/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2009-04-17 01:16:37 UTC
  • Revision ID: teddy@fukt.bsnet.se-20090417011637-bcqjpm7fskm4370v
Code cleanup and one bug fix.

* mandos (Client.enable): Bug fix: Do not enable if already enabled.
  (MandosServer.__init__): Create empty set of clients if none passed.
  (main): Do not create clients set; do not pass a clients set to
          MandosServer.  Use tcp_server.clients throughout.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008,2009 Teddy Hogeborn
 
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
33
33
 
34
 
from __future__ import (division, absolute_import, print_function,
35
 
                        unicode_literals)
 
34
from __future__ import division, with_statement, absolute_import
36
35
 
37
36
import SocketServer as socketserver
38
37
import socket
39
 
import argparse
 
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
 
import contextlib
 
58
from contextlib import closing
60
59
import struct
61
60
import fcntl
62
61
import functools
63
 
import cPickle as pickle
64
 
import multiprocessing
65
62
 
66
63
import dbus
67
64
import dbus.service
70
67
from dbus.mainloop.glib import DBusGMainLoop
71
68
import ctypes
72
69
import ctypes.util
73
 
import xml.dom.minidom
74
 
import inspect
75
70
 
76
71
try:
77
72
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
82
77
        SO_BINDTODEVICE = None
83
78
 
84
79
 
85
 
version = "1.3.0"
 
80
version = "1.0.8"
86
81
 
87
 
#logger = logging.getLogger('mandos')
88
 
logger = logging.Logger('mandos')
 
82
logger = logging.Logger(u'mandos')
89
83
syslogger = (logging.handlers.SysLogHandler
90
84
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
 
              address = str("/dev/log")))
 
85
              address = "/dev/log"))
92
86
syslogger.setFormatter(logging.Formatter
93
 
                       ('Mandos [%(process)d]: %(levelname)s:'
94
 
                        ' %(message)s'))
 
87
                       (u'Mandos [%(process)d]: %(levelname)s:'
 
88
                        u' %(message)s'))
95
89
logger.addHandler(syslogger)
96
90
 
97
91
console = logging.StreamHandler()
98
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
 
                                       ' %(levelname)s:'
100
 
                                       ' %(message)s'))
 
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
 
93
                                       u' %(levelname)s:'
 
94
                                       u' %(message)s'))
101
95
logger.addHandler(console)
102
96
 
103
97
class AvahiError(Exception):
120
114
    Attributes:
121
115
    interface: integer; avahi.IF_UNSPEC or an interface index.
122
116
               Used to optionally bind to the specified interface.
123
 
    name: string; Example: 'Mandos'
124
 
    type: string; Example: '_mandos._tcp'.
 
117
    name: string; Example: u'Mandos'
 
118
    type: string; Example: u'_mandos._tcp'.
125
119
                  See <http://www.dns-sd.org/ServiceTypes.html>
126
120
    port: integer; what port to announce
127
121
    TXT: list of strings; TXT record for the service
136
130
    """
137
131
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
132
                 servicetype = None, port = None, TXT = None,
139
 
                 domain = "", host = "", max_renames = 32768,
 
133
                 domain = u"", host = u"", max_renames = 32768,
140
134
                 protocol = avahi.PROTO_UNSPEC, bus = None):
141
135
        self.interface = interface
142
136
        self.name = name
151
145
        self.group = None       # our entry group
152
146
        self.server = None
153
147
        self.bus = bus
154
 
        self.entry_group_state_changed_match = None
155
148
    def rename(self):
156
149
        """Derived from the Avahi example code"""
157
150
        if self.rename_count >= self.max_renames:
158
 
            logger.critical("No suitable Zeroconf service name found"
159
 
                            " after %i retries, exiting.",
 
151
            logger.critical(u"No suitable Zeroconf service name found"
 
152
                            u" after %i retries, exiting.",
160
153
                            self.rename_count)
161
 
            raise AvahiServiceError("Too many renames")
162
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
163
 
        logger.info("Changing Zeroconf service name to %r ...",
164
 
                    self.name)
 
154
            raise AvahiServiceError(u"Too many renames")
 
155
        self.name = self.server.GetAlternativeServiceName(self.name)
 
156
        logger.info(u"Changing Zeroconf service name to %r ...",
 
157
                    unicode(self.name))
165
158
        syslogger.setFormatter(logging.Formatter
166
 
                               ('Mandos (%s) [%%(process)d]:'
167
 
                                ' %%(levelname)s: %%(message)s'
 
159
                               (u'Mandos (%s) [%%(process)d]:'
 
160
                                u' %%(levelname)s: %%(message)s'
168
161
                                % self.name))
169
162
        self.remove()
170
 
        try:
171
 
            self.add()
172
 
        except dbus.exceptions.DBusException as error:
173
 
            logger.critical("DBusException: %s", error)
174
 
            self.cleanup()
175
 
            os._exit(1)
 
163
        self.add()
176
164
        self.rename_count += 1
177
165
    def remove(self):
178
166
        """Derived from the Avahi example code"""
179
167
        if self.group is not None:
180
 
            try:
181
 
                self.group.Free()
182
 
            except (dbus.exceptions.UnknownMethodException,
183
 
                    dbus.exceptions.DBusException) as e:
184
 
                pass
185
 
            self.group = None
186
 
        if self.entry_group_state_changed_match is not None:
187
 
            self.entry_group_state_changed_match.remove()
188
 
            self.entry_group_state_changed_match = None
 
168
            self.group.Reset()
189
169
    def add(self):
190
170
        """Derived from the Avahi example code"""
191
 
        self.remove()
192
 
        self.group = dbus.Interface(
193
 
            self.bus.get_object(avahi.DBUS_NAME,
194
 
                                self.server.EntryGroupNew(),
195
 
                                follow_name_owner_changes=True),
196
 
            avahi.DBUS_INTERFACE_ENTRY_GROUP)
197
 
        self.entry_group_state_changed_match = (
198
 
            self.group.connect_to_signal(
199
 
                'StateChanged', self .entry_group_state_changed))
200
 
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
171
        if self.group is None:
 
172
            self.group = dbus.Interface(
 
173
                self.bus.get_object(avahi.DBUS_NAME,
 
174
                                    self.server.EntryGroupNew()),
 
175
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
176
            self.group.connect_to_signal('StateChanged',
 
177
                                         self.entry_group_state_changed)
 
178
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
201
179
                     self.name, self.type)
202
180
        self.group.AddService(
203
181
            self.interface,
210
188
        self.group.Commit()
211
189
    def entry_group_state_changed(self, state, error):
212
190
        """Derived from the Avahi example code"""
213
 
        logger.debug("Avahi entry group state change: %i", state)
 
191
        logger.debug(u"Avahi state change: %i", state)
214
192
        
215
193
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
216
 
            logger.debug("Zeroconf service established.")
 
194
            logger.debug(u"Zeroconf service established.")
217
195
        elif state == avahi.ENTRY_GROUP_COLLISION:
218
 
            logger.info("Zeroconf service name collision.")
 
196
            logger.warning(u"Zeroconf service name collision.")
219
197
            self.rename()
220
198
        elif state == avahi.ENTRY_GROUP_FAILURE:
221
 
            logger.critical("Avahi: Error in group state changed %s",
 
199
            logger.critical(u"Avahi: Error in group state changed %s",
222
200
                            unicode(error))
223
 
            raise AvahiGroupError("State changed: %s"
 
201
            raise AvahiGroupError(u"State changed: %s"
224
202
                                  % unicode(error))
225
203
    def cleanup(self):
226
204
        """Derived from the Avahi example code"""
227
 
        self.remove()
228
 
    def server_state_changed(self, state, error=None):
 
205
        if self.group is not None:
 
206
            self.group.Free()
 
207
            self.group = None
 
208
    def server_state_changed(self, state):
229
209
        """Derived from the Avahi example code"""
230
 
        logger.debug("Avahi server state change: %i", state)
231
 
        bad_states = { avahi.SERVER_INVALID:
232
 
                           "Zeroconf server invalid",
233
 
                       avahi.SERVER_REGISTERING: None,
234
 
                       avahi.SERVER_COLLISION:
235
 
                           "Zeroconf server name collision",
236
 
                       avahi.SERVER_FAILURE:
237
 
                           "Zeroconf server failure" }
238
 
        if state in bad_states:
239
 
            if bad_states[state]:
240
 
                logger.error(bad_states[state])
 
210
        if state == avahi.SERVER_COLLISION:
 
