseRequestHandler, object):
705
 
    """A class to handle client connections.
706
 
    
707
 
    Instantiated once for each connection to handle it.
 
591
def peer_certificate(session):
 
592
    "Return the peer's OpenPGP certificate as a bytestring"
 
593
    # If not an OpenPGP certificate...
 
594
    if (gnutls.library.functions
 
595
        .gnutls_certificate_type_get(session._c_object)
 
596
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
597
        # ...do the normal thing
 
598
        return session.peer_certificate
 
599
    list_size = ctypes.c_uint(1)
 
600
    cert_list = (gnutls.library.functions
 
601
                 .gnutls_certificate_get_peers
 
602
                 (session._c_object, ctypes.byref(list_size)))
 
603
    if not bool(cert_list) and list_size.value != 0:
 
604
        raise gnutls.errors.GNUTLSError("error getting peer"
 
605
                                        " certificate")
 
606
    if list_size.value == 0:
 
607
        return None
 
608
    cert = cert_list[0]
 
609
    return ctypes.string_at(cert.data, cert.size)
 
610
 
 
611
 
 
612
def fingerprint(openpgp):
 
613
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
 
614
    # New GnuTLS "datum" with the OpenPGP public key
 
615
    datum = (gnutls.library.types
 
616
             .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
617
                                         ctypes.POINTER
 
618
                                         (ctypes.c_ubyte)),
 
619
                             ctypes.c_uint(len(openpgp))))
 
620
    # New empty GnuTLS certificate
 
621
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
622
    (gnutls.library.functions
 
623
     .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
624
    # Import the OpenPGP public key into the certificate
 
625
    (gnutls.library.functions
 
626
     .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
627
                                gnutls.library.constants
 
628
                                .GNUTLS_OPENPGP_FMT_RAW))
 
629
    # Verify the self signature in the key
 
630
    crtverify = ctypes.c_uint()
 
631
    (gnutls.library.functions
 
632
     .gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
 
633
    if crtverify.value != 0:
 
634
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
635
        raise gnutls.errors.CertificateSecurityError("Verify failed")
 
636
    # New buffer for the fingerprint
 
637
    buf = ctypes.create_string_buffer(20)
 
638
    buf_len = ctypes.c_size_t()
 
639
    # Get the fingerprint from the certificate into the buffer
 
640
    (gnutls.library.functions
 
641
     .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
642
                                         ctypes.byref(buf_len)))
 
643
    # Deinit the certificate
 
644
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
645
    # Convert the buffer to a Python bytestring
 
646
    fpr = ctypes.string_at(buf, buf_len.value)
 
647
    # Convert the bytestring to hexadecimal notation
 
648
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
649
    return hex_fpr
 
650
 
 
651
 
 
652
class TCP_handler(SocketServer.BaseRequestHandler, object):
 
653
    """A TCP request handler class.
 
654
    Instantiated by IPv6_TCPServer for each request to handle it.
708
655
    Note: This will run in its own forked process."""
709
656
    
710
657
    def handle(self):
711
658
        logger.info(u"TCP connection from: %s",
712
659
                    unicode(self.client_address))
713
 
        logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
714
 
        # Open IPC pipe to parent process
715
 
        with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
716
 
            session = (gnutls.connection
717
 
                       .ClientSession(self.request,
718
 
                                      gnutls.connection
719
 
                                      .X509Credentials()))
720
 
            
721
 
            line = self.request.makefile().readline()
722
 
            logger.debug(u"Protocol version: %r", line)
723
 
            try:
724
 
                if int(line.strip().split()[0]) > 1:
725
 
                    raise RuntimeError
726
 
            except (ValueError, IndexError, RuntimeError), error:
727
 
                logger.error(u"Unknown protocol version: %s", error)
728
 
                return
729
 
            
730
 
            # Note: gnutls.connection.X509Credentials is really a
731
 
            # generic GnuTLS certificate credentials object so long as
732
 
            # no X.509 keys are added to it.  Therefore, we can use it
733
 
            # here despite using OpenPGP certificates.
734
 
            
735
 
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
736
 
            #                      u"+AES-256-CBC", u"+SHA1",
737
 
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
738
 
            #                      u"+DHE-DSS"))
739
 
            # Use a fallback default, since this MUST be set.
740
 
            priority = self.server.gnutls_priority
741
 
            if priority is None:
742
 
                priority = u"NORMAL"
743
 
            (gnutls.library.functions
744
 
             .gnutls_priority_set_direct(session._c_object,
745
 
                                         priority, None))
746
 
            
747
 
            try:
748
 
                session.handshake()
749
 
            except gnutls.errors.GNUTLSError, error:
750
 
                logger.warning(u"Handshake failed: %s", error)
751
 
                # Do not run session.bye() here: the session is not
752
 
                # established.  Just abandon the request.
753
 
                return
754
 
            logger.debug(u"Handshake succeeded")
755
 
            try:
756
 
                fpr = self.fingerprint(self.peer_certificate(session))
757
 
            except (TypeError, gnutls.errors.GNUTLSError), error:
758
 
                logger.warning(u"Bad certificate: %s", error)
759
 
                session.bye()
760
 
                return
761
 
            logger.debug(u"Fingerprint: %s", fpr)
762
 
            
763
 
            for c in self.server.clients:
764
 
                if c.fingerprint == fpr:
765
 
                    client = c
766
 
                    break
767
 
            else:
768
 
                ipc.write(u"NOTFOUND %s\n" % fpr)
769
 
                session.bye()
770
 
                return
771
 
            # Have to check if client.still_valid(), since it is
772
 
            # possible that the client timed out while establishing
773
 
            # the GnuTLS session.
774
 
            if not client.still_valid():
775
 
                ipc.write(u"INVALID %s\n" % client.name)
776
 
                session.bye()
777
 
                return
778
 
            ipc.write(u"SENDING %s\n" % client.name)
779
 
            sent_size = 0
780
 
            while sent_size < len(client.secret):
781
 
                sent = session.send(client.secret[sent_size:])
782
 
                logger.debug(u"Sent: %d, remaining: %d",
783
 
                             sent, len(client.secret)
784
 
                             - (sent_size + sent))
785
 
                sent_size += sent
786
 
            session.bye()
787
 
    
788
 
    @staticmethod
789
 
    def peer_certificate(session):
790
 
        "Return the peer's OpenPGP certificate as a bytestring"
791
 
        # If not an OpenPGP certificate...
792
 
        if (gnutls.library.functions
793
 
            .gnutls_certificate_type_get(session._c_object)
794
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
795
 
            # ...do the normal thing
796
 
            return session.peer_certificate
797
 
        list_size = ctypes.c_uint(1)
798
 
        cert_list = (gnutls.library.functions
799
 
                     .gnutls_certificate_get_peers
800
 
                     (session._c_object, ctypes.byref(list_size)))
801
 
        if not bool(cert_list) and list_size.value != 0:
802
 
            raise gnutls.errors.GNUTLSError(u"error getting peer"
803
 
                                            u" certificate")
804
 
        if list_size.value == 0:
805
 
            return None
806
 
        cert = cert_list[0]
807
 
        return ctypes.string_at(cert.data, cert.size)
808
 
    
809
 
    @staticmethod
810
 
    def fingerprint(openpgp):
811
 
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
812
 
        # New GnuTLS "datum" with the OpenPGP public key
813
 
        datum = (gnutls.library.types
814
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
815
 
                                             ctypes.POINTER
816
 
                                             (ctypes.c_ubyte)),
817
 
                                 ctypes.c_uint(len(openpgp))))
818
 
        # New empty GnuTLS certificate
819
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
820
 
        (gnutls.library.functions
821
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
822
 
        # Import the OpenPGP public key into the certificate
823
 
        (gnutls.library.functions
824
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
825
 
                                    gnutls.library.constants
826
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
827
 
        # Verify the self signature in the key
828
 
        crtverify = ctypes.c_uint()
829
 
        (gnutls.library.functions
830
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
831
 
                                         ctypes.byref(crtverify)))
832
 
        if crtverify.value != 0:
833
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
834
 
            raise (gnutls.errors.CertificateSecurityError
835
 
                   (u"Verify failed"))
836
 
        # New buffer for the fingerprint
837
 
        buf = ctypes.create_string_buffer(20)
838
 
        buf_len = ctypes.c_size_t()
839
 
        # Get the fingerprint from the certificate into the buffer
840
 
        (gnutls.library.functions
841
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
842
 
                                             ctypes.byref(buf_len)))
843
 
        # Deinit the certificate
844
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
845
 
        # Convert the buffer to a Python bytestring
846
 
        fpr = ctypes.string_at(buf, buf_len.value)
847
 
        # Convert the bytestring to hexadecimal notation
848
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
849
 
        return hex_fpr
850
 
 
851
 
 
852
 
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
853
 
    """Like socketserver.ForkingMixIn, but also pass a pipe.
854
 
    
855
 
    Assumes a gobject.MainLoop event loop.
856
 
    """
857
 
    def process_request(self, request, client_address):
858
 
        """Overrides and wraps the original process_request().
859
 
        
860
 
        This function creates a new pipe in self.pipe 
861
 
        """
862
 
        self.pipe = os.pipe()
863
 
        super(ForkingMixInWithPipe,
864
 
              self).process_request(request, client_address)
865
 
        os.close(self.pipe[1])  # close write end
866
 
        # Call "handle_ipc" for both data and EOF events
867
 
        gobject.io_add_watch(self.pipe[0],
868
 
                             gobject.IO_IN | gobject.IO_HUP,
869
 
                             self.handle_ipc)
870
 
    def handle_ipc(source, condition):
871
 
        """Dummy function; override as necessary"""
872
 
        os.close(source)
873
 
        return False
874
 
 
875
 
 
876
 
class IPv6_TCPServer(ForkingMixInWithPipe,
877
 
                     socketserver.TCPServer, object):
878
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
879
 
    
 
660
        session = (gnutls.connection
 
661
                   .ClientSession(self.request,
 
662
                                  gnutls.connection
 
663
                                  .X509Credentials()))
 
664
        
 
665
        line = self.request.makefile().readline()
 
666
        logger.debug(u"Protocol version: %r", line)
 
667
        try:
 
668
            if int(line.strip().split()[0]) > 1:
 
669
                raise RuntimeError
 
670
        except (ValueError, IndexError, RuntimeError), error:
 
671
            logger.error(u"Unknown protocol version: %s", error)
 
672
            return
 
673
        
 
674
        # Note: gnutls.connection.X509Credentials is really a generic
 
675
        # GnuTLS certificate credentials object so long as no X.509
 
676
        # keys are added to it.  Therefore, we can use it here despite
 
677
        # using OpenPGP certificates.
 
