/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2009-04-17 01:16:37 UTC
  • Revision ID: teddy@fukt.bsnet.se-20090417011637-bcqjpm7fskm4370v
Code cleanup and one bug fix.

* mandos (Client.enable): Bug fix: Do not enable if already enabled.
  (MandosServer.__init__): Create empty set of clients if none passed.
  (main): Do not create clients set; do not pass a clients set to
          MandosServer.  Use tcp_server.clients throughout.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# methods "add" and "remove" in the "AvahiService" class, the
10
 
# "server_state_changed" and "entry_group_state_changed" functions,
11
 
# and some lines in "main".
 
9
# methods "add", "remove", "server_state_changed",
 
10
# "entry_group_state_changed", "cleanup", and "activate" in the
 
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
 
34
34
from __future__ import division, with_statement, absolute_import
35
35
 
36
 
import SocketServer
 
36
import SocketServer as socketserver
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
 
import ConfigParser
 
47
import ConfigParser as configparser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
 
from sets import Set
53
52
import subprocess
54
53
import atexit
55
54
import stat
57
56
import logging.handlers
58
57
import pwd
59
58
from contextlib import closing
 
59
import struct
 
60
import fcntl
 
61
import functools
60
62
 
61
63
import dbus
62
64
import dbus.service
66
68
import ctypes
67
69
import ctypes.util
68
70
 
 
71
try:
 
72
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
 
73
except AttributeError:
 
74
    try:
 
75
        from IN import SO_BINDTODEVICE
 
76
    except ImportError:
 
77
        SO_BINDTODEVICE = None
 
78
 
 
79
 
69
80
version = "1.0.8"
70
81
 
71
 
logger = logging.Logger('mandos')
 
82
logger = logging.Logger(u'mandos')
72
83
syslogger = (logging.handlers.SysLogHandler
73
84
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
85
              address = "/dev/log"))
75
86
syslogger.setFormatter(logging.Formatter
76
 
                       ('Mandos [%(process)d]: %(levelname)s:'
77
 
                        ' %(message)s'))
 
87
                       (u'Mandos [%(process)d]: %(levelname)s:'
 
88
                        u' %(message)s'))
78
89
logger.addHandler(syslogger)
79
90
 
80
91
console = logging.StreamHandler()
81
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
 
                                       ' %(levelname)s: %(message)s'))
 
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
 
93
                                       u' %(levelname)s:'
 
94
                                       u' %(message)s'))
83
95
logger.addHandler(console)
84
96
 
85
97
class AvahiError(Exception):
98
110
 
99
111
class AvahiService(object):
100
112
    """An Avahi (Zeroconf) service.
 
113
    
101
114
    Attributes:
102
115
    interface: integer; avahi.IF_UNSPEC or an interface index.
103
116
               Used to optionally bind to the specified interface.
104
 
    name: string; Example: 'Mandos'
105
 
    type: string; Example: '_mandos._tcp'.
 
117
    name: string; Example: u'Mandos'
 
118
    type: string; Example: u'_mandos._tcp'.
106
119
                  See <http://www.dns-sd.org/ServiceTypes.html>
107
120
    port: integer; what port to announce
108
121
    TXT: list of strings; TXT record for the service
111
124
    max_renames: integer; maximum number of renames
112
125
    rename_count: integer; counter so we only rename after collisions
113
126
                  a sensible number of times
 
127
    group: D-Bus Entry Group
 
128
    server: D-Bus Server
 
129
    bus: dbus.SystemBus()
114
130
    """
115
131
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
132
                 servicetype = None, port = None, TXT = None,
117
 
                 domain = "", host = "", max_renames = 32768,
118
 
                 protocol = avahi.PROTO_UNSPEC):
 
133
                 domain = u"", host = u"", max_renames = 32768,
 
134
                 protocol = avahi.PROTO_UNSPEC, bus = None):
119
135
        self.interface = interface
120
136
        self.name = name
121
137
        self.type = servicetype
126
142
        self.rename_count = 0
127
143
        self.max_renames = max_renames
128
144
        self.protocol = protocol
 
145
        self.group = None       # our entry group
 
146
        self.server = None
 
147
        self.bus = bus
129
148
    def rename(self):
130
149
        """Derived from the Avahi example code"""
131
150
        if self.rename_count >= self.max_renames:
133
152
                            u" after %i retries, exiting.",
134
153
                            self.rename_count)
135
154
            raise AvahiServiceError(u"Too many renames")
136
 
        self.name = server.GetAlternativeServiceName(self.name)
 
155
        self.name = self.server.GetAlternativeServiceName(self.name)
137
156
        logger.info(u"Changing Zeroconf service name to %r ...",
138
 
                    str(self.name))
 
157
                    unicode(self.name))
139
158
        syslogger.setFormatter(logging.Formatter
140
 
                               ('Mandos (%s) [%%(process)d]:'
141
 
                                ' %%(levelname)s: %%(message)s'
 
159
                               (u'Mandos (%s) [%%(process)d]:'
 
160
                                u' %%(levelname)s: %%(message)s'
142
161
                                % self.name))
143
162
        self.remove()
144
163
        self.add()
145
164
        self.rename_count += 1
146
165
    def remove(self):
147
166
        """Derived from the Avahi example code"""
148
 
        if group is not None:
149
 
            group.Reset()
 
167
        if self.group is not None:
 
168
            self.group.Reset()
150
169
    def add(self):
151
170
        """Derived from the Avahi example code"""
152
 
        global group
153
 
        if group is None:
154
 
            group = dbus.Interface(bus.get_object
155
 
                                   (avahi.DBUS_NAME,
156
 
                                    server.EntryGroupNew()),
157
 
                                   avahi.DBUS_INTERFACE_ENTRY_GROUP)
158
 
            group.connect_to_signal('StateChanged',
159
 
                                    entry_group_state_changed)
 
171
        if self.group is None:
 
172
            self.group = dbus.Interface(
 
173
                self.bus.get_object(avahi.DBUS_NAME,
 
174
                                    self.server.EntryGroupNew()),
 
175
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
176
            self.group.connect_to_signal('StateChanged',
 
177
                                         self.entry_group_state_changed)
160
178
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
161
 
                     service.name, service.type)
162
 
        group.AddService(
163
 
                self.interface,         # interface
164
 
                self.protocol,          # protocol
165
 
                dbus.UInt32(0),         # flags
166
 
                self.name, self.type,
167
 
                self.domain, self.host,
168
 
                dbus.UInt16(self.port),
169
 
                avahi.string_array_to_txt_array(self.TXT))
170
 
        group.Commit()
171
 
 
172
 
# From the Avahi example code:
173
 
group = None                            # our entry group
174
 
# End of Avahi example code
175
 
 
176
 
 
177
 
def _datetime_to_dbus(dt, variant_level=0):
178
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
179
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
180
 
 
181
 
 
182
 
class Client(dbus.service.Object):
 
179
                     self.name, self.type)
 
180
        self.group.AddService(
 
181
            self.interface,
 
182
            self.protocol,
 
183
            dbus.UInt32(0),     # flags
 
184
            self.name, self.type,
 
185
            self.domain, self.host,
 
186
            dbus.UInt16(self.port),
 
187
            avahi.string_array_to_txt_array(self.TXT))
 
188
        self.group.Commit()
 
189
    def entry_group_state_changed(self, state, error):
 
190
        """Derived from the Avahi example code"""
 
191
        logger.debug(u"Avahi state change: %i", state)
 
192
        
 
193
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
194
            logger.debug(u"Zeroconf service established.")
 
195
        elif state == avahi.ENTRY_GROUP_COLLISION:
 
196
            logger.warning(u"Zeroconf service name collision.")
 
197
            self.rename()
 
198
        elif state == avahi.ENTRY_GROUP_FAILURE:
 
199
            logger.critical(u"Avahi: Error in group state changed %s",
 
200
                            unicode(error))
 
201
            raise AvahiGroupError(u"State changed: %s"
 
202
                                  % unicode(error))
 
203
    def cleanup(self):
 
204
        """Derived from the Avahi example code"""
 
205
        if self.group is not None:
 
206
            self.group.Free()
 
207
            self.group = None
 
208
    def server_state_changed(self, state):
 
209
        """Derived from the Avahi example code"""
 
210
        if state == avahi.SERVER_COLLISION:
 
211
            logger.error(u"Zeroconf server name collision")
 
212
            self.remove()
 
213
        elif state == avahi.SERVER_RUNNING:
 
214
            self.add()
 
215
    def activate(self):
 
216
        """Derived from the Avahi example code"""
 
217
        if self.server is None:
 
218
            self.server = dbus.Interface(
 
219
                self.bus.get_object(avahi.DBUS_NAME,
 
220
                                    avahi.DBUS_PATH_SERVER),
 
221
                avahi.DBUS_INTERFACE_SERVER)
 
222
        self.server.connect_to_signal(u"StateChanged",
 
223
                                 self.server_state_changed)
 
224
        self.server_state_changed(self.server.GetState())
 
225
 
 
226
 
 
227
class Client(object):
183
228
    """A representation of a client host served by this server.
 