211
            logger.error(u"Zeroconf server name collision")
241
212
            self.remove()
242
213
        elif state == avahi.SERVER_RUNNING:
243
214
            self.add()
244
 
        else:
245
 
            logger.debug("Unknown state: %r", state)
246
215
    def activate(self):
247
216
        """Derived from the Avahi example code"""
248
217
        if self.server is None:
249
218
            self.server = dbus.Interface(
250
219
                self.bus.get_object(avahi.DBUS_NAME,
251
 
                                    avahi.DBUS_PATH_SERVER,
252
 
                                    follow_name_owner_changes=True),
 
220
                                    avahi.DBUS_PATH_SERVER),
253
221
                avahi.DBUS_INTERFACE_SERVER)
254
 
        self.server.connect_to_signal("StateChanged",
 
222
        self.server.connect_to_signal(u"StateChanged",
255
223
                                 self.server_state_changed)
256
224
        self.server_state_changed(self.server.GetState())
257
225
 
260
228
    """A representation of a client host served by this server.
261
229
    
262
230
    Attributes:
263
 
    _approved:   bool(); 'None' if not yet approved/disapproved
264
 
    approval_delay: datetime.timedelta(); Time to wait for approval
265
 
    approval_duration: datetime.timedelta(); Duration of one approval
 
231
    name:       string; from the config file, used in log messages and
 
232
                        D-Bus identifiers
 
233
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
234
                 uniquely identify the client
 
235
    secret:     bytestring; sent verbatim (over TLS) to client
 
236
    host:       string; available for use by the checker command
 
237
    created:    datetime.datetime(); (UTC) object creation
 
238
    last_enabled: datetime.datetime(); (UTC)
 
239
    enabled:    bool()
 
240
    last_checked_ok: datetime.datetime(); (UTC) or None
 
241
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
242
                                      until this client is invalid
 
243
    interval:   datetime.timedelta(); How often to start a new checker
 
244
    disable_hook:  If set, called by disable() as disable_hook(self)
266
245
    checker:    subprocess.Popen(); a running checker process used
267
246
                                    to see if the client lives.
268
247
                                    'None' if no process is running.
269
 
    checker_callback_tag: a gobject event source tag, or None
270
 
    checker_command: string; External command which is run to check
271
 
                     if client lives.  %() expansions are done at
 
248
    checker_initiator_tag: a gobject event source tag, or None
 
249
    disable_initiator_tag:    - '' -
 
250
    checker_callback_tag:  - '' -
 
251
    checker_command: string; External command which is run to check if
 
252
                     client lives.  %() expansions are done at
272
253
                     runtime with vars(self) as dict, so that for
273
254
                     instance %(name)s can be used in the command.
274
 
    checker_initiator_tag: a gobject event source tag, or None
275
 
    created:    datetime.datetime(); (UTC) object creation
276
255
    current_checker_command: string; current running checker_command
277
 
    disable_hook:  If set, called by disable() as disable_hook(self)
278
 
    disable_initiator_tag: a gobject event source tag, or None
279
 
    enabled:    bool()
280
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
281
 
                 uniquely identify the client
282
 
    host:       string; available for use by the checker command
283
 
    interval:   datetime.timedelta(); How often to start a new checker
284
 
    last_approval_request: datetime.datetime(); (UTC) or None
285
 
    last_checked_ok: datetime.datetime(); (UTC) or None
286
 
    last_enabled: datetime.datetime(); (UTC)
287
 
    name:       string; from the config file, used in log messages and
288
 
                        D-Bus identifiers
289
 
    secret:     bytestring; sent verbatim (over TLS) to client
290
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
291
 
                                      until this client is disabled
292
 
    runtime_expansions: Allowed attributes for runtime expansion.
293
256
    """
294
257
    
295
 
    runtime_expansions = ("approval_delay", "approval_duration",
296
 
                          "created", "enabled", "fingerprint",
297
 
                          "host", "interval", "last_checked_ok",
298
 
                          "last_enabled", "name", "timeout")
299
 
    
300
258
    @staticmethod
301
 
    def _timedelta_to_milliseconds(td):
302
 
        "Convert a datetime.timedelta() to milliseconds"
303
 
        return ((td.days * 24 * 60 * 60 * 1000)
304
 
                + (td.seconds * 1000)
305
 
                + (td.microseconds // 1000))
 
259
    def _datetime_to_milliseconds(dt):
 
260
        "Convert a datetime.datetime() to milliseconds"
 
261
        return ((dt.days * 24 * 60 * 60 * 1000)
 
262
                + (dt.seconds * 1000)
 
263
                + (dt.microseconds // 1000))
306
264
    
307
265
    def timeout_milliseconds(self):
308
266
        "Return the 'timeout' attribute in milliseconds"
309
 
        return self._timedelta_to_milliseconds(self.timeout)
 
267
        return self._datetime_to_milliseconds(self.timeout)
310
268
    
311
269
    def interval_milliseconds(self):
312
270
        "Return the 'interval' attribute in milliseconds"
313
 
        return self._timedelta_to_milliseconds(self.interval)
314
 
 
315
 
    def approval_delay_milliseconds(self):
316
 
        return self._timedelta_to_milliseconds(self.approval_delay)
 
271
        return self._datetime_to_milliseconds(self.interval)
317
272
    
318
273
    def __init__(self, name = None, disable_hook=None, config=None):
319
274
        """Note: the 'checker' key in 'config' sets the
322
277
        self.name = name
323
278
        if config is None:
324
279
            config = {}
325
 
        logger.debug("Creating client %r", self.name)
 
280
        logger.debug(u"Creating client %r", self.name)
326
281
        # Uppercase and remove spaces from fingerprint for later
327
282
        # comparison purposes with return value from the fingerprint()
328
283
        # function
329
 
        self.fingerprint = (config["fingerprint"].upper()
330
 
                            .replace(" ", ""))
331
 
        logger.debug("  Fingerprint: %s", self.fingerprint)
332
 
        if "secret" in config:
333
 
            self.secret = config["secret"].decode("base64")
334
 
        elif "secfile" in config:
335
 
            with open(os.path.expanduser(os.path.expandvars
336
 
                                         (config["secfile"])),
337
 
                      "rb") as secfile:
 
284
        self.fingerprint = (config[u"fingerprint"].upper()
 
285
                            .replace(u" ", u""))
 
286
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
 
287
        if u"secret" in config:
 
288
            self.secret = config[u"secret"].decode(u"base64")
 
289
        elif u"secfile" in config:
 
290
            with closing(open(os.path.expanduser
 
291
                              (os.path.expandvars
 
292
                               (config[u"secfile"])))) as secfile:
338
293
                self.secret = secfile.read()
339
294
        else:
340
 
            raise TypeError("No secret or secfile for client %s"
 
295
            raise TypeError(u"No secret or secfile for client %s"
341
296
                            % self.name)
342
 
        self.host = config.get("host", "")
 
297
        self.host = config.get(u"host", u"")
343
298
        self.created = datetime.datetime.utcnow()
344
299
        self.enabled = False
345
 
        self.last_approval_request = None
346
300
        self.last_enabled = None
347
301
        self.last_checked_ok = None
348
 
        self.timeout = string_to_delta(config["timeout"])
349
 
        self.interval = string_to_delta(config["interval"])
 
302
        self.timeout = string_to_delta(config[u"timeout"])
 
303
        self.interval = string_to_delta(config[u"interval"])
350
304
        self.disable_hook = disable_hook
351
305
        self.checker = None
352
306
        self.checker_initiator_tag = None
353
307
        self.disable_initiator_tag = None
354
308
        self.checker_callback_tag = None
355
 
        self.checker_command = config["checker"]
 
309
        self.checker_command = config[u"checker"]
356
310
        self.current_checker_command = None
357
311
        self.last_connect = None
358
 
        self._approved = None
359
 
        self.approved_by_default = config.get("approved_by_default",
360
 
                                              True)
361
 
        self.approvals_pending = 0
362
 
        self.approval_delay = string_to_delta(
363
 
            config["approval_delay"])
364
 
        self.approval_duration = string_to_delta(
365
 
            config["approval_duration"])
366
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
367
312
    
368
 
    def send_changedstate(self):
369
 
        self.changedstate.acquire()
370
 
        self.changedstate.notify_all()
371
 
        self.changedstate.release()
372
 
        
373
313
    def enable(self):
374
314
        """Start this client's checker and timeout hooks"""
375
 
        if getattr(self, "enabled", False):
 
315
        if getattr(self, u"enabled", False):
376
316
            # Already enabled
377
317
            return
378
 
        self.send_changedstate()
379
318
        self.last_enabled = datetime.datetime.utcnow()
380
319
        # Schedule a new checker to be started an 'interval' from now,
381
320
        # and every interval from then on.
382
321
        self.checker_initiator_tag = (gobject.timeout_add
383
322
                                      (self.interval_milliseconds(),
384
323
                                       self.start_checker))
 
324
        # Also start a new checker *right now*.
 