678
        
 
679
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
 
680
        #                     "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
 
681
        #                     "+DHE-DSS"))
 
682
        # Use a fallback default, since this MUST be set.
 
683
        priority = self.server.settings.get("priority", "NORMAL")
 
684
        (gnutls.library.functions
 
685
         .gnutls_priority_set_direct(session._c_object,
 
686
                                     priority, None))
 
687
        
 
688
        try:
 
689
            session.handshake()
 
690
        except gnutls.errors.GNUTLSError, error:
 
691
            logger.warning(u"Handshake failed: %s", error)
 
692
            # Do not run session.bye() here: the session is not
 
693
            # established.  Just abandon the request.
 
694
            return
 
695
        logger.debug(u"Handshake succeeded")
 
696
        try:
 
697
            fpr = fingerprint(peer_certificate(session))
 
698
        except (TypeError, gnutls.errors.GNUTLSError), error:
 
699
            logger.warning(u"Bad certificate: %s", error)
 
700
            session.bye()
 
701
            return
 
702
        logger.debug(u"Fingerprint: %s", fpr)
 
703
        
 
704
        for c in self.server.clients:
 
705
            if c.fingerprint == fpr:
 
706
                client = c
 
707
                break
 
708
        else:
 
709
            logger.warning(u"Client not found for fingerprint: %s",
 
710
                           fpr)
 
711
            session.bye()
 
712
            return
 
713
        # Have to check if client.still_valid(), since it is possible
 
714
        # that the client timed out while establishing the GnuTLS
 
715
        # session.
 
716
        if not client.still_valid():
 
717
            logger.warning(u"Client %(name)s is invalid",
 
718
                           vars(client))
 
719
            session.bye()
 
720
            return
 
721
        ## This won't work here, since we're in a fork.
 
722
        # client.checked_ok()
 
723
        sent_size = 0
 
724
        while sent_size < len(client.secret):
 
725
            sent = session.send(client.secret[sent_size:])
 
726
            logger.debug(u"Sent: %d, remaining: %d",
 
727
                         sent, len(client.secret)
 
728
                         - (sent_size + sent))
 
729
            sent_size += sent
 
730
        session.bye()
 
731
 
 
732
 
 
733
class IPv6_TCPServer(SocketServer.ForkingMixIn,
 
734
                     SocketServer.TCPServer, object):
 
735
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
880
736
    Attributes:
 
737
        settings:       Server settings
 
738
        clients:        Set() of Client objects
881
739
        enabled:        Boolean; whether this server is activated yet
882
 
        interface:      None or a network interface name (string)
883
 
        use_ipv6:       Boolean; to use IPv6 or not
884
 
        ----
885
 
        clients:        set of Client objects
886
 
        gnutls_priority GnuTLS priority string
887
 
        use_dbus:       Boolean; to emit D-Bus signals or not
888
740
    """
889
 
    def __init__(self, server_address, RequestHandlerClass,
890
 
                 interface=None, use_ipv6=True, clients=None,
891
 
                 gnutls_priority=None, use_dbus=True):
 
741
    address_family = socket.AF_INET6
 
742
    def __init__(self, *args, **kwargs):
 
743
        if "settings" in kwargs:
 
744
            self.settings = kwargs["settings"]
 
745
            del kwargs["settings"]
 
746
        if "clients" in kwargs:
 
747
            self.clients = kwargs["clients"]
 
748
            del kwargs["clients"]
892
749
        self.enabled = False
893
 
        self.interface = interface
894
 
        if use_ipv6:
895
 
            self.address_family = socket.AF_INET6
896
 
        self.clients = clients
897
 
        self.use_dbus = use_dbus
898
 
        self.gnutls_priority = gnutls_priority
899
 
        socketserver.TCPServer.__init__(self, server_address,
900
 
                                        RequestHandlerClass)
 
750
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
901
751
    def server_bind(self):
902
752
        """This overrides the normal server_bind() function
903
753
        to bind to an interface if one was specified, and also NOT to
904
754
        bind to an address or port if they were not specified."""
905
 
        if self.interface is not None:
 
755
        if self.settings["interface"]:
 
756
            # 25 is from /usr/include/asm-i486/socket.h
 
757
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
906
758
            try:
907
759
                self.socket.setsockopt(socket.SOL_SOCKET,
908
760
                                       SO_BINDTODEVICE,
909
 
                                       str(self.interface + u'\0'))
 
761
                                       self.settings["interface"])
910
762
            except socket.error, error:
911
763
                if error[0] == errno.EPERM:
912
764
                    logger.error(u"No permission to"
913
765
                                 u" bind to interface %s",
914
 