229
    
184
230
    Attributes:
185
231
    name:       string; from the config file, used in log messages and
186
232
                        D-Bus identifiers
207
253
                     runtime with vars(self) as dict, so that for
208
254
                     instance %(name)s can be used in the command.
209
255
    current_checker_command: string; current running checker_command
210
 
    use_dbus: bool(); Whether to provide D-Bus interface and signals
211
 
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
212
256
    """
 
257
    
 
258
    @staticmethod
 
259
    def _datetime_to_milliseconds(dt):
 
260
        "Convert a datetime.datetime() to milliseconds"
 
261
        return ((dt.days * 24 * 60 * 60 * 1000)
 
262
                + (dt.seconds * 1000)
 
263
                + (dt.microseconds // 1000))
 
264
    
213
265
    def timeout_milliseconds(self):
214
266
        "Return the 'timeout' attribute in milliseconds"
215
 
        return ((self.timeout.days * 24 * 60 * 60 * 1000)
216
 
                + (self.timeout.seconds * 1000)
217
 
                + (self.timeout.microseconds // 1000))
 
267
        return self._datetime_to_milliseconds(self.timeout)
218
268
    
219
269
    def interval_milliseconds(self):
220
270
        "Return the 'interval' attribute in milliseconds"
221
 
        return ((self.interval.days * 24 * 60 * 60 * 1000)
222
 
                + (self.interval.seconds * 1000)
223
 
                + (self.interval.microseconds // 1000))
 
271
        return self._datetime_to_milliseconds(self.interval)
224
272
    
225
 
    def __init__(self, name = None, disable_hook=None, config=None,
226
 
                 use_dbus=True):
 
273
    def __init__(self, name = None, disable_hook=None, config=None):
227
274
        """Note: the 'checker' key in 'config' sets the
228
275
        'checker_command' attribute and *not* the 'checker'
229
276
        attribute."""
231
278
        if config is None:
232
279
            config = {}
233
280
        logger.debug(u"Creating client %r", self.name)
234
 
        self.use_dbus = False   # During __init__
235
281
        # Uppercase and remove spaces from fingerprint for later
236
282
        # comparison purposes with return value from the fingerprint()
237
283
        # function
238
 
        self.fingerprint = (config["fingerprint"].upper()
 
284
        self.fingerprint = (config[u"fingerprint"].upper()
239
285
                            .replace(u" ", u""))
240
286
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
241
 
        if "secret" in config:
242
 
            self.secret = config["secret"].decode(u"base64")
243
 
        elif "secfile" in config:
 
287
        if u"secret" in config:
 
288
            self.secret = config[u"secret"].decode(u"base64")
 
289
        elif u"secfile" in config:
244
290
            with closing(open(os.path.expanduser
245
291
                              (os.path.expandvars
246
 
                               (config["secfile"])))) as secfile:
 
292
                               (config[u"secfile"])))) as secfile:
247
293
                self.secret = secfile.read()
248
294
        else:
249
295
            raise TypeError(u"No secret or secfile for client %s"
250
296
                            % self.name)
251
 
        self.host = config.get("host", "")
 
297
        self.host = config.get(u"host", u"")
252
298
        self.created = datetime.datetime.utcnow()
253
299
        self.enabled = False
254
300
        self.last_enabled = None
255
301
        self.last_checked_ok = None
256
 
        self.timeout = string_to_delta(config["timeout"])
257
 
        self.interval = string_to_delta(config["interval"])
 
302
        self.timeout = string_to_delta(config[u"timeout"])
 
303
        self.interval = string_to_delta(config[u"interval"])
258
304
        self.disable_hook = disable_hook
259
305
        self.checker = None
260
306
        self.checker_initiator_tag = None
261
307
        self.disable_initiator_tag = None
262
308
        self.checker_callback_tag = None
263
 
        self.checker_command = config["checker"]
 
309
        self.checker_command = config[u"checker"]
264
310
        self.current_checker_command = None
265
311
        self.last_connect = None
266
 
        # Only now, when this client is initialized, can it show up on
267
 
        # the D-Bus
268
 
        self.use_dbus = use_dbus
269
 
        if self.use_dbus:
270
 
            self.dbus_object_path = (dbus.ObjectPath
271
 
                                     ("/clients/"
272
 
                                      + self.name.replace(".", "_")))
273
 
            dbus.service.Object.__init__(self, bus,
274
 
                                         self.dbus_object_path)
275
312
    
276
313
    def enable(self):
277
314
        """Start this client's checker and timeout hooks"""
 
315
        if getattr(self, u"enabled", False):
 
316
            # Already enabled
 
317
            return
278
318
        self.last_enabled = datetime.datetime.utcnow()
279
319
        # Schedule a new checker to be started an 'interval' from now,
280
320
        # and every interval from then on.
288
328
                                   (self.timeout_milliseconds(),
289
329
                                    self.disable))
290
330
        self.enabled = True
291
 
        if self.use_dbus:
292
 
            # Emit D-Bus signals
293
 
            self.PropertyChanged(dbus.String(u"enabled"),
294
 
                                 dbus.Boolean(True, variant_level=1))
295
 
            self.PropertyChanged(dbus.String(u"last_enabled"),
296
 
                                 (_datetime_to_dbus(self.last_enabled,
297
 
                                                    variant_level=1)))
298
331
    
299
332
    def disable(self):
300
333
        """Disable this client."""
301
334
        if not getattr(self, "enabled", False):
302
335
            return False
303
336
        logger.info(u"Disabling client %s", self.name)
304
 
        if getattr(self, "disable_initiator_tag", False):
 
337
        if getattr(self, u"disable_initiator_tag", False):
305
338
            gobject.source_remove(self.disable_initiator_tag)
306
339
            self.disable_initiator_tag = None
307
 
        if getattr(self, "checker_initiator_tag", False):
 
340
        if getattr(self, u"checker_initiator_tag", False):
308
341
            gobject.source_remove(self.checker_initiator_tag)
309
342
            self.checker_initiator_tag = None
310
343
        self.stop_checker()
311
344
        if self.disable_hook:
312
345
            self.disable_hook(self)
313
346
        self.enabled = False
314
 
        if self.use_dbus:
315
 
            # Emit D-Bus signal
316
 
            self.PropertyChanged(dbus.String(u"enabled"),
317
 
                                 dbus.Boolean(False, variant_level=1))
318
347
        # Do not run this again if called by a gobject.timeout_add
319
348
        return False
320
349
    
326
355
        """The checker has completed, so take appropriate actions."""
327
356
        self.checker_callback_tag = None
328
357
        self.checker = None
329
 
        if self.use_dbus:
330
 
            # Emit D-Bus signal
331
 
            self.PropertyChanged(dbus.String(u"checker_running"),
332
 
                                 dbus.Boolean(False, variant_level=1))
333
358
        if os.WIFEXITED(condition):
334
359
            exitstatus = os.WEXITSTATUS(condition)
335
360
            if exitstatus == 0:
339
364
            else:
340
365
                logger.info(u"Checker for %(name)s failed",
341
366
                            vars(self))
342
 
            if self.use_dbus:
343
 
                # Emit D-Bus signal
344
 
                self.CheckerCompleted(dbus.Int16(exitstatus),
345
 
                                      dbus.Int64(condition),
346
 
                                      dbus.String(command))
347
367
        else:
348
368
            logger.warning(u"Checker for %(name)s crashed?",
349
369
                           vars(self))
350
 
            if self.use_dbus:
351
 
                # Emit D-Bus signal
352
 
                self.CheckerCompleted(dbus.Int16(-1),
353
 
                                      dbus.Int64(condition),
354
 
                                      dbus.String(command))
355
370
    
356
371
    def checked_ok(self):
357
372
        """Bump up the timeout for this client.
 
373
        
358
374
        This should only be called when the client has been seen,
359
375
        alive and well.
360
376
        """
363
379
        self.disable_initiator_tag = (gobject.timeout_add
364
380
                                      (self.timeout_milliseconds(),
365
381
                                       self.disable))
366
 
        if self.use_dbus:
367
 
            # Emit D-Bus signal
368
 
            self.PropertyChanged(
369
 
                dbus.String(u"last_checked_ok"),
370
 
                (_datetime_to_dbus(self.last_checked_ok,
371
 
                                   variant_level=1)))
372
382
    
373
383
    def start_checker(self):
374
384
        """Start a new checker subprocess if one is not running.
 