325
        self.start_checker()
385
326
        # Schedule a disable() when 'timeout' has passed
386
327
        self.disable_initiator_tag = (gobject.timeout_add
387
328
                                   (self.timeout_milliseconds(),
388
329
                                    self.disable))
389
330
        self.enabled = True
390
 
        # Also start a new checker *right now*.
391
 
        self.start_checker()
392
331
    
393
 
    def disable(self, quiet=True):
 
332
    def disable(self):
394
333
        """Disable this client."""
395
334
        if not getattr(self, "enabled", False):
396
335
            return False
397
 
        if not quiet:
398
 
            self.send_changedstate()
399
 
        if not quiet:
400
 
            logger.info("Disabling client %s", self.name)
401
 
        if getattr(self, "disable_initiator_tag", False):
 
336
        logger.info(u"Disabling client %s", self.name)
 
337
        if getattr(self, u"disable_initiator_tag", False):
402
338
            gobject.source_remove(self.disable_initiator_tag)
403
339
            self.disable_initiator_tag = None
404
 
        if getattr(self, "checker_initiator_tag", False):
 
340
        if getattr(self, u"checker_initiator_tag", False):
405
341
            gobject.source_remove(self.checker_initiator_tag)
406
342
            self.checker_initiator_tag = None
407
343
        self.stop_checker()
422
358
        if os.WIFEXITED(condition):
423
359
            exitstatus = os.WEXITSTATUS(condition)
424
360
            if exitstatus == 0:
425
 
                logger.info("Checker for %(name)s succeeded",
 
361
                logger.info(u"Checker for %(name)s succeeded",
426
362
                            vars(self))
427
363
                self.checked_ok()
428
364
            else:
429
 
                logger.info("Checker for %(name)s failed",
 
365
                logger.info(u"Checker for %(name)s failed",
430
366
                            vars(self))
431
367
        else:
432
 
            logger.warning("Checker for %(name)s crashed?",
 
368
            logger.warning(u"Checker for %(name)s crashed?",
433
369
                           vars(self))
434
370
    
435
371
    def checked_ok(self):
444
380
                                      (self.timeout_milliseconds(),
445
381
                                       self.disable))
446
382
    
447
 
    def need_approval(self):
448
 
        self.last_approval_request = datetime.datetime.utcnow()
449
 
    
450
383
    def start_checker(self):
451
384
        """Start a new checker subprocess if one is not running.
452
385
        
458
391
        # client would inevitably timeout, since no checker would get
459
392
        # a chance to run to completion.  If we instead leave running
460
393
        # checkers alone, the checker would have to take more time
461
 
        # than 'timeout' for the client to be disabled, which is as it
462
 
        # should be.
 
394
        # than 'timeout' for the client to be declared invalid, which
 
395
        # is as it should be.
463
396
        
464
397
        # If a checker exists, make sure it is not a zombie
465
 
        try:
 
398
        if self.checker is not None:
466
399
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
467
 
        except (AttributeError, OSError) as error:
468
 
            if (isinstance(error, OSError)
469
 
                and error.errno != errno.ECHILD):
470
 
                raise error
471
 
        else:
472
400
            if pid:
473
 
                logger.warning("Checker was a zombie")
 
401
                logger.warning(u"Checker was a zombie")
474
402
                gobject.source_remove(self.checker_callback_tag)
475
403
                self.checker_callback(pid, status,
476
404
                                      self.current_checker_command)
481
409
                command = self.checker_command % self.host
482
410
            except TypeError:
483
411
                # Escape attributes for the shell
484
 
                escaped_attrs = dict(
485
 
                    (attr,
486
 
                     re.escape(unicode(str(getattr(self, attr, "")),
487
 
                                       errors=
488
 
                                       'replace')))
489
 
                    for attr in
490
 
                    self.runtime_expansions)
491
 
 
 
412
                escaped_attrs = dict((key,
 
413
                                      re.escape(unicode(str(val),
 
414
                                                        errors=
 
415
                                                        u'replace')))
 
416
                                     for key, val in
 
417
                                     vars(self).iteritems())
492
418
                try:
493
419
                    command = self.checker_command % escaped_attrs
494
 
                except TypeError as error:
495
 
                    logger.error('Could not format string "%s":'
496
 
                                 ' %s', self.checker_command, error)
 
420
                except TypeError, error:
 
421
                    logger.error(u'Could not format string "%s":'
 
422
                                 u' %s', self.checker_command, error)
497
423
                    return True # Try again later
498
424
            self.current_checker_command = command
499
425
            try:
500
 
                logger.info("Starting checker %r for %s",
 
426
                logger.info(u"Starting checker %r for %s",
501
427
                            command, self.name)
502
428
                # We don't need to redirect stdout and stderr, since
503
429
                # in normal mode, that is already done by daemon(),
505
431
                # always replaced by /dev/null.)
506
432
                self.checker = subprocess.Popen(command,
507
433
                                                close_fds=True,
508
 
                                                shell=True, cwd="/")
 
434
                                                shell=True, cwd=u"/")
509
435
                self.checker_callback_tag = (gobject.child_watch_add
510
436
                                             (self.checker.pid,
511
437
                                              self.checker_callback,
516
442
                if pid:
517
443
                    gobject.source_remove(self.checker_callback_tag)
518
444
                    self.checker_callback(pid, status, command)
519
 
            except OSError as error:
520
 
                logger.error("Failed to start subprocess: %s",
 
445
            except OSError, error:
 
446
                logger.error(u"Failed to start subprocess: %s",
521
447
                             error)
522
448
        # Re-run this periodically if run by gobject.timeout_add
523
449
        return True
527
453
        if self.checker_callback_tag:
528
454
            gobject.source_remove(self.checker_callback_tag)
529
455
            self.checker_callback_tag = None
530
 
        if getattr(self, "checker", None) is None:
 
456
        if getattr(self, u"checker", None) is None:
531
457
            return
532
 
        logger.debug("Stopping checker for %(name)s", vars(self))
 
458
        logger.debug(u"Stopping checker for %(name)s", vars(self))
533
459
        try:
534
460
            os.kill(self.checker.pid, signal.SIGTERM)
535
 
            #time.sleep(0.5)
 
461
            #os.sleep(0.5)
536
462
            #if self.checker.poll() is None:
537
463
            #    os.kill(self.checker.pid, signal.SIGKILL)
538
 
        except OSError as error:
 
464
        except OSError, error:
539
465
            if error.errno != errno.ESRCH: # No such process
540
466
                raise
541
467
        self.checker = None
542
 
 
543
 
def dbus_service_property(dbus_interface, signature="v",
544
 
                          access="readwrite", byte_arrays=False):
545
 
    """Decorators for marking methods of a DBusObjectWithProperties to
546
 
    become properties on the D-Bus.
547
 
    
548
 
    The decorated method will be called with no arguments by "Get"
549
 
    and with one argument by "Set".
550
 
    
551
 
    The parameters, where they are supported, are the same as
552
 
    dbus.service.method, except there is only "signature", since the
553
 
    type from Get() and the type sent to Set() is the same.
554
 
    """
555
 
    # Encoding deeply encoded byte arrays is not supported yet by the
556
 
    # "Set" method, so we fail early here:
557
 
    if byte_arrays and signature != "ay":
558
 
        raise ValueError("Byte arrays not supported for non-'ay'"
559
 
                         " signature %r" % signature)
560
 
    def decorator(func):
561
 
        func._dbus_is_property = True
562
 
        func._dbus_interface = dbus_interface
563
 
        func._dbus_signature = signature
564
 
        func._dbus_access = access
565
 
        func._dbus_name = func.__name__
566
 
        if func._dbus_name.endswith("_dbus_property"):
567
 
            func._dbus_name = func._dbus_name[:-14]
568
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
569
 
        return func
570
 
    return decorator
571
 
 
572
 
 
573
 
class DBusPropertyException(dbus.exceptions.DBusException):
574
 
    """A base class for D-Bus property-related exceptions
575
 
    """
576
 
    def __unicode__(self):
577
 
        return unicode(str(self))
578
 
 
579
 
 
580
 
class DBusPropertyAccessException(DBusPropertyException):
581
 
    """A property's access permissions disallows an operation.
582
 
    """
583
 
    pass
584
 
 
585
 
 
586
 
class DBusPropertyNotFound(DBusPropertyException):
587
 
    """An attempt was made to access a non-existing property.
588
 
    """
589
 
    pass
590
 
 
591
 
 
592
 
class DBusObjectWithProperties(dbus.service.Object):
593
 
    """A D-Bus object with properties.
594
 
 
595
 
    Classes inheriting from this can use the dbus_service_property
596
 
    decorator to expose methods as D-Bus properties.  It exposes the
597
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
598
 