                                 self.interface)
 
766
                                 self.settings["interface"])
915
767
                else:
916
768
                    raise
917
769
        # Only bind(2) the socket if we really need to.
918
770
        if self.server_address[0] or self.server_address[1]:
919
771
            if not self.server_address[0]:
920
 
                if self.address_family == socket.AF_INET6:
921
 
                    any_address = u"::" # in6addr_any
922
 
                else:
923
 
                    any_address = socket.INADDR_ANY
924
 
                self.server_address = (any_address,
 
772
                in6addr_any = "::"
 
773
                self.server_address = (in6addr_any,
925
774
                                       self.server_address[1])
926
775
            elif not self.server_address[1]:
927
776
                self.server_address = (self.server_address[0],
928
777
                                       0)
929
 
#                 if self.interface:
 
778
#                 if self.settings["interface"]:
930
779
#                     self.server_address = (self.server_address[0],
931
780
#                                            0, # port
932
781
#                                            0, # flowinfo
933
782
#                                            if_nametoindex
934
 
#                                            (self.interface))
935
 
            return socketserver.TCPServer.server_bind(self)
 
783
#                                            (self.settings
 
784
#                                             ["interface"]))
 
785
            return super(IPv6_TCPServer, self).server_bind()
936
786
    def server_activate(self):
937
787
        if self.enabled:
938
 
            return socketserver.TCPServer.server_activate(self)
 
788
            return super(IPv6_TCPServer, self).server_activate()
939
789
    def enable(self):
940
790
        self.enabled = True
941
 
    def handle_ipc(self, source, condition, file_objects={}):
942
 
        condition_names = {
943
 
            gobject.IO_IN: u"IN",   # There is data to read.
944
 
            gobject.IO_OUT: u"OUT", # Data can be written (without
945
 
                                    # blocking).
946
 
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
947
 
            gobject.IO_ERR: u"ERR", # Error condition.
948
 
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
949
 
                                    # broken, usually for pipes and
950
 
                                    # sockets).
951
 
            }
952
 
        conditions_string = ' | '.join(name
953
 
                                       for cond, name in
954
 
                                       condition_names.iteritems()
955
 
                                       if cond & condition)
956
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
957
 
                     conditions_string)
958
 
        
959
 
        # Turn the pipe file descriptor into a Python file object
960
 
        if source not in file_objects:
961
 
            file_objects[source] = os.fdopen(source, u"r", 1)
962
 
        
963
 
        # Read a line from the file object
964
 
        cmdline = file_objects[source].readline()
965
 
        if not cmdline:             # Empty line means end of file
966
 
            # close the IPC pipe
967
 
            file_objects[source].close()
968
 
            del file_objects[source]
969
 
            
970
 
            # Stop calling this function
971
 
            return False
972
 
        
973
 
        logger.debug(u"IPC command: %r", cmdline)
974
 
        
975
 
        # Parse and act on command
976
 
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
977
 
        
978
 
        if cmd == u"NOTFOUND":
979
 
            logger.warning(u"Client not found for fingerprint: %s",
980
 
                           args)
981
 
            if self.use_dbus:
982
 
                # Emit D-Bus signal
983
 
                mandos_dbus_service.ClientNotFound(args)
984
 
        elif cmd == u"INVALID":
985
 
            for client in self.clients:
986
 
                if client.name == args:
987
 
                    logger.warning(u"Client %s is invalid", args)
988
 
                    if self.use_dbus:
989
 
                        # Emit D-Bus signal
990
 
                        client.Rejected()
991
 
                    break
992
 
            else:
993
 
                logger.error(u"Unknown client %s is invalid", args)
994
 
        elif cmd == u"SENDING":
995
 
            for client in self.clients:
996
 
                if client.name == args:
997
 
                    logger.info(u"Sending secret to %s", client.name)
998
 
                    client.checked_ok()
999
 
                    if self.use_dbus:
1000
 
                        # Emit D-Bus signal
1001
 
                        client.ReceivedSecret()
1002
 
                    break
1003
 
            else:
1004
 
                logger.error(u"Sending secret to unknown client %s",
1005
 
                             args)
1006
 
        else:
1007
 
            logger.error(u"Unknown IPC command: %r", cmdline)
1008
 
        
1009
 
        # Keep calling this function
1010
 
        return True
1011
791
 
1012
792
 
1013
793
def string_to_delta(interval):
1014
794
    """Parse a string and return a datetime.timedelta
1015
795
    
1016
 
    >>> string_to_delta(u'7d')
 
796
    >>> string_to_delta('7d')
1017
797
    datetime.timedelta(7)
1018
 
    >>> string_to_delta(u'60s')
 
798
    >>> string_to_delta('60s')
1019
799
    datetime.timedelta(0, 60)
1020
 
    >>> string_to_delta(u'60m')
 
800
    >>> string_to_delta('60m')
1021
801
    datetime.timedelta(0, 3600)
1022
 
    >>> string_to_delta(u'24h')
 
802
    >>> string_to_delta('24h')
1023
803
    datetime.timedelta(1)
1024
804
    >>> string_to_delta(u'1w')
1025
805
    datetime.timedelta(7)
1026
 
    >>> string_to_delta(u'5m 30s')
 
806
    >>> string_to_delta('5m 30s')
1027
807
    datetime.timedelta(0, 330)
1028
808
    """
1029
809
    timevalue = datetime.timedelta(0)
1073
853
        raise AvahiGroupError(u"State changed: %s" % unicode(error))
1074
854
 
1075
855
def if_nametoindex(interface):
1076
 
    """Call the C function if_nametoindex(), or equivalent
1077
 
    
1078
 
    Note: This function cannot accept a unicode string."""
 