385
        
375
386
        If a checker already exists, leave it running and do
376
387
        nothing."""
377
388
        # The reason for not killing a running checker is that if we
387
398
        if self.checker is not None:
388
399
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
389
400
            if pid:
390
 
                logger.warning("Checker was a zombie")
 
401
                logger.warning(u"Checker was a zombie")
391
402
                gobject.source_remove(self.checker_callback_tag)
392
403
                self.checker_callback(pid, status,
393
404
                                      self.current_checker_command)
398
409
                command = self.checker_command % self.host
399
410
            except TypeError:
400
411
                # Escape attributes for the shell
401
 
                escaped_attrs = dict((key, re.escape(str(val)))
 
412
                escaped_attrs = dict((key,
 
413
                                      re.escape(unicode(str(val),
 
414
                                                        errors=
 
415
                                                        u'replace')))
402
416
                                     for key, val in
403
417
                                     vars(self).iteritems())
404
418
                try:
407
421
                    logger.error(u'Could not format string "%s":'
408
422
                                 u' %s', self.checker_command, error)
409
423
                    return True # Try again later
410
 
                self.current_checker_command = command
 
424
            self.current_checker_command = command
411
425
            try:
412
426
                logger.info(u"Starting checker %r for %s",
413
427
                            command, self.name)
417
431
                # always replaced by /dev/null.)
418
432
                self.checker = subprocess.Popen(command,
419
433
                                                close_fds=True,
420
 
                                                shell=True, cwd="/")
421
 
                if self.use_dbus:
422
 
                    # Emit D-Bus signal
423
 
                    self.CheckerStarted(command)
424
 
                    self.PropertyChanged(
425
 
                        dbus.String("checker_running"),
426
 
                        dbus.Boolean(True, variant_level=1))
 
434
                                                shell=True, cwd=u"/")
427
435
                self.checker_callback_tag = (gobject.child_watch_add
428
436
                                             (self.checker.pid,
429
437
                                              self.checker_callback,
445
453
        if self.checker_callback_tag:
446
454
            gobject.source_remove(self.checker_callback_tag)
447
455
            self.checker_callback_tag = None
448
 
        if getattr(self, "checker", None) is None:
 
456
        if getattr(self, u"checker", None) is None:
449
457
            return
450
458
        logger.debug(u"Stopping checker for %(name)s", vars(self))
451
459
        try:
457
465
            if error.errno != errno.ESRCH: # No such process
458
466
                raise
459
467
        self.checker = None
460
 
        if self.use_dbus:
461
 
            self.PropertyChanged(dbus.String(u"checker_running"),
462
 
                                 dbus.Boolean(False, variant_level=1))
463
468
    
464
469
    def still_valid(self):
465
470
        """Has the timeout not yet passed for this client?"""
466
 
        if not getattr(self, "enabled", False):
 
471
        if not getattr(self, u"enabled", False):
467
472
            return False
468
473
        now = datetime.datetime.utcnow()
469
474
        if self.last_checked_ok is None:
470
475
            return now < (self.created + self.timeout)
471
476
        else:
472
477
            return now < (self.last_checked_ok + self.timeout)
 
478
 
 
479
 
 
480
class ClientDBus(Client, dbus.service.Object):
 
481
    """A Client class using D-Bus
 
482
    
 
483
    Attributes:
 
484
    dbus_object_path: dbus.ObjectPath
 
485
    bus: dbus.SystemBus()
 
486
    """
 
487
    # dbus.service.Object doesn't use super(), so we can't either.
 
488
    
 
489
    def __init__(self, bus = None, *args, **kwargs):
 
490
        self.bus = bus
 
491
        Client.__init__(self, *args, **kwargs)
 
492
        # Only now, when this client is initialized, can it show up on
 
493
        # the D-Bus
 
494
        self.dbus_object_path = (dbus.ObjectPath
 
495
                                 (u"/clients/"
 
496
                                  + self.name.replace(u".", u"_")))
 
497
        dbus.service.Object.__init__(self, self.bus,
 
498
                                     self.dbus_object_path)
 
499
    
 
500
    @staticmethod
 
501
    def _datetime_to_dbus(dt, variant_level=0):
 
502
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
503
        return dbus.String(dt.isoformat(),
 
504
                           variant_level=variant_level)
 
505
    
 
506
    def enable(self):
 
507
        oldstate = getattr(self, u"enabled", False)
 
508
        r = Client.enable(self)
 
509
        if oldstate != self.enabled:
 
510
            # Emit D-Bus signals
 
511
            self.PropertyChanged(dbus.String(u"enabled"),
 
512
                                 dbus.Boolean(True, variant_level=1))
 
513
            self.PropertyChanged(
 
514
                dbus.String(u"last_enabled"),
 
515
                self._datetime_to_dbus(self.last_enabled,
 
516
                                       variant_level=1))
 
517
        return r
 
518
    
 
519
    def disable(self, signal = True):
 
520
        oldstate = getattr(self, u"enabled", False)
 
521
        r = Client.disable(self)
 
522
        if signal and oldstate != self.enabled:
 
523
            # Emit D-Bus signal
 
524
            self.PropertyChanged(dbus.String(u"enabled"),
 
525
                                 dbus.Boolean(False, variant_level=1))
 
526
        return r
 
527
    
 
528
    def __del__(self, *args, **kwargs):
 
529
        try:
 
530
            self.remove_from_connection()
 
531
        except LookupError:
 
532
            pass
 
533
        if hasattr(dbus.service.Object, u"__del__"):
 
534
            dbus.service.Object.__del__(self, *args, **kwargs)
 
535
        Client.__del__(self, *args, **kwargs)
 
536
    
 
537
    def checker_callback(self, pid, condition, command,
 
538
                         *args, **kwargs):
 
539
        self.checker_callback_tag = None
 
540
        self.checker = None
 
541
        # Emit D-Bus signal
 
542
        self.PropertyChanged(dbus.String(u"checker_running"),
 
543
                             dbus.Boolean(False, variant_level=1))
 
544
        if os.WIFEXITED(condition):
 
545
            exitstatus = os.WEXITSTATUS(condition)
 
546
            # Emit D-Bus signal
 
547
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
548
                                  dbus.Int64(condition),
 
549
                                  dbus.String(command))
 
550
        else:
 
551
            # Emit D-Bus signal
 
552
            self.CheckerCompleted(dbus.Int16(-1),
 
553
                                  dbus.Int64(condition),
 
554
                                  dbus.String(command))
 
555
        
 
556
        return Client.checker_callback(self, pid, condition, command,
 
557
                                       *args, **kwargs)
 
558
    
 
559
    def checked_ok(self, *args, **kwargs):
 
560
        r = Client.checked_ok(self, *args, **kwargs)
 
561
        # Emit D-Bus signal
 
562
        self.PropertyChanged(
 
563
            dbus.String(u"last_checked_ok"),
 
564
            (self._datetime_to_dbus(self.last_checked_ok,
 
565
                                    variant_level=1)))
 
566
        return r
 
567
    
 
568
    def start_checker(self, *args, **kwargs):
 
569
        old_checker = self.checker
 
570
        if self.checker is not None:
 
571
            old_checker_pid = self.checker.pid
 
572
        else:
 
573
            old_checker_pid = None
 
574
        r = Client.start_checker(self, *args, **kwargs)
 
575
        # Only if new checker process was started
 
576
        if (self.checker is not None
 
577
            and old_checker_pid != self.checker.pid):
 
578
            # Emit D-Bus signal
 
579
            self.CheckerStarted(self.current_checker_command)
 
580
            self.PropertyChanged(
 
581
                dbus.String(u"checker_running"),
 
582
                dbus.Boolean(True, variant_level=1))
 
583
        return r
 
584
    
 
585
    def stop_checker(self, *args, **kwargs):
 
586
        old_checker = getattr(self, u"checker", None)
 
587
        r = Client.stop_checker(self, *args, **kwargs)
 
588
        if (old_checker is not None
 
589
            and getattr(self, u"checker", None) is None):
 
590
            self.PropertyChanged(dbus.String(u"checker_running"),
 
591
                                 dbus.Boolean(False, variant_level=1))
 
592
        return r
473
593
    
474
594
    ## D-Bus methods & signals
475
595
    _interface = u"se.bsnet.fukt.Mandos.Client"
476
596
    
477
597
    # CheckedOK - method
478
 
    CheckedOK = dbus.service.method(_interface)(checked_ok)
479
 
    CheckedOK.__name__ = "CheckedOK"
 
598
    @dbus.service.method(_interface)
 
599
    def CheckedOK(self):
 
600
        return self.checked_ok()
480
601
    
481
602
    # CheckerCompleted - signal
482
 
    @dbus.service.signal(_interface, signature="nxs")
 
603
    @dbus.service.signal(_interface, signature=u"nxs")
483
604
    def CheckerCompleted(self, exitcode, waitstatus, command):
484
605
        "D-Bus signal"
485
606
        pass
486
607
    
487
608
    # CheckerStarted - signal
488
 
    @dbus.service.signal(_interface, signature="s")
 
609
    @dbus.service.signal(_interface, signature=u"s")
489
610
    def CheckerStarted(self, command):
490
611
        "D-Bus signal"
491
612
        pass
492
613
    
493
614
    # GetAllProperties - method
494
 
    @dbus.service.method(_interface, out_signature="a{sv}")
 
615
    @dbus.service.method(_interface, out_signature=u"a{sv}")
495
616
    def GetAllProperties(self):
496
617
        "D-Bus method"
497
618
        return dbus.Dictionary({
498
 
                dbus.String("name"):
 
619
                dbus.String(u"name"):
499
620
                    dbus.String(self.name, variant_level=1),
500
 
                dbus.String("fingerprint"):
 
621
                dbus.String(u"fingerprint"):
501
622
                    dbus.String(self.fingerprint, variant_level=1),
502
 
                dbus.String("host"):
 
623
                dbus.String(u"host"):
503
624
                    dbus.String(self.host, variant_level=1),
504
 
                dbus.String("created"):
505
 
                    _datetime_to_dbus(self.created, variant_level=1),
506
 
                dbus.String("last_enabled"):
507
 
                    (_datetime_to_dbus(self.last_enabled,
508
 
                                       variant_level=1)
 
625
                dbus.String(u"created"):
 
626
                    self._datetime_to_dbus(self.created,
 
627
                                           variant_level=1),
 
628
                dbus.String(u"last_enabled"):
 