    """
599
 
    
600
 
    @staticmethod
601
 
    def _is_dbus_property(obj):
602
 
        return getattr(obj, "_dbus_is_property", False)
603
 
    
604
 
    def _get_all_dbus_properties(self):
605
 
        """Returns a generator of (name, attribute) pairs
606
 
        """
607
 
        return ((prop._dbus_name, prop)
608
 
                for name, prop in
609
 
                inspect.getmembers(self, self._is_dbus_property))
610
 
    
611
 
    def _get_dbus_property(self, interface_name, property_name):
612
 
        """Returns a bound method if one exists which is a D-Bus
613
 
        property with the specified name and interface.
614
 
        """
615
 
        for name in (property_name,
616
 
                     property_name + "_dbus_property"):
617
 
            prop = getattr(self, name, None)
618
 
            if (prop is None
619
 
                or not self._is_dbus_property(prop)
620
 
                or prop._dbus_name != property_name
621
 
                or (interface_name and prop._dbus_interface
622
 
                    and interface_name != prop._dbus_interface)):
623
 
                continue
624
 
            return prop
625
 
        # No such property
626
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
627
 
                                   + interface_name + "."
628
 
                                   + property_name)
629
 
    
630
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
631
 
                         out_signature="v")
632
 
    def Get(self, interface_name, property_name):
633
 
        """Standard D-Bus property Get() method, see D-Bus standard.
634
 
        """
635
 
        prop = self._get_dbus_property(interface_name, property_name)
636
 
        if prop._dbus_access == "write":
637
 
            raise DBusPropertyAccessException(property_name)
638
 
        value = prop()
639
 
        if not hasattr(value, "variant_level"):
640
 
            return value
641
 
        return type(value)(value, variant_level=value.variant_level+1)
642
 
    
643
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
644
 
    def Set(self, interface_name, property_name, value):
645
 
        """Standard D-Bus property Set() method, see D-Bus standard.
646
 
        """
647
 
        prop = self._get_dbus_property(interface_name, property_name)
648
 
        if prop._dbus_access == "read":
649
 
            raise DBusPropertyAccessException(property_name)
650
 
        if prop._dbus_get_args_options["byte_arrays"]:
651
 
            # The byte_arrays option is not supported yet on
652
 
            # signatures other than "ay".
653
 
            if prop._dbus_signature != "ay":
654
 
                raise ValueError
655
 
            value = dbus.ByteArray(''.join(unichr(byte)
656
 
                                           for byte in value))
657
 
        prop(value)
658
 
    
659
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
660
 
                         out_signature="a{sv}")
661
 
    def GetAll(self, interface_name):
662
 
        """Standard D-Bus property GetAll() method, see D-Bus
663
 
        standard.
664
 
 
665
 
        Note: Will not include properties with access="write".
666
 
        """
667
 
        all = {}
668
 
        for name, prop in self._get_all_dbus_properties():
669
 
            if (interface_name
670
 
                and interface_name != prop._dbus_interface):
671
 
                # Interface non-empty but did not match
672
 
                continue
673
 
            # Ignore write-only properties
674
 
            if prop._dbus_access == "write":
675
 
                continue
676
 
            value = prop()
677
 
            if not hasattr(value, "variant_level"):
678
 
                all[name] = value
679
 
                continue
680
 
            all[name] = type(value)(value, variant_level=
681
 
                                    value.variant_level+1)
682
 
        return dbus.Dictionary(all, signature="sv")
683
 
    
684
 
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
685
 
                         out_signature="s",
686
 
                         path_keyword='object_path',
687
 
                         connection_keyword='connection')
688
 
    def Introspect(self, object_path, connection):
689
 
        """Standard D-Bus method, overloaded to insert property tags.
690
 
        """
691
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
692
 
                                                   connection)
693
 
        try:
694
 
            document = xml.dom.minidom.parseString(xmlstring)
695
 
            def make_tag(document, name, prop):
696
 
                e = document.createElement("property")
697
 
                e.setAttribute("name", name)
698
 
                e.setAttribute("type", prop._dbus_signature)
699
 
                e.setAttribute("access", prop._dbus_access)
700
 
                return e
701
 
            for if_tag in document.getElementsByTagName("interface"):
702
 
                for tag in (make_tag(document, name, prop)
703
 
                            for name, prop
704
 
                            in self._get_all_dbus_properties()
705
 
                            if prop._dbus_interface
706
 
                            == if_tag.getAttribute("name")):
707
 
                    if_tag.appendChild(tag)
708
 
                # Add the names to the return values for the
709
 
                # "org.freedesktop.DBus.Properties" methods
710
 
                if (if_tag.getAttribute("name")
711
 
                    == "org.freedesktop.DBus.Properties"):
712
 
                    for cn in if_tag.getElementsByTagName("method"):
713
 
                        if cn.getAttribute("name") == "Get":
714
 
                            for arg in cn.getElementsByTagName("arg"):
715
 
                                if (arg.getAttribute("direction")
716
 
                                    == "out"):
717
 
                                    arg.setAttribute("name", "value")
718
 
                        elif cn.getAttribute("name") == "GetAll":
719
 
                            for arg in cn.getElementsByTagName("arg"):
720
 
                                if (arg.getAttribute("direction")
721
 
                                    == "out"):
722
 
                                    arg.setAttribute("name", "props")
723
 
            xmlstring = document.toxml("utf-8")
724
 
            document.unlink()
725
 
        except (AttributeError, xml.dom.DOMException,
726
 
                xml.parsers.expat.ExpatError) as error:
727
 
            logger.error("Failed to override Introspection method",
728
 
                         error)
729
 
        return xmlstring
730
 
 
731
 
 
732
 
class ClientDBus(Client, DBusObjectWithProperties):
 
468
    
 
469
    def still_valid(self):
 
470
        """Has the timeout not yet passed for this client?"""
 
471
        if not getattr(self, u"enabled", False):
 
472
            return False
 
473
        now = datetime.datetime.utcnow()
 
474
        if self.last_checked_ok is None:
 
475
            return now < (self.created + self.timeout)
 
476
        else:
 
477
            return now < (self.last_checked_ok + self.timeout)
 
478
 
 
479
 
 
480
class ClientDBus(Client, dbus.service.Object):
733
481
    """A Client class using D-Bus
734
482
    
735
483
    Attributes:
736
484
    dbus_object_path: dbus.ObjectPath
737
485
    bus: dbus.SystemBus()
738
486
    """
739
 
    
740
 
    runtime_expansions = (Client.runtime_expansions
741
 
                          + ("dbus_object_path",))
742
 
    
743
487
    # dbus.service.Object doesn't use super(), so we can't either.
744
488
    
745
489
    def __init__(self, bus = None, *args, **kwargs):
746
 
        self._approvals_pending = 0
747
490
        self.bus = bus
748
491
        Client.__init__(self, *args, **kwargs)
749
492
        # Only now, when this client is initialized, can it show up on
750
493
        # the D-Bus
751
 
        client_object_name = unicode(self.name).translate(
752
 
            {ord("."): ord("_"),
753
 
             ord("-"): ord("_")})
754
494
        self.dbus_object_path = (dbus.ObjectPath
755
 
                                 ("/clients/" + client_object_name))
756
 
        DBusObjectWithProperties.__init__(self, self.bus,
757
 
                                          self.dbus_object_path)
758
 
        
759
 
    def _get_approvals_pending(self):
760
 
        return self._approvals_pending
761
 
    def _set_approvals_pending(self, value):
762
 
        old_value = self._approvals_pending
763
 
        self._approvals_pending = value
764
 
        bval = bool(value)
765
 
        if (hasattr(self, "dbus_object_path")
766
 
            and bval is not bool(old_value)):
767
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
768
 
            self.PropertyChanged(dbus.String("ApprovalPending"),
769
 
                                 dbus_bool)
770
 
 
771
 
    approvals_pending = property(_get_approvals_pending,
772
 
                                 _set_approvals_pending)
773
 
    del _get_approvals_pending, _set_approvals_pending
 
495
                                 (u"/clients/"
 
496
                                  + self.name.replace(u".", u"_")))
 