856
    """Call the C function if_nametoindex(), or equivalent"""
1079
857
    global if_nametoindex
1080
858
    try:
1081
859
        if_nametoindex = (ctypes.cdll.LoadLibrary
1082
 
                          (ctypes.util.find_library(u"c"))
 
860
                          (ctypes.util.find_library("c"))
1083
861
                          .if_nametoindex)
1084
862
    except (OSError, AttributeError):
1085
 
        logger.warning(u"Doing if_nametoindex the hard way")
 
863
        if "struct" not in sys.modules:
 
864
            import struct
 
865
        if "fcntl" not in sys.modules:
 
866
            import fcntl
1086
867
        def if_nametoindex(interface):
1087
868
            "Get an interface index the hard way, i.e. using fcntl()"
1088
869
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1089
870
            with closing(socket.socket()) as s:
1090
871
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1091
 
                                    struct.pack(str(u"16s16x"),
1092
 
                                                interface))
1093
 
            interface_index = struct.unpack(str(u"I"),
1094
 
                                            ifreq[16:20])[0]
 
872
                                    struct.pack("16s16x", interface))
 
873
            interface_index = struct.unpack("I", ifreq[16:20])[0]
1095
874
            return interface_index
1096
875
    return if_nametoindex(interface)
1097
876
 
1098
877
 
1099
878
def daemon(nochdir = False, noclose = False):
1100
879
    """See daemon(3).  Standard BSD Unix function.
1101
 
    
1102
880
    This should really exist as os.daemon, but it doesn't (yet)."""
1103
881
    if os.fork():
1104
882
        sys.exit()
1105
883
    os.setsid()
1106
884
    if not nochdir:
1107
 
        os.chdir(u"/")
 
885
        os.chdir("/")
1108
886
    if os.fork():
1109
887
        sys.exit()
1110
888
    if not noclose:
1112
890
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1113
891
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1114
892
            raise OSError(errno.ENODEV,
1115
 
                          u"/dev/null not a character device")
 
893
                          "/dev/null not a character device")
1116
894
        os.dup2(null, sys.stdin.fileno())
1117
895
        os.dup2(null, sys.stdout.fileno())
1118
896
        os.dup2(null, sys.stderr.fileno())
1121
899
 
1122
900
 
1123
901
def main():
1124
 
    
1125
 
    ######################################################################
1126
 
    # Parsing of options, both command line and config file
1127
 
    
1128
902
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1129
 
    parser.add_option("-i", u"--interface", type=u"string",
1130
 
                      metavar="IF", help=u"Bind to interface IF")
1131
 
    parser.add_option("-a", u"--address", type=u"string",
1132
 
                      help=u"Address to listen for requests on")
1133
 
    parser.add_option("-p", u"--port", type=u"int",
1134
 
                      help=u"Port number to receive requests on")
1135
 
    parser.add_option("--check", action=u"store_true",
1136
 
                      help=u"Run self-test")
1137
 
    parser.add_option("--debug", action=u"store_true",
1138
 
                      help=u"Debug mode; run in foreground and log to"
1139
 
                      u" terminal")
1140
 
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1141
 
                      u" priority string (see GnuTLS documentation)")
1142
 
    parser.add_option("--servicename", type=u"string",
1143
 
                      metavar=u"NAME", help=u"Zeroconf service name")
1144
 
    parser.add_option("--configdir", type=u"string",
1145
 
                      default=u"/etc/mandos", metavar=u"DIR",
1146
 
                      help=u"Directory to search for configuration"
1147
 
                      u" files")
1148
 
    parser.add_option("--no-dbus", action=u"store_false",
1149
 
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
1150
 
                      u" system bus interface")
1151
 
    parser.add_option("--no-ipv6", action=u"store_false",
1152
 
                      dest=u"use_ipv6", help=u"Do not use IPv6")
 
903
    parser.add_option("-i", "--interface", type="string",
 
904
                      metavar="IF", help="Bind to interface IF")
 
905
    parser.add_option("-a", "--address", type="string",
 
906
                      help="Address to listen for requests on")
 
907
    parser.add_option("-p", "--port", type="int",
 
908
                      help="Port number to receive requests on")
 
909
    parser.add_option("--check", action="store_true",
 
910
                      help="Run self-test")
 
911
    parser.add_option("--debug", action="store_true",
 
912
                      help="Debug mode; run in foreground and log to"
 
913
                      " terminal")
 
914
    parser.add_option("--priority", type="string", help="GnuTLS"
 