629
                    (self._datetime_to_dbus(self.last_enabled,
 
630
                                            variant_level=1)
509
631
                     if self.last_enabled is not None
510
632
                     else dbus.Boolean(False, variant_level=1)),
511
 
                dbus.String("enabled"):
 
633
                dbus.String(u"enabled"):
512
634
                    dbus.Boolean(self.enabled, variant_level=1),
513
 
                dbus.String("last_checked_ok"):
514
 
                    (_datetime_to_dbus(self.last_checked_ok,
515
 
                                       variant_level=1)
 
635
                dbus.String(u"last_checked_ok"):
 
636
                    (self._datetime_to_dbus(self.last_checked_ok,
 
637
                                            variant_level=1)
516
638
                     if self.last_checked_ok is not None
517
639
                     else dbus.Boolean (False, variant_level=1)),
518
 
                dbus.String("timeout"):
 
640
                dbus.String(u"timeout"):
519
641
                    dbus.UInt64(self.timeout_milliseconds(),
520
642
                                variant_level=1),
521
 
                dbus.String("interval"):
 
643
                dbus.String(u"interval"):
522
644
                    dbus.UInt64(self.interval_milliseconds(),
523
645
                                variant_level=1),
524
 
                dbus.String("checker"):
 
646
                dbus.String(u"checker"):
525
647
                    dbus.String(self.checker_command,
526
648
                                variant_level=1),
527
 
                dbus.String("checker_running"):
 
649
                dbus.String(u"checker_running"):
528
650
                    dbus.Boolean(self.checker is not None,
529
651
                                 variant_level=1),
530
 
                dbus.String("object_path"):
 
652
                dbus.String(u"object_path"):
531
653
                    dbus.ObjectPath(self.dbus_object_path,
532
654
                                    variant_level=1)
533
 
                }, signature="sv")
 
655
                }, signature=u"sv")
534
656
    
535
657
    # IsStillValid - method
536
 
    IsStillValid = (dbus.service.method(_interface, out_signature="b")
537
 
                    (still_valid))
538
 
    IsStillValid.__name__ = "IsStillValid"
 
658
    @dbus.service.method(_interface, out_signature=u"b")
 
659
    def IsStillValid(self):
 
660
        return self.still_valid()
539
661
    
540
662
    # PropertyChanged - signal
541
 
    @dbus.service.signal(_interface, signature="sv")
 
663
    @dbus.service.signal(_interface, signature=u"sv")
542
664
    def PropertyChanged(self, property, value):
543
665
        "D-Bus signal"
544
666
        pass
556
678
        pass
557
679
    
558
680
    # SetChecker - method
559
 
    @dbus.service.method(_interface, in_signature="s")
 
681
    @dbus.service.method(_interface, in_signature=u"s")
560
682
    def SetChecker(self, checker):
561
683
        "D-Bus setter method"
562
684
        self.checker_command = checker
566
688
                                         variant_level=1))
567
689
    
568
690
    # SetHost - method
569
 
    @dbus.service.method(_interface, in_signature="s")
 
691
    @dbus.service.method(_interface, in_signature=u"s")
570
692
    def SetHost(self, host):
571
693
        "D-Bus setter method"
572
694
        self.host = host
575
697
                             dbus.String(self.host, variant_level=1))
576
698
    
577
699
    # SetInterval - method
578
 
    @dbus.service.method(_interface, in_signature="t")
 
700
    @dbus.service.method(_interface, in_signature=u"t")
579
701
    def SetInterval(self, milliseconds):
580
702
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
581
703
        # Emit D-Bus signal
584
706
                                          variant_level=1)))
585
707
    
586
708
    # SetSecret - method
587
 
    @dbus.service.method(_interface, in_signature="ay",
 
709
    @dbus.service.method(_interface, in_signature=u"ay",
588
710
                         byte_arrays=True)
589
711
    def SetSecret(self, secret):
590
712
        "D-Bus setter method"
591
713
        self.secret = str(secret)
592
714
    
593
715
    # SetTimeout - method
594
 
    @dbus.service.method(_interface, in_signature="t")
 
716
    @dbus.service.method(_interface, in_signature=u"t")
595
717
    def SetTimeout(self, milliseconds):
596
718
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
597
719
        # Emit D-Bus signal
600
722
                                          variant_level=1)))
601
723
    
602
724
    # Enable - method
603
 
    Enable = dbus.service.method(_interface)(enable)
604
 
    Enable.__name__ = "Enable"
 
725
    @dbus.service.method(_interface)
 
726
    def Enable(self):
 
727
        "D-Bus method"
 
728
        self.enable()
605
729
    
606
730
    # StartChecker - method
607
731
    @dbus.service.method(_interface)
616
740
        self.disable()
617
741
    
618
742
    # StopChecker - method
619
 
    StopChecker = dbus.service.method(_interface)(stop_checker)
620
 
    StopChecker.__name__ = "StopChecker"
 
743
    @dbus.service.method(_interface)
 
744
    def StopChecker(self):
 
745
        self.stop_checker()
621
746
    
622
747
    del _interface
623
748
 
624
749
 
625
 
def peer_certificate(session):
626
 
    "Return the peer's OpenPGP certificate as a bytestring"
627
 
    # If not an OpenPGP certificate...
628
 
    if (gnutls.library.functions
629
 
        .gnutls_certificate_type_get(session._c_object)
630
 
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
631
 
        # ...do the normal thing
632
 
        return session.peer_certificate
633
 
    list_size = ctypes.c_uint(1)
634
 
    cert_list = (gnutls.library.functions
635
 
                 .gnutls_certificate_get_peers
636
 
                 (session._c_object, ctypes.byref(list_size)))
637
 
    if not bool(cert_list) and list_size.value != 0:
638
 
        raise gnutls.errors.GNUTLSError("error getting peer"
639
 
                                        " certificate")
640
 
    if list_size.value == 0:
641
 
        return None
642
 
    cert = cert_list[0]
643
 
    return ctypes.string_at(cert.data, cert.size)
644
 
 
645
 
 
646
 
def fingerprint(openpgp):
647
 
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
648
 
    # New GnuTLS "datum" with the OpenPGP public key
649
 
    datum = (gnutls.library.types
650
 
             .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
651
 
                                         ctypes.POINTER
652
 
                                         (ctypes.c_ubyte)),
653
 
                             ctypes.c_uint(len(openpgp))))
654
 
    # New empty GnuTLS certificate
655
 
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
656
 
    (gnutls.library.functions
657
 
     .gnutls_openpgp_crt_init(ctypes.byref(crt)))
658
 
    # Import the OpenPGP public key into the certificate
659
 
    (gnutls.library.functions
660
 
     .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
661
 
                                gnutls.library.constants
662
 
                                .GNUTLS_OPENPGP_FMT_RAW))
663
 
    # Verify the self signature in the key
664
 
    crtverify = ctypes.c_uint()
665
 
    (gnutls.library.functions
666
 
     .gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
667
 
    if crtverify.value != 0:
668
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
669
 
        raise gnutls.errors.CertificateSecurityError("Verify failed")
670
 
    # New buffer for the fingerprint
671
 
    buf = ctypes.create_string_buffer(20)
672
 
    buf_len = ctypes.c_size_t()
673
 
    # Get the fingerprint from the certificate into the buffer
674
 
    (gnutls.library.functions
675
 
     .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
676
 
                                         ctypes.byref(buf_len)))
677
 
    # Deinit the certificate
678
 
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
679
 
    # Convert the buffer to a Python bytestring
680
 
    fpr = ctypes.string_at(buf, buf_len.value)
681
 
    # Convert the bytestring to hexadecimal notation
682
 
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
683
 
    return hex_fpr
684
 
 
685
 
 
686
 
class TCP_handler(SocketServer.BaseRequestHandler, object):
687
 
    """A TCP request handler class.
688
 
    Instantiated by IPv6_TCPServer for each request to handle it.
 
750
class ClientHandler(socketserver.BaseRequestHandler, object):
 
751
    """A class to handle client connections.
 
752
    
 
753
    Instantiated once for each connection to handle it.
689
754
    Note: This will run in its own forked process."""
690
755
    
691
756
    def handle(self):
693
758
                    unicode(self.client_address))
694
759
        logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
695
760
        # Open IPC pipe to parent process
696
 
        with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
 
761
        with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
697
762
            session = (gnutls.connection
698
763
                       .ClientSession(self.request,
699
764
                                      gnutls.connection
713
778
            # no X.509 keys are added to it.  Therefore, we can use it
714
779
            # here despite using OpenPGP certificates.
715
780
            
716
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
717
 
            #                     "+AES-256-CBC", "+SHA1",
718
 
            #                     "+COMP-NULL", "+CTYPE-OPENPGP",
719
 
            #                     "+DHE-DSS"))
 
781
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
 
782
            #                      u"+AES-256-CBC", u"+SHA1",
 
783
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
 
784
            #                      u"+DHE-DSS"))
720
785
            # Use a fallback default, since this MUST be set.
721
 
            priority = self.server.settings.get("priority", "NORMAL")
 
786
            priority = self.server.gnutls_priority
 
787
            if priority is None:
 
788
                priority = u"NORMAL"
722
789
            (gnutls.library.functions
723
790
             .gnutls_priority_set_direct(session._c_object,
724
791
                                         priority, None))
732
799
                return
733
800
            logger.debug(u"Handshake succeeded")
734
801
            try:
735
 
                fpr = fingerprint(peer_certificate(session))
 