497
        dbus.service.Object.__init__(self, self.bus,
 
498
                                     self.dbus_object_path)
774
499
    
775
500
    @staticmethod
776
501
    def _datetime_to_dbus(dt, variant_level=0):
779
504
                           variant_level=variant_level)
780
505
    
781
506
    def enable(self):
782
 
        oldstate = getattr(self, "enabled", False)
 
507
        oldstate = getattr(self, u"enabled", False)
783
508
        r = Client.enable(self)
784
509
        if oldstate != self.enabled:
785
510
            # Emit D-Bus signals
786
 
            self.PropertyChanged(dbus.String("Enabled"),
 
511
            self.PropertyChanged(dbus.String(u"enabled"),
787
512
                                 dbus.Boolean(True, variant_level=1))
788
513
            self.PropertyChanged(
789
 
                dbus.String("LastEnabled"),
 
514
                dbus.String(u"last_enabled"),
790
515
                self._datetime_to_dbus(self.last_enabled,
791
516
                                       variant_level=1))
792
517
        return r
793
518
    
794
 
    def disable(self, quiet = False):
795
 
        oldstate = getattr(self, "enabled", False)
796
 
        r = Client.disable(self, quiet=quiet)
797
 
        if not quiet and oldstate != self.enabled:
 
519
    def disable(self, signal = True):
 
520
        oldstate = getattr(self, u"enabled", False)
 
521
        r = Client.disable(self)
 
522
        if signal and oldstate != self.enabled:
798
523
            # Emit D-Bus signal
799
 
            self.PropertyChanged(dbus.String("Enabled"),
 
524
            self.PropertyChanged(dbus.String(u"enabled"),
800
525
                                 dbus.Boolean(False, variant_level=1))
801
526
        return r
802
527
    
805
530
            self.remove_from_connection()
806
531
        except LookupError:
807
532
            pass
808
 
        if hasattr(DBusObjectWithProperties, "__del__"):
809
 
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
 
533
        if hasattr(dbus.service.Object, u"__del__"):
 
534
            dbus.service.Object.__del__(self, *args, **kwargs)
810
535
        Client.__del__(self, *args, **kwargs)
811
536
    
812
537
    def checker_callback(self, pid, condition, command,
814
539
        self.checker_callback_tag = None
815
540
        self.checker = None
816
541
        # Emit D-Bus signal
817
 
        self.PropertyChanged(dbus.String("CheckerRunning"),
 
542
        self.PropertyChanged(dbus.String(u"checker_running"),
818
543
                             dbus.Boolean(False, variant_level=1))
819
544
        if os.WIFEXITED(condition):
820
545
            exitstatus = os.WEXITSTATUS(condition)
832
557
                                       *args, **kwargs)
833
558
    
834
559
    def checked_ok(self, *args, **kwargs):
835
 
        Client.checked_ok(self, *args, **kwargs)
 
560
        r = Client.checked_ok(self, *args, **kwargs)
836
561
        # Emit D-Bus signal
837
562
        self.PropertyChanged(
838
 
            dbus.String("LastCheckedOK"),
 
563
            dbus.String(u"last_checked_ok"),
839
564
            (self._datetime_to_dbus(self.last_checked_ok,
840
565
                                    variant_level=1)))
841
 
    
842
 
    def need_approval(self, *args, **kwargs):
843
 
        r = Client.need_approval(self, *args, **kwargs)
844
 
        # Emit D-Bus signal
845
 
        self.PropertyChanged(
846
 
            dbus.String("LastApprovalRequest"),
847
 
            (self._datetime_to_dbus(self.last_approval_request,
848
 
                                    variant_level=1)))
849
566
        return r
850
567
    
851
568
    def start_checker(self, *args, **kwargs):
861
578
            # Emit D-Bus signal
862
579
            self.CheckerStarted(self.current_checker_command)
863
580
            self.PropertyChanged(
864
 
                dbus.String("CheckerRunning"),
 
581
                dbus.String(u"checker_running"),
865
582
                dbus.Boolean(True, variant_level=1))
866
583
        return r
867
584
    
868
585
    def stop_checker(self, *args, **kwargs):
869
 
        old_checker = getattr(self, "checker", None)
 
586
        old_checker = getattr(self, u"checker", None)
870
587
        r = Client.stop_checker(self, *args, **kwargs)
871
588
        if (old_checker is not None
872
 
            and getattr(self, "checker", None) is None):
873
 
            self.PropertyChanged(dbus.String("CheckerRunning"),
 
589
            and getattr(self, u"checker", None) is None):
 
590
            self.PropertyChanged(dbus.String(u"checker_running"),
874
591
                                 dbus.Boolean(False, variant_level=1))
875
592
        return r
876
 
 
877
 
    def _reset_approved(self):
878
 
        self._approved = None
879
 
        return False
880
 
    
881
 
    def approve(self, value=True):
882
 
        self.send_changedstate()
883
 
        self._approved = value
884
 
        gobject.timeout_add(self._timedelta_to_milliseconds
885
 
                            (self.approval_duration),
886
 
                            self._reset_approved)
887
 
    
888
 
    
889
 
    ## D-Bus methods, signals & properties
890
 
    _interface = "se.bsnet.fukt.Mandos.Client"
891
 
    
892
 
    ## Signals
 
593
    
 
594
    ## D-Bus methods & signals
 
595
    _interface = u"se.bsnet.fukt.Mandos.Client"
 
596
    
 
597
    # CheckedOK - method
 
598
    @dbus.service.method(_interface)
 
599
    def CheckedOK(self):
 
600
        return self.checked_ok()
893
601
    
894
602
    # CheckerCompleted - signal
895
 
    @dbus.service.signal(_interface, signature="nxs")
 
603
    @dbus.service.signal(_interface, signature=u"nxs")
896
604
    def CheckerCompleted(self, exitcode, waitstatus, command):
897
605
        "D-Bus signal"
898
606
        pass
899
607
    
900
608
    # CheckerStarted - signal
901
 
    @dbus.service.signal(_interface, signature="s")
 
609
    @dbus.service.signal(_interface, signature=u"s")
902
610
    def CheckerStarted(self, command):
903
611
        "D-Bus signal"
904
612
        pass
905
613
    
 
614
    # GetAllProperties - method
 
615
    @dbus.service.method(_interface, out_signature=u"a{sv}")
 
616
    def GetAllProperties(self):
 
617
        "D-Bus method"
 
618
        return dbus.Dictionary({
 
619
                dbus.String(u"name"):
 
620
                    dbus.String(self.name, variant_level=1),
 
621
                dbus.String(u"fingerprint"):
 
622
                    dbus.String(self.fingerprint, variant_level=1),
 
623
                dbus.String(u"host"):
 
624
                    dbus.String(self.host, variant_level=1),
 
625
                dbus.String(u"created"):
 
626
                    self._datetime_to_dbus(self.created,
 
627
                                           variant_level=1),
 
628
                dbus.String(u"last_enabled"):
 
629
                    (self._datetime_to_dbus(self.last_enabled,
 
630
                                            variant_level=1)
 
631
                     if self.last_enabled is not None
 
632
                     else dbus.Boolean(False, variant_level=1)),
 
633
                dbus.String(u"enabled"):
 
634
                    dbus.Boolean(self.enabled, variant_level=1),
 
635
                dbus.String(u"last_checked_ok"):
 
636
                    (self._datetime_to_dbus(self.last_checked_ok,
 
637
                                            variant_level=1)
 
638
                     if self.last_checked_ok is not None
 
639
                     else dbus.Boolean (False, variant_level=1)),
 
640
                dbus.String(u"timeout"):
 
641
                    dbus.UInt64(self.timeout_milliseconds(),
 
642
                                variant_level=1),
 
643
                dbus.String(u"interval"):
 
644
                    dbus.UInt64(self.interval_milliseconds(),
 
645
                                variant_level=1),
 
646
                dbus.String(u"checker"):
 
647
                    dbus.String(self.checker_command,
 
648
                                variant_level=1),
 
649
                dbus.String(u"checker_running"):
 
650
                    dbus.Boolean(self.checker is not None,
 
651
                                 variant_level=1),
 
652
                dbus.String(u"object_path"):
 
653
                    dbus.ObjectPath(self.dbus_object_path,
 
654
                                    variant_level=1)
 
655
                }, signature=u"sv")
 
656
    
 
657
    # IsStillValid - method
 
658
    @dbus.service.method(_interface, out_signature=u"b")
 
659
    def IsStillValid(self):
 
660
        return self.still_valid()
 