915
                      " priority string (see GnuTLS documentation)")
 
916
    parser.add_option("--servicename", type="string", metavar="NAME",
 
917
                      help="Zeroconf service name")
 
918
    parser.add_option("--configdir", type="string",
 
919
                      default="/etc/mandos", metavar="DIR",
 
920
                      help="Directory to search for configuration"
 
921
                      " files")
 
922
    parser.add_option("--no-dbus", action="store_false",
 
923
                      dest="use_dbus",
 
924
                      help="Do not provide D-Bus system bus"
 
925
                      " interface")
1153
926
    options = parser.parse_args()[0]
1154
927
    
1155
928
    if options.check:
1158
931
        sys.exit()
1159
932
    
1160
933
    # Default values for config file for server-global settings
1161
 
    server_defaults = { u"interface": u"",
1162
 
                        u"address": u"",
1163
 
                        u"port": u"",
1164
 
                        u"debug": u"False",
1165
 
                        u"priority":
1166
 
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1167
 
                        u"servicename": u"Mandos",
1168
 
                        u"use_dbus": u"True",
1169
 
                        u"use_ipv6": u"True",
 
934
    server_defaults = { "interface": "",
 
935
                        "address": "",
 
936
                        "port": "",
 
937
                        "debug": "False",
 
938
                        "priority":
 
939
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
940
                        "servicename": "Mandos",
 
941
                        "use_dbus": "True",
1170
942
                        }
1171
943
    
1172
944
    # Parse config file for server-global settings
1173
 
    server_config = configparser.SafeConfigParser(server_defaults)
 
945
    server_config = ConfigParser.SafeConfigParser(server_defaults)
1174
946
    del server_defaults
1175
 
    server_config.read(os.path.join(options.configdir,
1176
 
                                    u"mandos.conf"))
 
947
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
1177
948
    # Convert the SafeConfigParser object to a dict
1178
949
    server_settings = server_config.defaults()
1179
950
    # Use the appropriate methods on the non-string config options
1180
 
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
1181
 
        server_settings[option] = server_config.getboolean(u"DEFAULT",
1182
 
                                                           option)
 
951
    server_settings["debug"] = server_config.getboolean("DEFAULT",
 
952
                                                        "debug")
 
953
    server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
 
954
                                                           "use_dbus")
1183
955
    if server_settings["port"]:
1184
 
        server_settings["port"] = server_config.getint(u"DEFAULT",
1185
 
                                                       u"port")
 
956
        server_settings["port"] = server_config.getint("DEFAULT",
 
957
                                                       "port")
1186
958
    del server_config
1187
959
    
1188
960
    # Override the settings from the config file with command line
1189
961
    # options, if set.
1190
 
    for option in (u"interface", u"address", u"port", u"debug",
1191
 
                   u"priority", u"servicename", u"configdir",
1192
 
                   u"use_dbus", u"use_ipv6"):
 
962
    for option in ("interface", "address", "port", "debug",
 
963
                   "priority", "servicename", "configdir",
 
964
                   "use_dbus"):
1193
965
        value = getattr(options, option)
1194
966
        if value is not None:
1195
967
            server_settings[option] = value
1196
968
    del options
1197
 
    # Force all strings to be unicode
1198
 
    for option in server_settings.keys():
1199
 
        if type(server_settings[option]) is str:
1200
 
            server_settings[option] = unicode(server_settings[option])
1201
969
    # Now we have our good server settings in "server_settings"
1202
970
    
1203
 
    ##################################################################
1204
 
    
1205
971
    # For convenience
1206
 
    debug = server_settings[u"debug"]
1207
 
    use_dbus = server_settings[u"use_dbus"]
1208
 
    use_ipv6 = server_settings[u"use_ipv6"]
 
972
    debug = server_settings["debug"]
 
973
    use_dbus = server_settings["use_dbus"]
1209
974
    
1210
975
    if not debug:
1211
976
        syslogger.setLevel(logging.WARNING)
1212
977
        console.setLevel(logging.WARNING)
1213
978
    
1214
 
    if server_settings[u"servicename"] != u"Mandos":
 
979
    if server_settings["servicename"] != "Mandos":
1215
980
        syslogger.setFormatter(logging.Formatter
1216
 
                               (u'Mandos (%s) [%%(process)d]:'
1217
 
                                u' %%(levelname)s: %%(message)s'
1218
 
                                % server_settings[u"servicename"]))
 
981
                               ('Mandos (%s): %%(levelname)s:'
 
982
                                ' %%(message)s'
 