802
                fpr = self.fingerprint(self.peer_certificate(session))
736
803
            except (TypeError, gnutls.errors.GNUTLSError), error:
737
804
                logger.warning(u"Bad certificate: %s", error)
738
805
                session.bye()
744
811
                    client = c
745
812
                    break
746
813
            else:
747
 
                logger.warning(u"Client not found for fingerprint: %s",
748
 
                               fpr)
749
 
                ipc.write("NOTFOUND %s\n" % fpr)
 
814
                ipc.write(u"NOTFOUND %s\n" % fpr)
750
815
                session.bye()
751
816
                return
752
817
            # Have to check if client.still_valid(), since it is
753
818
            # possible that the client timed out while establishing
754
819
            # the GnuTLS session.
755
820
            if not client.still_valid():
756
 
                logger.warning(u"Client %(name)s is invalid",
757
 
                               vars(client))
758
 
                ipc.write("INVALID %s\n" % client.name)
 
821
                ipc.write(u"INVALID %s\n" % client.name)
759
822
                session.bye()
760
823
                return
761
 
            ipc.write("SENDING %s\n" % client.name)
 
824
            ipc.write(u"SENDING %s\n" % client.name)
762
825
            sent_size = 0
763
826
            while sent_size < len(client.secret):
764
827
                sent = session.send(client.secret[sent_size:])
767
830
                             - (sent_size + sent))
768
831
                sent_size += sent
769
832
            session.bye()
770
 
 
771
 
 
772
 
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
773
 
    """Like SocketServer.ForkingMixIn, but also pass a pipe.
774
 
    Assumes a gobject.MainLoop event loop.
775
 
    """
 
833
    
 
834
    @staticmethod
 
835
    def peer_certificate(session):
 
836
        "Return the peer's OpenPGP certificate as a bytestring"
 
837
        # If not an OpenPGP certificate...
 
838
        if (gnutls.library.functions
 
839
            .gnutls_certificate_type_get(session._c_object)
 
840
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
841
            # ...do the normal thing
 
842
            return session.peer_certificate
 
843
        list_size = ctypes.c_uint(1)
 
844
        cert_list = (gnutls.library.functions
 
845
                     .gnutls_certificate_get_peers
 
846
                     (session._c_object, ctypes.byref(list_size)))
 
847
        if not bool(cert_list) and list_size.value != 0:
 
848
            raise gnutls.errors.GNUTLSError(u"error getting peer"
 
849
                                            u" certificate")
 
850
        if list_size.value == 0:
 
851
            return None
 
852
        cert = cert_list[0]
 
853
        return ctypes.string_at(cert.data, cert.size)
 
854
    
 
855
    @staticmethod
 
856
    def fingerprint(openpgp):
 
857
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
 
858
        # New GnuTLS "datum" with the OpenPGP public key
 
859
        datum = (gnutls.library.types
 
860
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
861
                                             ctypes.POINTER
 
862
                                             (ctypes.c_ubyte)),
 
863
                                 ctypes.c_uint(len(openpgp))))
 
864
        # New empty GnuTLS certificate
 
865
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
866
        (gnutls.library.functions
 
867
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
868
        # Import the OpenPGP public key into the certificate
 
869
        (gnutls.library.functions
 
870
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
871
                                    gnutls.library.constants
 
872
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
873
        # Verify the self signature in the key
 
874
        crtverify = ctypes.c_uint()
 
875
        (gnutls.library.functions
 
876
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
877
                                         ctypes.byref(crtverify)))
 
878
        if crtverify.value != 0:
 
879
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
880
            raise (gnutls.errors.CertificateSecurityError
 
881
                   (u"Verify failed"))
 
882
        # New buffer for the fingerprint
 
883
        buf = ctypes.create_string_buffer(20)
 
884
        buf_len = ctypes.c_size_t()
 
885
        # Get the fingerprint from the certificate into the buffer
 
886
        (gnutls.library.functions
 
887
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
888
                                             ctypes.byref(buf_len)))
 
889
        # Deinit the certificate
 
890
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
891
        # Convert the buffer to a Python bytestring
 
892
        fpr = ctypes.string_at(buf, buf_len.value)
 
893
        # Convert the bytestring to hexadecimal notation
 
894
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
895
        return hex_fpr
 
896
 
 
897
 
 
898
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
 
899
    """Like socketserver.ForkingMixIn, but also pass a pipe."""
776
900
    def process_request(self, request, client_address):
777
 
        """This overrides and wraps the original process_request().
 
901
        """Overrides and wraps the original process_request().
 
902
        
778
903
        This function creates a new pipe in self.pipe 
779
904
        """
780
905
        self.pipe = os.pipe()
781
906
        super(ForkingMixInWithPipe,
782
907
              self).process_request(request, client_address)
783
908
        os.close(self.pipe[1])  # close write end
784
 
        # Call "handle_ipc" for both data and EOF events
785
 
        gobject.io_add_watch(self.pipe[0],
786
 
                             gobject.IO_IN | gobject.IO_HUP,
787
 
                             self.handle_ipc)
788
 
    def handle_ipc(source, condition):
 
909
        self.add_pipe(self.pipe[0])
 
910
    def add_pipe(self, pipe):
789
911
        """Dummy function; override as necessary"""
790
 
        os.close(source)
791
 
        return False
 
912
        os.close(pipe)
792
913
 
793
914
 
794
915
class IPv6_TCPServer(ForkingMixInWithPipe,
795
 
                     SocketServer.TCPServer, object):
 
916
                     socketserver.TCPServer, object):
796
917
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
918
    
797
919
    Attributes:
798
 
        settings:       Server settings
799
 
        clients:        Set() of Client objects
800
920
        enabled:        Boolean; whether this server is activated yet
 
921
        interface:      None or a network interface name (string)
 
922
        use_ipv6:       Boolean; to use IPv6 or not
801
923
    """
802
 
    address_family = socket.AF_INET6
803
 
    def __init__(self, *args, **kwargs):
804
 
        if "settings" in kwargs:
805
 
            self.settings = kwargs["settings"]
806
 
            del kwargs["settings"]
807
 
        if "clients" in kwargs:
808
 
            self.clients = kwargs["clients"]
809
 
            del kwargs["clients"]
810
 
        if "use_ipv6" in kwargs:
811
 
            if not kwargs["use_ipv6"]:
812
 
                self.address_family = socket.AF_INET
813
 
            del kwargs["use_ipv6"]
814
 
        self.enabled = False
815
 
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
 
924
    def __init__(self, server_address, RequestHandlerClass,
 
925
                 interface=None, use_ipv6=True):
 
926
        self.interface = interface
 
927
        if use_ipv6:
 
928
            self.address_family = socket.AF_INET6
 
929
        socketserver.TCPServer.__init__(self, server_address,
 
930
                                        RequestHandlerClass)
816
931
    def server_bind(self):
817
932
        """This overrides the normal server_bind() function
818
933
        to bind to an interface if one was specified, and also NOT to
819
934
        bind to an address or port if they were not specified."""
820
 
        if self.settings["interface"]:
821
 
            # 25 is from /usr/include/asm-i486/socket.h
822
 
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
823
 
            try:
824
 
                self.socket.setsockopt(socket.SOL_SOCKET,
825
 
                                       SO_BINDTODEVICE,
826
 
                                       self.settings["interface"])
827
 
            except socket.error, error:
828
 
                if error[0] == errno.EPERM:
829
 
                    logger.error(u"No permission to"
830
 
                                 u" bind to interface %s",
831
 
                                 self.settings["interface"])
832
 
                else:
833
 
                    raise
 
935
        if self.interface is not None:
 
936
            if SO_BINDTODEVICE is None:
 
937
                logger.error(u"SO_BINDTODEVICE does not exist;"
 
938
                             u" cannot bind to interface %s",
 
939
                             self.interface)
 
940
            else:
 
941
                try:
 
942
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
943
                                           SO_BINDTODEVICE,
 
944
                                           str(self.interface
 
945
                                               + u'\0'))
 
946
                except socket.error, error:
 
947
                    if error[0] == errno.EPERM:
 
948
                        logger.error(u"No permission to"
 
949
                                     u" bind to interface %s",
 
950
                                     self.interface)
 
951
                    elif error[0] == errno.ENOPROTOOPT:
 
952
                        logger.error(u"SO_BINDTODEVICE not available;"
 
953
                                     u" cannot bind to interface %s",
 
954
                                     self.interface)
 
955
                    else:
 
956
                        raise
834
957
        # Only bind(2) the socket if we really need to.
835
958
        if self.server_address[0] or self.server_address[1]:
836
959
            if not self.server_address[0]:
837
960
                if self.address_family == socket.AF_INET6:
838
 
                    any_address = "::" # in6addr_any
 
961
                    any_address = u"::" # in6addr_any
839
962
                else:
840
963
                    any_address = socket.INADDR_ANY
841
964
                self.server_address = (any_address,
843
966
            elif not self.server_address[1]:
844
967
                self.server_address = (self.server_address[0],
845
968
                                       0)
846
 
#                 if self.settings["interface"]:
 
969
#                 if self.interface:
847
970
#                     self.server_address = (self.server_address[0],
848
971
#                                            0, # port
849
972
#                                            0, # flowinfo
850
973
#                                            if_nametoindex
851
 
#                                            (self.settings
852
 
#                                             ["interface"]))
853
 
            return super(IPv6_TCPServer, self).server_bind()
 
974
#                                            (self.interface))
 
975
            return socketserver.TCPServer.server_bind(self)
 
976
 
 
977
 
 
978
class MandosServer(IPv6_TCPServer):
 
979
    """Mandos server.
 