661
    
906
662
    # PropertyChanged - signal
907
 
    @dbus.service.signal(_interface, signature="sv")
 
663
    @dbus.service.signal(_interface, signature=u"sv")
908
664
    def PropertyChanged(self, property, value):
909
665
        "D-Bus signal"
910
666
        pass
911
667
    
912
 
    # GotSecret - signal
 
668
    # ReceivedSecret - signal
913
669
    @dbus.service.signal(_interface)
914
 
    def GotSecret(self):
915
 
        """D-Bus signal
916
 
        Is sent after a successful transfer of secret from the Mandos
917
 
        server to mandos-client
918
 
        """
 
670
    def ReceivedSecret(self):
 
671
        "D-Bus signal"
919
672
        pass
920
673
    
921
674
    # Rejected - signal
922
 
    @dbus.service.signal(_interface, signature="s")
923
 
    def Rejected(self, reason):
 
675
    @dbus.service.signal(_interface)
 
676
    def Rejected(self):
924
677
        "D-Bus signal"
925
678
        pass
926
679
    
927
 
    # NeedApproval - signal
928
 
    @dbus.service.signal(_interface, signature="tb")
929
 
    def NeedApproval(self, timeout, default):
930
 
        "D-Bus signal"
931
 
        return self.need_approval()
932
 
    
933
 
    ## Methods
934
 
    
935
 
    # Approve - method
936
 
    @dbus.service.method(_interface, in_signature="b")
937
 
    def Approve(self, value):
938
 
        self.approve(value)
939
 
    
940
 
    # CheckedOK - method
941
 
    @dbus.service.method(_interface)
942
 
    def CheckedOK(self):
943
 
        self.checked_ok()
 
680
    # SetChecker - method
 
681
    @dbus.service.method(_interface, in_signature=u"s")
 
682
    def SetChecker(self, checker):
 
683
        "D-Bus setter method"
 
684
        self.checker_command = checker
 
685
        # Emit D-Bus signal
 
686
        self.PropertyChanged(dbus.String(u"checker"),
 
687
                             dbus.String(self.checker_command,
 
688
                                         variant_level=1))
 
689
    
 
690
    # SetHost - method
 
691
    @dbus.service.method(_interface, in_signature=u"s")
 
692
    def SetHost(self, host):
 
693
        "D-Bus setter method"
 
694
        self.host = host
 
695
        # Emit D-Bus signal
 
696
        self.PropertyChanged(dbus.String(u"host"),
 
697
                             dbus.String(self.host, variant_level=1))
 
698
    
 
699
    # SetInterval - method
 
700
    @dbus.service.method(_interface, in_signature=u"t")
 
701
    def SetInterval(self, milliseconds):
 
702
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
 
703
        # Emit D-Bus signal
 
704
        self.PropertyChanged(dbus.String(u"interval"),
 
705
                             (dbus.UInt64(self.interval_milliseconds(),
 
706
                                          variant_level=1)))
 
707
    
 
708
    # SetSecret - method
 
709
    @dbus.service.method(_interface, in_signature=u"ay",
 
710
                         byte_arrays=True)
 
711
    def SetSecret(self, secret):
 
712
        "D-Bus setter method"
 
713
        self.secret = str(secret)
 
714
    
 
715
    # SetTimeout - method
 
716
    @dbus.service.method(_interface, in_signature=u"t")
 
717
    def SetTimeout(self, milliseconds):
 
718
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
 
719
        # Emit D-Bus signal
 
720
        self.PropertyChanged(dbus.String(u"timeout"),
 
721
                             (dbus.UInt64(self.timeout_milliseconds(),
 
722
                                          variant_level=1)))
944
723
    
945
724
    # Enable - method
946
725
    @dbus.service.method(_interface)
965
744
    def StopChecker(self):
966
745
        self.stop_checker()
967
746
    