983
                                % server_settings["servicename"]))
1219
984
    
1220
985
    # Parse config file with clients
1221
 
    client_defaults = { u"timeout": u"1h",
1222
 
                        u"interval": u"5m",
1223
 
                        u"checker": u"fping -q -- %%(host)s",
1224
 
                        u"host": u"",
 
986
    client_defaults = { "timeout": "1h",
 
987
                        "interval": "5m",
 
988
                        "checker": "fping -q -- %%(host)s",
 
989
                        "host": "",
1225
990
                        }
1226
 
    client_config = configparser.SafeConfigParser(client_defaults)
1227
 
    client_config.read(os.path.join(server_settings[u"configdir"],
1228
 
                                    u"clients.conf"))
1229
 
    
1230
 
    global mandos_dbus_service
1231
 
    mandos_dbus_service = None
1232
 
    
1233
 
    clients = set()
1234
 
    tcp_server = IPv6_TCPServer((server_settings[u"address"],
1235
 
                                 server_settings[u"port"]),
1236
 
                                ClientHandler,
1237
 
                                interface=
1238
 
                                server_settings[u"interface"],
1239
 
                                use_ipv6=use_ipv6,
1240
 
                                clients=clients,
1241
 
                                gnutls_priority=
1242
 
                                server_settings[u"priority"],
1243
 
                                use_dbus=use_dbus)
1244
 
    pidfilename = u"/var/run/mandos.pid"
 
991
    client_config = ConfigParser.SafeConfigParser(client_defaults)
 
992
    client_config.read(os.path.join(server_settings["configdir"],
 
993
                                    "clients.conf"))
 
994
    
 
995
    clients = Set()
 
996
    tcp_server = IPv6_TCPServer((server_settings["address"],
 
997
                                 server_settings["port"]),
 
998
                                TCP_handler,
 
999
                                settings=server_settings,
 
1000
                                clients=clients)
 
1001
    pidfilename = "/var/run/mandos.pid"
1245
1002
    try:
1246
 
        pidfile = open(pidfilename, u"w")
 
1003
        pidfile = open(pidfilename, "w")
1247
1004
    except IOError:
1248
 
        logger.error(u"Could not open file %r", pidfilename)
 
1005
        logger.error("Could not open file %r", pidfilename)
1249
1006
    
1250
1007
    try:
1251
 
        uid = pwd.getpwnam(u"_mandos").pw_uid
1252
 
        gid = pwd.getpwnam(u"_mandos").pw_gid
 
1008
        uid = pwd.getpwnam("_mandos").pw_uid
 
1009
        gid = pwd.getpwnam("_mandos").pw_gid
1253
1010
    except KeyError:
1254
1011
        try:
1255
 
            uid = pwd.getpwnam(u"mandos").pw_uid
1256
 
            gid = pwd.getpwnam(u"mandos").pw_gid
 
1012
            uid = pwd.getpwnam("mandos").pw_uid
 
1013
            gid = pwd.getpwnam("mandos").pw_gid
1257
1014
        except KeyError:
1258
1015
            try:
1259
 
                uid = pwd.getpwnam(u"nobody").pw_uid
1260
 
                gid = pwd.getpwnam(u"nobody").pw_gid
 
1016
                uid = pwd.getpwnam("nobody").pw_uid
 
1017
                gid = pwd.getpwnam("nogroup").pw_gid
1261
1018
            except KeyError:
1262
1019
                uid = 65534
1263
1020
                gid = 65534
1276
1033
        
1277
1034
        @gnutls.library.types.gnutls_log_func
1278
1035
        def debug_gnutls(level, string):
1279
 
            logger.debug(u"GnuTLS: %s", string[:-1])
 
1036
            logger.debug("GnuTLS: %s", string[:-1])
1280
1037
        
1281
1038
        (gnutls.library.functions
1282
1039
         .gnutls_global_set_log_function(debug_gnutls))
1283
1040
    
1284
1041
    global service
1285
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1286
 
    service = AvahiService(name = server_settings[u"servicename"],
1287
 
                           servicetype = u"_mandos._tcp",
1288
 
                           protocol = protocol)
 
1042
    service = AvahiService(name = server_settings["servicename"],
 
1043
                           servicetype = "_mandos._tcp", )
1289
1044
    if server_settings["interface"]:
1290
1045
        service.interface = (if_nametoindex
1291
 
                             (str(server_settings[u"interface"])))
 
1046
                             (server_settings["interface"]))
1292
1047
    
1293
1048
    global main_loop
1294
1049
    global bus
1304
1059
    if use_dbus:
1305
1060
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1306
1061
    
1307
 
    client_class = Client
1308
 
    if use_dbus:
1309
 
        client_class = ClientDBus
1310
 
    clients.update(set(
1311
 
            client_class(name = section,
1312
 
                         config= dict(client_config.items(section)))
1313
 
            for section in client_config.sections()))
 
1062
    clients.update(Set(Client(name = section,
 
1063
                              config
 
1064
                              = dict(client_config.items(section)),
 
1065
                              use_dbus = use_dbus)
 
1066
                       for section in client_config.sections()))
1314
1067
    if not clients:
1315
1068
        logger.warning(u"No clients defined")
1316
1069
    
1327
1080
        daemon()
1328
1081
    
1329
1082
    try:
1330
 
        with closing(pidfile):
1331
 
            pid = os.getpid()
1332
 
            pidfile.write(str(pid) + "\n")
 
1083
        pid = os.getpid()
 
1084
        pidfile.write(str(pid) + "\n")
 
1085
        pidfile.close()
1333
1086
        del pidfile
1334
1087
    except IOError:
1335
1088
        logger.error(u"Could not write to file %r with PID %d",
1361
1114
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1362
1115
    