980
    
 
981
    Attributes:
 
982
        clients:        set of Client objects
 
983
        gnutls_priority GnuTLS priority string
 
984
        use_dbus:       Boolean; to emit D-Bus signals or not
 
985
        clients:        set of Client objects
 
986
        gnutls_priority GnuTLS priority string
 
987
        use_dbus:       Boolean; to emit D-Bus signals or not
 
988
    
 
989
    Assumes a gobject.MainLoop event loop.
 
990
    """
 
991
    def __init__(self, server_address, RequestHandlerClass,
 
992
                 interface=None, use_ipv6=True, clients=None,
 
993
                 gnutls_priority=None, use_dbus=True):
 
994
        self.enabled = False
 
995
        self.clients = clients
 
996
        if self.clients is None:
 
997
            self.clients = set()
 
998
        self.use_dbus = use_dbus
 
999
        self.gnutls_priority = gnutls_priority
 
1000
        IPv6_TCPServer.__init__(self, server_address,
 
1001
                                RequestHandlerClass,
 
1002
                                interface = interface,
 
1003
                                use_ipv6 = use_ipv6)
854
1004
    def server_activate(self):
855
1005
        if self.enabled:
856
 
            return super(IPv6_TCPServer, self).server_activate()
 
1006
            return socketserver.TCPServer.server_activate(self)
857
1007
    def enable(self):
858
1008
        self.enabled = True
 
1009
    def add_pipe(self, pipe):
 
1010
        # Call "handle_ipc" for both data and EOF events
 
1011
        gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
 
1012
                             self.handle_ipc)
859
1013
    def handle_ipc(self, source, condition, file_objects={}):
860
1014
        condition_names = {
861
 
            gobject.IO_IN: "IN", # There is data to read.
862
 
            gobject.IO_OUT: "OUT", # Data can be written (without
863
 
                                   # blocking).
864
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
865
 
            gobject.IO_ERR: "ERR", # Error condition.
866
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
867
 
                                   # broken, usually for pipes and
868
 
                                   # sockets).
 
1015
            gobject.IO_IN: u"IN",   # There is data to read.
 
1016
            gobject.IO_OUT: u"OUT", # Data can be written (without
 
1017
                                    # blocking).
 
1018
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
 
1019
            gobject.IO_ERR: u"ERR", # Error condition.
 
1020
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
 
1021
                                    # broken, usually for pipes and
 
1022
                                    # sockets).
869
1023
            }
870
1024
        conditions_string = ' | '.join(name
871
1025
                                       for cond, name in
872
1026
                                       condition_names.iteritems()
873
1027
                                       if cond & condition)
874
 
        logger.debug("Handling IPC: FD = %d, condition = %s", source,
 
1028
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
875
1029
                     conditions_string)
876
1030
        
877
1031
        # Turn the pipe file descriptor into a Python file object
878
1032
        if source not in file_objects:
879
 
            file_objects[source] = os.fdopen(source, "r", 1)
 
1033
            file_objects[source] = os.fdopen(source, u"r", 1)
880
1034
        
881
1035
        # Read a line from the file object
882
1036
        cmdline = file_objects[source].readline()
888
1042
            # Stop calling this function
889
1043
            return False
890
1044
        
891
 
        logger.debug("IPC command: %r\n" % cmdline)
 
1045
        logger.debug(u"IPC command: %r", cmdline)
892
1046
        
893
1047
        # Parse and act on command
894
 
        cmd, args = cmdline.split(None, 1)
895
 
        if cmd == "NOTFOUND":
896
 
            if self.settings["use_dbus"]:
 
1048
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
 
1049
        
 
1050
        if cmd == u"NOTFOUND":
 
1051
            logger.warning(u"Client not found for fingerprint: %s",
 
1052
                           args)
 
1053
            if self.use_dbus:
897
1054
                # Emit D-Bus signal
898
1055
                mandos_dbus_service.ClientNotFound(args)
899
 
        elif cmd == "INVALID":
900
 
            if self.settings["use_dbus"]:
901
 
                for client in self.clients:
902
 
                    if client.name == args:
 
1056
        elif cmd == u"INVALID":
 
1057
            for client in self.clients:
 
1058
                if client.name == args:
 
1059
                    logger.warning(u"Client %s is invalid", args)
 
1060
                    if self.use_dbus:
903
1061
                        # Emit D-Bus signal
904
1062
                        client.Rejected()
905
 
                        break
906
 
        elif cmd == "SENDING":
 
1063
                    break
 
1064
            else:
 
1065
                logger.error(u"Unknown client %s is invalid", args)
 
1066
        elif cmd == u"SENDING":
907
1067
            for client in self.clients:
908
1068
                if client.name == args:
 
1069
                    logger.info(u"Sending secret to %s", client.name)
909
1070
                    client.checked_ok()
910
 
                    if self.settings["use_dbus"]:
 
1071
                    if self.use_dbus:
911
1072
                        # Emit D-Bus signal
912
1073
                        client.ReceivedSecret()
913
1074
                    break
 
1075
            else:
 
1076
                logger.error(u"Sending secret to unknown client %s",
 
1077
                             args)
914
1078
        else:
915
 
            logger.error("Unknown IPC command: %r", cmdline)
 
1079
            logger.error(u"Unknown IPC command: %r", cmdline)
916
1080
        
917
1081
        # Keep calling this function
918
1082
        return True
921
1085
def string_to_delta(interval):
922
1086
    """Parse a string and return a datetime.timedelta
923
1087
    
924
 
    >>> string_to_delta('7d')
 
1088
    >>> string_to_delta(u'7d')
925
1089
    datetime.timedelta(7)
926
 
    >>> string_to_delta('60s')
 
1090
    >>> string_to_delta(u'60s')
927
1091
    datetime.timedelta(0, 60)
928
 
    >>> string_to_delta('60m')
 
1092
    >>> string_to_delta(u'60m')
929
1093
    datetime.timedelta(0, 3600)
930
 
    >>> string_to_delta('24h')
 
1094
    >>> string_to_delta(u'24h')
931
1095
    datetime.timedelta(1)
932
1096
    >>> string_to_delta(u'1w')
933
1097
    datetime.timedelta(7)
934
 
    >>> string_to_delta('5m 30s')
 
1098
    >>> string_to_delta(u'5m 30s')
935
1099
    datetime.timedelta(0, 330)
936
1100
    """
937
1101
    timevalue = datetime.timedelta(0)
957
1121
    return timevalue
958
1122
 
959
1123
 
960
 
def server_state_changed(state):
961
 
    """Derived from the Avahi example code"""
962
 
    if state == avahi.SERVER_COLLISION:
963
 
        logger.error(u"Zeroconf server name collision")
964
 
        service.remove()
965
 
    elif state == avahi.SERVER_RUNNING:
966
 
        service.add()
967
 
 
968
 
 
969
 
def entry_group_state_changed(state, error):
970
 
    """Derived from the Avahi example code"""
971
 
    logger.debug(u"Avahi state change: %i", state)
972
 
    
973
 
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
974
 
        logger.debug(u"Zeroconf service established.")
975
 
    elif state == avahi.ENTRY_GROUP_COLLISION:
976
 
        logger.warning(u"Zeroconf service name collision.")
977
 
        service.rename()
978
 
    elif state == avahi.ENTRY_GROUP_FAILURE:
979
 
        logger.critical(u"Avahi: Error in group state changed %s",
980
 
                        unicode(error))
981
 
        raise AvahiGroupError(u"State changed: %s" % unicode(error))
982
 
 
983
1124
def if_nametoindex(interface):
984
 
    """Call the C function if_nametoindex(), or equivalent"""
 
1125
    """Call the C function if_nametoindex(), or equivalent
 
1126
    
 
1127
    Note: This function cannot accept a unicode string."""
985
1128
    global if_nametoindex
986
1129
    try:
987
1130
        if_nametoindex = (ctypes.cdll.LoadLibrary
988
 
                          (ctypes.util.find_library("c"))
 
1131
                          (ctypes.util.find_library(u"c"))
989
1132
                          .if_nametoindex)
990
1133
    except (OSError, AttributeError):
991
 
        if "struct" not in sys.modules:
992
 
            import struct
993
 
        if "fcntl" not in sys.modules:
994
 
            import fcntl
 
1134
        logger.warning(u"Doing if_nametoindex the hard way")
995
1135
        def if_nametoindex(interface):
996
1136
            "Get an interface index the hard way, i.e. using fcntl()"
997
1137
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
998
1138
            with closing(socket.socket()) as s:
999
1139
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1000
 
                                    struct.pack("16s16x", interface))
1001
 
            interface_index = struct.unpack("I", ifreq[16:20])[0]
 
1140
                                    struct.pack(str(u"16s16x"),
 
1141
                                                interface))
 
1142
            interface_index = struct.unpack(str(u"I"),
 
1143
                                            ifreq[16:20])[0]
1002
1144
            return interface_index
1003
1145
    return if_nametoindex(interface)
1004
1146
 
1005
1147
 
1006
1148
def daemon(nochdir = False, noclose = False):
1007
1149
    """See daemon(3).  Standard BSD Unix function.
 