968
 
    ## Properties
969
 
    
970
 
    # ApprovalPending - property
971
 
    @dbus_service_property(_interface, signature="b", access="read")
972
 
    def ApprovalPending_dbus_property(self):
973
 
        return dbus.Boolean(bool(self.approvals_pending))
974
 
    
975
 
    # ApprovedByDefault - property
976
 
    @dbus_service_property(_interface, signature="b",
977
 
                           access="readwrite")
978
 
    def ApprovedByDefault_dbus_property(self, value=None):
979
 
        if value is None:       # get
980
 
            return dbus.Boolean(self.approved_by_default)
981
 
        self.approved_by_default = bool(value)
982
 
        # Emit D-Bus signal
983
 
        self.PropertyChanged(dbus.String("ApprovedByDefault"),
984
 
                             dbus.Boolean(value, variant_level=1))
985
 
    
986
 
    # ApprovalDelay - property
987
 
    @dbus_service_property(_interface, signature="t",
988
 
                           access="readwrite")
989
 
    def ApprovalDelay_dbus_property(self, value=None):
990
 
        if value is None:       # get
991
 
            return dbus.UInt64(self.approval_delay_milliseconds())
992
 
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
993
 
        # Emit D-Bus signal
994
 
        self.PropertyChanged(dbus.String("ApprovalDelay"),
995
 
                             dbus.UInt64(value, variant_level=1))
996
 
    
997
 
    # ApprovalDuration - property
998
 
    @dbus_service_property(_interface, signature="t",
999
 
                           access="readwrite")
1000
 
    def ApprovalDuration_dbus_property(self, value=None):
1001
 
        if value is None:       # get
1002
 
            return dbus.UInt64(self._timedelta_to_milliseconds(
1003
 
                    self.approval_duration))
1004
 
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1005
 
        # Emit D-Bus signal
1006
 
        self.PropertyChanged(dbus.String("ApprovalDuration"),
1007
 
                             dbus.UInt64(value, variant_level=1))
1008
 
    
1009
 
    # Name - property
1010
 
    @dbus_service_property(_interface, signature="s", access="read")
1011
 
    def Name_dbus_property(self):
1012
 
        return dbus.String(self.name)
1013
 
    
1014
 
    # Fingerprint - property
1015
 
    @dbus_service_property(_interface, signature="s", access="read")
1016
 
    def Fingerprint_dbus_property(self):
1017
 
        return dbus.String(self.fingerprint)
1018
 
    
1019
 
    # Host - property
1020
 
    @dbus_service_property(_interface, signature="s",
1021
 
                           access="readwrite")
1022
 
    def Host_dbus_property(self, value=None):
1023
 
        if value is None:       # get
1024
 
            return dbus.String(self.host)
1025
 
        self.host = value
1026
 
        # Emit D-Bus signal
1027
 
        self.PropertyChanged(dbus.String("Host"),
1028
 
                             dbus.String(value, variant_level=1))
1029
 
    
1030
 
    # Created - property
1031
 
    @dbus_service_property(_interface, signature="s", access="read")
1032
 
    def Created_dbus_property(self):
1033
 
        return dbus.String(self._datetime_to_dbus(self.created))
1034
 
    
1035
 
    # LastEnabled - property
1036
 
    @dbus_service_property(_interface, signature="s", access="read")
1037
 
    def LastEnabled_dbus_property(self):
1038
 
        if self.last_enabled is None:
1039
 
            return dbus.String("")
1040
 
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
1041
 
    
1042
 
    # Enabled - property
1043
 
    @dbus_service_property(_interface, signature="b",
1044
 
                           access="readwrite")
1045
 
    def Enabled_dbus_property(self, value=None):
1046
 
        if value is None:       # get
1047
 
            return dbus.Boolean(self.enabled)
1048
 
        if value:
1049
 
            self.enable()
1050
 
        else:
1051
 
            self.disable()
1052
 
    
1053
 
    # LastCheckedOK - property
1054
 
    @dbus_service_property(_interface, signature="s",
1055
 
                           access="readwrite")
1056
 
    def LastCheckedOK_dbus_property(self, value=None):
1057
 
        if value is not None:
1058
 
            self.checked_ok()
1059
 
            return
1060
 
        if self.last_checked_ok is None:
1061
 
            return dbus.String("")
1062
 
        return dbus.String(self._datetime_to_dbus(self
1063
 
                                                  .last_checked_ok))
1064
 
    
1065
 
    # LastApprovalRequest - property
1066
 
    @dbus_service_property(_interface, signature="s", access="read")
1067
 
    def LastApprovalRequest_dbus_property(self):
1068
 
        if self.last_approval_request is None:
1069
 
            return dbus.String("")
1070
 
        return dbus.String(self.
1071
 
                           _datetime_to_dbus(self
1072
 
                                             .last_approval_request))
1073
 
    
1074
 
    # Timeout - property
1075
 
    @dbus_service_property(_interface, signature="t",
1076
 
                           access="readwrite")
1077
 
    def Timeout_dbus_property(self, value=None):
1078
 
        if value is None:       # get
1079
 
            return dbus.UInt64(self.timeout_milliseconds())
1080
 
        self.timeout = datetime.timedelta(0, 0, 0, value)
1081
 
        # Emit D-Bus signal
1082
 
        self.PropertyChanged(dbus.String("Timeout"),
1083
 
                             dbus.UInt64(value, variant_level=1))
1084
 
        if getattr(self, "disable_initiator_tag", None) is None:
1085
 
            return
1086
 
        # Reschedule timeout
1087
 
        gobject.source_remove(self.disable_initiator_tag)
1088
 
        self.disable_initiator_tag = None
1089
 
        time_to_die = (self.
1090
 
                       _timedelta_to_milliseconds((self
1091
 
                                                   .last_checked_ok
1092
 
                                                   + self.timeout)
1093
 
                                                  - datetime.datetime
1094
 
                                                  .utcnow()))
1095
 
        if time_to_die <= 0:
1096
 
            # The timeout has passed
1097
 
            self.disable()
1098
 
        else:
1099
 
            self.disable_initiator_tag = (gobject.timeout_add
1100
 
                                          (time_to_die, self.disable))
1101
 
    
1102
 
    # Interval - property
1103
 
    @dbus_service_property(_interface, signature="t",
1104
 
                           access="readwrite")
1105
 
    def Interval_dbus_property(self, value=None):
1106
 
        if value is None:       # get
1107
 
            return dbus.UInt64(self.interval_milliseconds())
1108
 
        self.interval = datetime.timedelta(0, 0, 0, value)
1109
 
        # Emit D-Bus signal
1110
 
        self.PropertyChanged(dbus.String("Interval"),
1111
 
                             dbus.UInt64(value, variant_level=1))
1112
 
        if getattr(self, "checker_initiator_tag", None) is None:
1113
 
            return
1114
 
        # Reschedule checker run
1115
 
        gobject.source_remove(self.checker_initiator_tag)
1116
 
        self.checker_initiator_tag = (gobject.timeout_add
1117
 
                                      (value, self.start_checker))
1118
 
        self.start_checker()    # Start one now, too
1119
 
 
1120
 
    # Checker - property
1121
 
    @dbus_service_property(_interface, signature="s",
1122
 
                           access="readwrite")
1123
 
    def Checker_dbus_property(self, value=None):
1124
 
        if value is None:       # get
1125
 
            return dbus.String(self.checker_command)
1126
 
        self.checker_command = value
1127
 
        # Emit D-Bus signal
1128
 
        self.PropertyChanged(dbus.String("Checker"),
1129
 
                             dbus.String(self.checker_command,
1130
 
                                         variant_level=1))
1131
 
    
1132
 
    # CheckerRunning - property
1133
 
    @dbus_service_property(_interface, signature="b",
1134
 
                           access="readwrite")
1135
 
    def CheckerRunning_dbus_property(self, value=None):
1136
 
        if value is None:       # get
1137
 
            return dbus.Boolean(self.checker is not None)
1138
 
        if value:
1139
 
            self.start_checker()
1140
 
        else:
1141
 
            self.stop_checker()
1142
 
    
1143
 
    # ObjectPath - property
1144
 
    @dbus_service_property(_interface, signature="o", access="read")
1145
 
    def ObjectPath_dbus_property(self):
1146
 
        return self.dbus_object_path # is already a dbus.ObjectPath
1147
 
    
1148
 
    # Secret = property
1149
 
    @dbus_service_property(_interface, signature="ay",
1150
 
                           access="write", byte_arrays=True)
1151
 
    def Secret_dbus_property(self, value):
1152
 
        self.secret = str(value)
1153
 
    
1154
747
    del _interface
1155
748
 
1156
749
 
1157
 
class ProxyClient(object):
1158
 
    def __init__(self, child_pipe, fpr, address):
1159
 
        self._pipe = child_pipe
1160
 
        self._pipe.send(('init', fpr, address))
1161
 
        if not self._pipe.recv():
1162
 
            raise KeyError()
1163
 
 
1164
 
    def __getattribute__(self, name):
1165
 
        if(name == '_pipe'):
1166
 
            return super(ProxyClient, self).__getattribute__(name)
1167
 
        self._pipe.send(('getattr', name))
1168
 
        data = self._pipe.recv()
1169
 
        if data[0] == 'data':
1170
 
            return data[1]
1171
 
        if data[0] == 'function':
1172
 
            def func(*args, **kwargs):
1173
 
                self._pipe.send(('funcall', name, args, kwargs))
1174
 
                return self._pipe.recv()[1]
1175
 
            return func
1176
 
 
1177
 
    def __setattr__(self, name, value):
1178
 
        if(name == '_pipe'):
1179
 
            return super(ProxyClient, self).__setattr__(name, value)
1180
 
        self._pipe.send(('setattr', name, value))
1181
 
 
1182
 
 
1183
750
class ClientHandler(socketserver.BaseRequestHandler, object):
1184
751
    """A class to handle client connections.
1185
752
    
1187
754
    Note: This will run in its own forked process."""
1188
755
    
1189
756
    def handle(self):
1190
 
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1191
 
            logger.info("TCP connection from: %s",
1192
 
                        unicode(self.client_address))
1193
 
            logger.debug("Pipe FD: %d",
1194
 
                         self.server.child_pipe.fileno())
1195
 
 
 
757
        logger.info(u"TCP connection from: %s",
 
758
                    unicode(self.client_address))
 
759
        logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
 
760
        # Open IPC pipe to parent process
 
761
        with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1196
762
            session = (gnutls.connection
1197
763
                       .ClientSession(self.request,
1198
764
                                      gnutls.connection
1199
765
                                      .X509Credentials()))
1200
 
 
 
766
            
 
767
            line = self.request.makefile().readline()
 
768
            logger.debug(u"Protocol version: %r", line)
 
769
            try:
 
770
                if int(line.strip().split()[0]) > 1:
 
771
                    raise RuntimeError
 
772
            except (ValueError, IndexError, RuntimeError), error:
 
773
                logger.error(u"Unknown protocol version: %s", error)
 
774
                return
 
775
            
1201
776
            # Note: gnutls.connection.X509Credentials is really a
1202
777
            # generic GnuTLS certificate credentials object so long as
1203
778
            # no X.509 keys are added to it.  Therefore, we can use it
1204
779
            # here despite using OpenPGP certificates.
1205
 
 
1206
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1207
 
            #                      "+AES-256-CBC", "+SHA1",
1208
 
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1209
 
            #                      "+DHE-DSS"))
 
780
            
 
781
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
 
782
            #                      u"+AES-256-CBC", u"+SHA1",
 
783
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
 
784
            #                      u"+DHE-DSS"))
1210
785
            # Use a fallback default, since this MUST be set.
1211
786
            priority = self.server.gnutls_priority
1212
787
            if priority is None:
1213
 
                priority = "NORMAL"
 
788
                priority = u"NORMAL"
1214
789
            (gnutls.library.functions
1215
790
             .gnutls_priority_set_direct(session._c_object,
1216
791
                                         priority, None))
1217
 
 
1218
 
            # Start communication using the Mandos protocol
1219
 
            # Get protocol number
1220
 
            line = self.request.makefile().readline()
1221
 
            logger.debug("Protocol version: %r", line)
1222
 
            try:
1223
 
                if int(line.strip().split()[0]) > 1:
1224
 
                    raise RuntimeError
1225
 
            except (ValueError, IndexError, RuntimeError) as error:
1226
 
                logger.error("Unknown protocol version: %s", error)
1227
 
                return
1228
 
 
1229
 
            # Start GnuTLS connection
 
792
            
1230
793
            try:
1231
794
                session.handshake()
1232
 
            except gnutls.errors.GNUTLSError as error:
1233
 
                logger.warning("Handshake failed: %s", error)
 
795
            except gnutls.errors.GNUTLSError, error:
 