1363
1116
    if use_dbus:
1364
 
        class MandosDBusService(dbus.service.Object):
 
1117
        class MandosServer(dbus.service.Object):
1365
1118
            """A D-Bus proxy object"""
1366
1119
            def __init__(self):
1367
 
                dbus.service.Object.__init__(self, bus, u"/")
 
1120
                dbus.service.Object.__init__(self, bus, "/")
1368
1121
            _interface = u"se.bsnet.fukt.Mandos"
1369
1122
            
1370
 
            @dbus.service.signal(_interface, signature=u"oa{sv}")
 
1123
            @dbus.service.signal(_interface, signature="oa{sv}")
1371
1124
            def ClientAdded(self, objpath, properties):
1372
1125
                "D-Bus signal"
1373
1126
                pass
1374
1127
            
1375
 
            @dbus.service.signal(_interface, signature=u"s")
1376
 
            def ClientNotFound(self, fingerprint):
1377
 
                "D-Bus signal"
1378
 
                pass
1379
 
            
1380
 
            @dbus.service.signal(_interface, signature=u"os")
 
1128
            @dbus.service.signal(_interface, signature="os")
1381
1129
            def ClientRemoved(self, objpath, name):
1382
1130
                "D-Bus signal"
1383
1131
                pass
1384
1132
            
1385
 
            @dbus.service.method(_interface, out_signature=u"ao")
 
1133
            @dbus.service.method(_interface, out_signature="ao")
1386
1134
            def GetAllClients(self):
1387
1135
                "D-Bus method"
1388
1136
                return dbus.Array(c.dbus_object_path for c in clients)
1389
1137
            
1390
 
            @dbus.service.method(_interface,
1391
 
                                 out_signature=u"a{oa{sv}}")
 
1138
            @dbus.service.method(_interface, out_signature="a{oa{sv}}")
1392
1139
            def GetAllClientsWithProperties(self):
1393
1140
                "D-Bus method"
1394
1141
                return dbus.Dictionary(
1395
1142
                    ((c.dbus_object_path, c.GetAllProperties())
1396
1143
                     for c in clients),
1397
 
                    signature=u"oa{sv}")
 
1144
                    signature="oa{sv}")
1398
1145
            
1399
 
            @dbus.service.method(_interface, in_signature=u"o")
 
1146
            @dbus.service.method(_interface, in_signature="o")
1400
1147
            def RemoveClient(self, object_path):
1401
1148
                "D-Bus method"
1402
1149
                for c in clients:
1403
1150
                    if c.dbus_object_path == object_path:
1404
1151
                        clients.remove(c)
1405
 
                        c.remove_from_connection()
1406
1152
                        # Don't signal anything except ClientRemoved
1407
 
                        c.disable(signal=False)
 
1153
                        c.use_dbus = False
 
1154
                        c.disable()
1408
1155
                        # Emit D-Bus signal
1409
1156
                        self.ClientRemoved(object_path, c.name)
1410
1157
                        return
1412
1159
            
1413
1160
            del _interface
1414
1161
        
1415
 
        mandos_dbus_service = MandosDBusService()
 
1162
        mandos_server = MandosServer()
1416
1163
    
1417
1164
    for client in clients:
1418
1165
        if use_dbus:
1419
1166
            # Emit D-Bus signal
1420
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path,
1421
 
                                            client.GetAllProperties())
 
1167
            mandos_server.ClientAdded(client.dbus_object_path,
 
1168
                                      client.GetAllProperties())
1422
1169
        client.enable()
1423
1170
    
1424
1171
    tcp_server.enable()
1426
1173
    
1427
1174
    # Find out what port we got
1428
1175
    service.port = tcp_server.socket.getsockname()[1]
1429
 
    if use_ipv6:
1430
 
        logger.info(u"Now listening on address %r, port %d,"
1431
 
                    " flowinfo %d, scope_id %d"
1432
 
                    % tcp_server.socket.getsockname())
1433
 
    else:                       # IPv4
1434
 
        logger.info(u"Now listening on address %r, port %d"
1435
 
                    % tcp_server.socket.getsockname())
 
1176
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
 
1177
                u" scope_id %d" % tcp_server.socket.getsockname())
1436
1178
    
1437
1179
    #service.interface = tcp_server.socket.getsockname()[3]
1438
1180
    
1439
1181
    try:
1440
1182
        # From the Avahi example code
1441
 
        server.connect_to_signal(u"StateChanged", server_state_changed)
 
1183
        server.connect_to_signal("StateChanged", server_state_changed)
1442
1184
        try:
1443
1185
            server_state_changed(server.GetState())
1444
1186
        except dbus.exceptions.DBusException, error:
1459
1201
    except KeyboardInterrupt:
1460
1202
        if debug:
1461
1203
            print >> sys.stderr
1462
 
        logger.debug(u"Server received KeyboardInterrupt")
1463
 
    logger.debug(u"Server exiting")
 
1204
        logger.debug("Server received KeyboardInterrupt")
 
1205
    logger.debug("Server exiting")
1464
1206
 
1465
1207
if __name__ == '__main__':
1466
1208
    main()