1150
    
1008
1151
    This should really exist as os.daemon, but it doesn't (yet)."""
1009
1152
    if os.fork():
1010
1153
        sys.exit()
1011
1154
    os.setsid()
1012
1155
    if not nochdir:
1013
 
        os.chdir("/")
 
1156
        os.chdir(u"/")
1014
1157
    if os.fork():
1015
1158
        sys.exit()
1016
1159
    if not noclose:
1018
1161
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1019
1162
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1020
1163
            raise OSError(errno.ENODEV,
1021
 
                          "/dev/null not a character device")
 
1164
                          u"/dev/null not a character device")
1022
1165
        os.dup2(null, sys.stdin.fileno())
1023
1166
        os.dup2(null, sys.stdout.fileno())
1024
1167
        os.dup2(null, sys.stderr.fileno())
1032
1175
    # Parsing of options, both command line and config file
1033
1176
    
1034
1177
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1035
 
    parser.add_option("-i", "--interface", type="string",
1036
 
                      metavar="IF", help="Bind to interface IF")
1037
 
    parser.add_option("-a", "--address", type="string",
1038
 
                      help="Address to listen for requests on")
1039
 
    parser.add_option("-p", "--port", type="int",
1040
 
                      help="Port number to receive requests on")
1041
 
    parser.add_option("--check", action="store_true",
1042
 
                      help="Run self-test")
1043
 
    parser.add_option("--debug", action="store_true",
1044
 
                      help="Debug mode; run in foreground and log to"
1045
 
                      " terminal")
1046
 
    parser.add_option("--priority", type="string", help="GnuTLS"
1047
 
                      " priority string (see GnuTLS documentation)")
1048
 
    parser.add_option("--servicename", type="string", metavar="NAME",
1049
 
                      help="Zeroconf service name")
1050
 
    parser.add_option("--configdir", type="string",
1051
 
                      default="/etc/mandos", metavar="DIR",
1052
 
                      help="Directory to search for configuration"
1053
 
                      " files")
1054
 
    parser.add_option("--no-dbus", action="store_false",
1055
 
                      dest="use_dbus",
1056
 
                      help="Do not provide D-Bus system bus"
1057
 
                      " interface")
1058
 
    parser.add_option("--no-ipv6", action="store_false",
1059
 
                      dest="use_ipv6", help="Do not use IPv6")
 
1178
    parser.add_option("-i", u"--interface", type=u"string",
 
1179
                      metavar="IF", help=u"Bind to interface IF")
 
1180
    parser.add_option("-a", u"--address", type=u"string",
 
1181
                      help=u"Address to listen for requests on")
 
1182
    parser.add_option("-p", u"--port", type=u"int",
 
1183
                      help=u"Port number to receive requests on")
 
1184
    parser.add_option("--check", action=u"store_true",
 
1185
                      help=u"Run self-test")
 
1186
    parser.add_option("--debug", action=u"store_true",
 
1187
                      help=u"Debug mode; run in foreground and log to"
 
1188
                      u" terminal")
 
1189
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
 
1190
                      u" priority string (see GnuTLS documentation)")
 
1191
    parser.add_option("--servicename", type=u"string",
 
1192
                      metavar=u"NAME", help=u"Zeroconf service name")
 
1193
    parser.add_option("--configdir", type=u"string",
 
1194
                      default=u"/etc/mandos", metavar=u"DIR",
 
1195
                      help=u"Directory to search for configuration"
 
1196
                      u" files")
 
1197
    parser.add_option("--no-dbus", action=u"store_false",
 
1198
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
 
1199
                      u" system bus interface")
 
1200
    parser.add_option("--no-ipv6", action=u"store_false",
 
1201
                      dest=u"use_ipv6", help=u"Do not use IPv6")
1060
1202
    options = parser.parse_args()[0]
1061
1203
    
1062
1204
    if options.check:
1065
1207
        sys.exit()
1066
1208
    
1067
1209
    # Default values for config file for server-global settings
1068
 
    server_defaults = { "interface": "",
1069
 
                        "address": "",
1070
 
                        "port": "",
1071
 
                        "debug": "False",
1072
 
                        "priority":
1073
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1074
 
                        "servicename": "Mandos",
1075
 
                        "use_dbus": "True",
1076
 
                        "use_ipv6": "True",
 
1210
    server_defaults = { u"interface": u"",
 
1211
                        u"address": u"",
 
1212
                        u"port": u"",
 
1213
                        u"debug": u"False",
 
1214
                        u"priority":
 
1215
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1216
                        u"servicename": u"Mandos",
 
1217
                        u"use_dbus": u"True",
 
1218
                        u"use_ipv6": u"True",
1077
1219
                        }
1078
1220
    
1079
1221
    # Parse config file for server-global settings
1080
 
    server_config = ConfigParser.SafeConfigParser(server_defaults)
 
1222
    server_config = configparser.SafeConfigParser(server_defaults)
1081
1223
    del server_defaults
1082
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
1224
    server_config.read(os.path.join(options.configdir,
 
1225
                                    u"mandos.conf"))
1083
1226
    # Convert the SafeConfigParser object to a dict
1084
1227
    server_settings = server_config.defaults()
1085
1228
    # Use the appropriate methods on the non-string config options
1086
 
    server_settings["debug"] = server_config.getboolean("DEFAULT",
1087
 
                                                        "debug")
1088
 
    server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1089
 
                                                           "use_dbus")
1090
 
    server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1091
 
                                                           "use_ipv6")
 
1229
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
 
1230
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
1231
                                                           option)
1092
1232
    if server_settings["port"]:
1093
 
        server_settings["port"] = server_config.getint("DEFAULT",
1094
 
                                                       "port")
 
1233
        server_settings["port"] = server_config.getint(u"DEFAULT",
 
1234
                                                       u"port")
1095
1235
    del server_config
1096
1236
    
1097
1237
    # Override the settings from the config file with command line
1098
1238
    # options, if set.
1099
 
    for option in ("interface", "address", "port", "debug",
1100
 
                   "priority", "servicename", "configdir",
1101
 
                   "use_dbus", "use_ipv6"):
 
1239
    for option in (u"interface", u"address", u"port", u"debug",
 
1240
                   u"priority", u"servicename", u"configdir",
 
1241
                   u"use_dbus", u"use_ipv6"):
1102
1242
        value = getattr(options, option)
1103
1243
        if value is not None:
1104
1244
            server_settings[option] = value
1105
1245
    del options
 
1246
    # Force all strings to be unicode
 
1247
    for option in server_settings.keys():
 
1248
        if type(server_settings[option]) is str:
 
1249
            server_settings[option] = unicode(server_settings[option])
1106
1250
    # Now we have our good server settings in "server_settings"
1107
1251
    
1108
1252
    ##################################################################
1109
1253
    
1110
1254
    # For convenience
1111
 
    debug = server_settings["debug"]
1112
 
    use_dbus = server_settings["use_dbus"]
1113
 
    use_ipv6 = server_settings["use_ipv6"]
 
1255
    debug = server_settings[u"debug"]
 
1256
    use_dbus = server_settings[u"use_dbus"]
 
1257
    use_ipv6 = server_settings[u"use_ipv6"]
1114
1258
    
1115
1259
    if not debug:
1116
1260
        syslogger.setLevel(logging.WARNING)
1117
1261
        console.setLevel(logging.WARNING)
1118
1262
    
1119
 
    if server_settings["servicename"] != "Mandos":
 
1263
    if server_settings[u"servicename"] != u"Mandos":
1120
1264
        syslogger.setFormatter(logging.Formatter
1121
 
                               ('Mandos (%s) [%%(process)d]:'
1122
 
                                ' %%(levelname)s: %%(message)s'
1123
 
                                % server_settings["servicename"]))
 
1265
                               (u'Mandos (%s) [%%(process)d]:'
 
1266
                                u' %%(levelname)s: %%(message)s'
 
1267
                                % server_settings[u"servicename"]))
1124
1268
    
1125
1269
    # Parse config file with clients
1126
 
    client_defaults = { "timeout": "1h",
1127
 
                        "interval": "5m",
1128
 
                        "checker": "fping -q -- %%(host)s",
1129
 
                        "host": "",
 
1270
    client_defaults = { u"timeout": u"1h",
 
1271
                        u"interval": u"5m",
 
1272
                        u"checker": u"fping -q -- %%(host)s",
 
1273
                        u"host": u"",
1130
1274
                        }
1131
 
    client_config = ConfigParser.SafeConfigParser(client_defaults)
1132
 
    client_config.read(os.path.join(server_settings["configdir"],
1133
 
                                    "clients.conf"))
1134
 
 
 
1275
    client_config = configparser.SafeConfigParser(client_defaults)
 
1276
    client_config.read(os.path.join(server_settings[u"configdir"],
 
1277
                                    u"clients.conf"))
 
1278
    
1135
1279
    global mandos_dbus_service
1136
1280
    mandos_dbus_service = None
1137
1281
    
1138
 
    clients = Set()
1139
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
1140
 
                                 server_settings["port"]),
1141
 
                                TCP_handler,
1142
 
                                settings=server_settings,
1143
 
                                clients=clients, use_ipv6=use_ipv6)
1144
 
    pidfilename = "/var/run/mandos.pid"
 
1282
    tcp_server = MandosServer((server_settings[u"address"],
 
1283
                               server_settings[u"port"]),
 
1284
                              ClientHandler,
 
1285
                              interface=server_settings[u"interface"],
 
1286
                              use_ipv6=use_ipv6,
 
1287
                              gnutls_priority=
 
1288
                              server_settings[u"priority"],
 
1289
                              use_dbus=use_dbus)
 
1290
    pidfilename = u"/var/run/mandos.pid"
1145
1291
    try:
1146
 
        pidfile = open(pidfilename, "w")
 
1292
        pidfile = open(pidfilename, u"w")
1147
1293
    except IOError:
1148
 
        logger.error("Could not open file %r", pidfilename)
 
1294
        logger.error(u"Could not open file %r", pidfilename)
1149
1295
    
1150
1296
    try:
1151
 
        uid = pwd.getpwnam("_mandos").pw_uid
1152
 
        gid = pwd.getpwnam("_mandos").pw_gid
 
1297
        uid = pwd.getpwnam(u"_mandos").pw_uid
 
1298
        gid = pwd.getpwnam(u"_mandos").pw_gid
1153
1299
    except KeyError:
1154
1300
        try:
1155
 
            uid = pwd.getpwnam("mandos").pw_uid
1156
 
            gid = pwd.getpwnam("mandos").pw_gid
 
1301
            uid = pwd.getpwnam(u"mandos").pw_uid
 
1302
            gid = pwd.getpwnam(u"mandos").pw_gid
1157
1303
        except KeyError:
1158
1304
            try:
1159
 
                uid = pwd.getpwnam("nobody").pw_uid
1160
 
                gid = pwd.getpwnam("nogroup").pw_gid
 
1305
                uid = pwd.getpwnam(u"nobody").pw_uid
 
1306
                gid = pwd.getpwnam(u"nobody").pw_gid
1161
1307
            except KeyError:
1162
1308
                uid = 65534
1163
1309
                gid = 65534
1176
1322
        
1177
1323
        @gnutls.library.types.gnutls_log_func
1178
1324
        def debug_gnutls(level, string):
1179
 
            logger.debug("GnuTLS: %s", string[:-1])
 
1325
            logger.debug(u"GnuTLS: %s", string[:-1])
1180
1326
        
1181
1327
        (gnutls.library.functions
1182
1328
         .gnutls_global_set_log_function(debug_gnutls))
1183
1329
    
1184
 
    global service
1185
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1186
 
    service = AvahiService(name = server_settings["servicename"],
1187
 
                           servicetype = "_mandos._tcp",
1188
 
                           protocol = protocol)
1189
 
    if server_settings["interface"]:
1190
 
        service.interface = (if_nametoindex
1191
 
                             (server_settings["interface"]))
1192
 
    
1193
1330
    global main_loop
1194
 
    global bus
1195
 
    global server
1196
1331
    # From the Avahi example code
1197
1332
    DBusGMainLoop(set_as_default=True )
1198
1333
    main_loop = gobject.MainLoop()
1199
1334
    bus = dbus.SystemBus()
1200
 
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1201
 
                                           avahi.DBUS_PATH_SERVER),
1202
 
                            avahi.DBUS_INTERFACE_SERVER)
1203
1335
    # End of Avahi example code
1204
1336
    if use_dbus:
1205
1337
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
 
1338
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
1339
    service = AvahiService(name = server_settings[u"servicename"],
 
1340
                           servicetype = u"_mandos._tcp",
 
1341
                           protocol = protocol, bus = bus)
 
1342
    if server_settings["interface"]:
 
1343
        service.interface = (if_nametoindex
 
1344
                             (str(server_settings[u"interface"])))
1206
1345
    
1207
 
    clients.update(Set(Client(name = section,
1208
 
                              config
1209
 
                              = dict(client_config.items(section)),
1210
 
                              use_dbus = use_dbus)
1211
 
                       for section in client_config.sections()))
1212
 
    if not clients:
 
1346
    client_class = Client
 
1347
    if use_dbus:
 
1348
        client_class = functools.partial(ClientDBus, bus = bus)
 
1349
    tcp_server.clients.update(set(
 
1350
            client_class(name = section,
 
1351
                         config= dict(client_config.items(section)))
 
1352
            for section in client_config.sections()))
 
1353
    if not tcp_server.clients:
1213
1354
        logger.warning(u"No clients defined")
1214
1355
    
1215
1356
    if debug:
1239
1380
    
1240
1381
    def cleanup():
1241
1382
        "Cleanup function; run on exit"
1242
 
        global group
1243
 
        # From the Avahi example code
1244
 
        if not group is None:
1245
 
            group.Free()
1246
 
            group = None
1247
 
        # End of Avahi example code
 
1383
        service.cleanup()
1248
1384
        
1249
 
        while clients:
1250
 
            client = clients.pop()
 
1385
        while tcp_server.clients:
 
1386
            client = tcp_server.clients.pop()
1251
1387
            client.disable_hook = None
1252
1388
            client.disable()
1253
1389
    
1262
1398
        class MandosDBusService(dbus.service.Object):
1263
1399
            """A D-Bus proxy object"""
1264
1400
            def __init__(self):
1265
 
                dbus.service.Object.__init__(self, bus, "/")
 
1401
                dbus.service.Object.__init__(self, bus, u"/")
1266
1402
            _interface = u"se.bsnet.fukt.Mandos"
1267
1403
            
1268
 
            @dbus.service.signal(_interface, signature="oa{sv}")
 
1404
            @dbus.service.signal(_interface, signature=u"oa{sv}")
1269
1405
            def ClientAdded(self, objpath, properties):
1270
1406
                "D-Bus signal"
1271
1407
                pass
1272
1408
            
1273
 
            @dbus.service.signal(_interface, signature="s")
 
1409
            @dbus.service.signal(_interface, signature=u"s")
1274
1410
            def ClientNotFound(self, fingerprint):
1275
1411
                "D-Bus signal"
1276
1412
                pass
1277
1413
            
1278
 
            @dbus.service.signal(_interface, signature="os")
 
1414
            @dbus.service.signal(_interface, signature=u"os")
1279
1415
            def ClientRemoved(self, objpath, name):
1280
1416
                "D-Bus signal"
1281
1417
                pass
1282
1418
            
1283
 
            @dbus.service.method(_interface, out_signature="ao")
 
1419
            @dbus.service.method(_interface, out_signature=u"ao")
1284
1420
            def GetAllClients(self):
1285
1421
                "D-Bus method"
1286
 
                return dbus.Array(c.dbus_object_path for c in clients)
 
1422
                return dbus.Array(c.dbus_object_path
 
1423
                                  for c in tcp_server.clients)
1287
1424
            
1288
 
            @dbus.service.method(_interface, out_signature="a{oa{sv}}")
 
1425
            @dbus.service.method(_interface,
 
1426
                                 out_signature=u"a{oa{sv}}")
1289
1427
            def GetAllClientsWithProperties(self):
1290
1428
                "D-Bus method"
1291
1429
                return dbus.Dictionary(
1292
1430
                    ((c.dbus_object_path, c.GetAllProperties())
1293
 
                     for c in clients),
1294
 
                    signature="oa{sv}")
 
1431
                     for c in tcp_server.clients),
 
1432
                    signature=u"oa{sv}")
1295
1433
            
1296
 
            @dbus.service.method(_interface, in_signature="o")
 
1434
            @dbus.service.method(_interface, in_signature=u"o")
1297
1435
            def RemoveClient(self, object_path):
1298
1436
                "D-Bus method"
1299
 
                for c in clients:
 
1437
                for c in tcp_server.clients:
1300
1438
                    if c.dbus_object_path == object_path:
1301
 
                        clients.remove(c)
 
1439
                        tcp_server.clients.remove(c)
 
1440
                        c.remove_from_connection()
1302
1441
                        # Don't signal anything except ClientRemoved
1303
 
                        c.use_dbus = False
1304
 
                        c.disable()
 
1442
                        c.disable(signal=False)
1305
1443
                        # Emit D-Bus signal
1306
1444
                        self.ClientRemoved(object_path, c.name)
1307
1445
                        return
1311
1449
        
1312
1450
        mandos_dbus_service = MandosDBusService()
1313
1451
    
1314
 
    for client in clients:
 
1452
    for client in tcp_server.clients:
1315
1453
        if use_dbus:
1316
1454
            # Emit D-Bus signal
1317
1455
            mandos_dbus_service.ClientAdded(client.dbus_object_path,
1335
1473
    
1336
1474
    try:
1337
1475
        # From the Avahi example code
1338
 
        server.connect_to_signal("StateChanged", server_state_changed)
1339
1476
        try:
1340
 
            server_state_changed(server.GetState())
 
1477
            service.activate()
1341
1478
        except dbus.exceptions.DBusException, error:
1342
1479
            logger.critical(u"DBusException: %s", error)
1343
1480
            sys.exit(1)
1356
1493
    except KeyboardInterrupt:
1357
1494
        if debug:
1358
1495
            print >> sys.stderr
1359
 
        logger.debug("Server received KeyboardInterrupt")
1360
 
    logger.debug("Server exiting")
 
1496
        logger.debug(u"Server received KeyboardInterrupt")
 
1497
    logger.debug(u"Server exiting")
1361
1498
 
1362
1499
if __name__ == '__main__':
1363
1500
    main()