796
                logger.warning(u"Handshake failed: %s", error)
1234
797
                # Do not run session.bye() here: the session is not
1235
798
                # established.  Just abandon the request.
1236
799
                return
1237
 
            logger.debug("Handshake succeeded")
1238
 
 
1239
 
            approval_required = False
 
800
            logger.debug(u"Handshake succeeded")
1240
801
            try:
1241
 
                try:
1242
 
                    fpr = self.fingerprint(self.peer_certificate
1243
 
                                           (session))
1244
 
                except (TypeError,
1245
 
                        gnutls.errors.GNUTLSError) as error:
1246
 
                    logger.warning("Bad certificate: %s", error)
1247
 
                    return
1248
 
                logger.debug("Fingerprint: %s", fpr)
1249
 
 
1250
 
                try:
1251
 
                    client = ProxyClient(child_pipe, fpr,
1252
 
                                         self.client_address)
1253
 
                except KeyError:
1254
 
                    return
1255
 
                
1256
 
                if client.approval_delay:
1257
 
                    delay = client.approval_delay
1258
 
                    client.approvals_pending += 1
1259
 
                    approval_required = True
1260
 
                
1261
 
                while True:
1262
 
                    if not client.enabled:
1263
 
                        logger.warning("Client %s is disabled",
1264
 
                                       client.name)
1265
 
                        if self.server.use_dbus:
1266
 
                            # Emit D-Bus signal
1267
 
                            client.Rejected("Disabled")                    
1268
 
                        return
1269
 
                    
1270
 
                    if client._approved or not client.approval_delay:
1271
 
                        #We are approved or approval is disabled
1272
 
                        break
1273
 
                    elif client._approved is None:
1274
 
                        logger.info("Client %s needs approval",
1275
 
                                    client.name)
1276
 
                        if self.server.use_dbus:
1277
 
                            # Emit D-Bus signal
1278
 
                            client.NeedApproval(
1279
 
                                client.approval_delay_milliseconds(),
1280
 
                                client.approved_by_default)
1281
 
                    else:
1282
 
                        logger.warning("Client %s was not approved",
1283
 
                                       client.name)
1284
 
                        if self.server.use_dbus:
1285
 
                            # Emit D-Bus signal
1286
 
                            client.Rejected("Denied")
1287
 
                        return
1288
 
                    
1289
 
                    #wait until timeout or approved
1290
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1291
 
                    time = datetime.datetime.now()
1292
 
                    client.changedstate.acquire()
1293
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1294
 
                    client.changedstate.release()
1295
 
                    time2 = datetime.datetime.now()
1296
 
                    if (time2 - time) >= delay:
1297
 
                        if not client.approved_by_default:
1298
 
                            logger.warning("Client %s timed out while"
1299
 
                                           " waiting for approval",
1300
 
                                           client.name)
1301
 
                            if self.server.use_dbus:
1302
 
                                # Emit D-Bus signal
1303
 
                                client.Rejected("Approval timed out")
1304
 
                            return
1305
 
                        else:
1306
 
                            break
1307
 
                    else:
1308
 
                        delay -= time2 - time
1309
 
                
1310
 
                sent_size = 0
1311
 
                while sent_size < len(client.secret):
1312
 
                    try:
1313
 
                        sent = session.send(client.secret[sent_size:])
1314
 
                    except gnutls.errors.GNUTLSError as error:
1315
 
                        logger.warning("gnutls send failed")
1316
 
                        return
1317
 
                    logger.debug("Sent: %d, remaining: %d",
1318
 
                                 sent, len(client.secret)
1319
 
                                 - (sent_size + sent))
1320
 
                    sent_size += sent
1321
 
 
1322
 
                logger.info("Sending secret to %s", client.name)
1323
 
                # bump the timeout as if seen
1324
 
                client.checked_ok()
1325
 
                if self.server.use_dbus:
1326
 
                    # Emit D-Bus signal
1327
 
                    client.GotSecret()
 
802
                fpr = self.fingerprint(self.peer_certificate(session))
 
803
            except (TypeError, gnutls.errors.GNUTLSError), error:
 
804
                logger.warning(u"Bad certificate: %s", error)
 
805
                session.bye()
 
806
                return
 
807
            logger.debug(u"Fingerprint: %s", fpr)
1328
808
            
1329
 
            finally:
1330
 
                if approval_required:
1331
 
                    client.approvals_pending -= 1
1332
 
                try:
1333
 
                    session.bye()
1334
 
                except gnutls.errors.GNUTLSError as error:
1335
 
                    logger.warning("GnuTLS bye failed")
 
809
            for c in self.server.clients:
 
810
                if c.fingerprint == fpr:
 
811
                    client = c
 
812
                    break
 
813
            else:
 
814
                ipc.write(u"NOTFOUND %s\n" % fpr)
 
815
                session.bye()
 
816
                return
 
817
            # Have to check if client.still_valid(), since it is
 
818
            # possible that the client timed out while establishing
 
819
            # the GnuTLS session.
 
820
            if not client.still_valid():
 
821
                ipc.write(u"INVALID %s\n" % client.name)
 
822
                session.bye()
 
823
                return
 
824
            ipc.write(u"SENDING %s\n" % client.name)
 
825
            sent_size = 0
 
826
            while sent_size < len(client.secret):
 
827
                sent = session.send(client.secret[sent_size:])
 
828
                logger.debug(u"Sent: %d, remaining: %d",
 
829
                             sent, len(client.secret)
 
830
                             - (sent_size + sent))
 
831
                sent_size += sent
 
832
            session.bye()
1336
833
    
1337
834
    @staticmethod
1338
835
    def peer_certificate(session):
1348
845
                     .gnutls_certificate_get_peers
1349
846
                     (session._c_object, ctypes.byref(list_size)))
1350
847
        if not bool(cert_list) and list_size.value != 0:
1351
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1352
 
                                            " certificate")
 
848
            raise gnutls.errors.GNUTLSError(u"error getting peer"
 
849
                                            u" certificate")
1353
850
        if list_size.value == 0:
1354
851
            return None
1355
852
        cert = cert_list[0]
1381
878
        if crtverify.value != 0:
1382
879
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1383
880
            raise (gnutls.errors.CertificateSecurityError
1384
 
                   ("Verify failed"))
 
881
                   (u"Verify failed"))
1385
882
        # New buffer for the fingerprint
1386
883
        buf = ctypes.create_string_buffer(20)
1387
884
        buf_len = ctypes.c_size_t()
1394
891
        # Convert the buffer to a Python bytestring
1395
892
        fpr = ctypes.string_at(buf, buf_len.value)
1396
893
        # Convert the bytestring to hexadecimal notation
1397
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
894
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1398
895
        return hex_fpr
1399
896
 
1400
897
 
1401
 
class MultiprocessingMixIn(object):
1402
 
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1403
 
    def sub_process_main(self, request, address):
1404
 
        try:
1405
 
            self.finish_request(request, address)
1406
 
        except:
1407
 
            self.handle_error(request, address)
1408
 
        self.close_request(request)
1409
 
            
1410
 
    def process_request(self, request, address):
1411
 
        """Start a new process to process the request."""
1412
 
        multiprocessing.Process(target = self.sub_process_main,
1413
 
                                args = (request, address)).start()
1414
 
 
1415
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1416
 
    """ adds a pipe to the MixIn """
 
898
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
 
899
    """Like socketserver.ForkingMixIn, but also pass a pipe."""
1417
900
    def process_request(self, request, client_address):
1418
901
        """Overrides and wraps the original process_request().
1419
902
        
1420
 
        This function creates a new pipe in self.pipe
 
903
        This function creates a new pipe in self.pipe 
1421
904
        """
1422
 
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1423
 
 
1424
 
        super(MultiprocessingMixInWithPipe,
 
905
        self.pipe = os.pipe()
 
906
        super(ForkingMixInWithPipe,
1425
907
              self).process_request(request, client_address)
1426
 
        self.child_pipe.close()
1427
 
        self.add_pipe(parent_pipe)
1428
 
 
1429
 
    def add_pipe(self, parent_pipe):
 
908
        os.close(self.pipe[1])  # close write end
 
909
        self.add_pipe(self.pipe[0])
 
910
    def add_pipe(self, pipe):
1430
911
        """Dummy function; override as necessary"""
1431
 
        raise NotImplementedError
1432
 
 
1433
 
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
 
912
        os.close(pipe)
 
913
 
 
914
 
 
915
class IPv6_TCPServer(ForkingMixInWithPipe,
1434
916
                     socketserver.TCPServer, object):
1435
917
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1436
918
    
1452
934
        bind to an address or port if they were not specified."""
1453
935
        if self.interface is not None:
1454
936
            if SO_BINDTODEVICE is None:
1455
 
                logger.error("SO_BINDTODEVICE does not exist;"
1456
 
                             " cannot bind to interface %s",
 
937
                logger.error(u"SO_BINDTODEVICE does not exist;"
 
938
                             u" cannot bind to interface %s",
1457
939
                             self.interface)
1458
940
            else:
1459
941
                try:
1460
942
                    self.socket.setsockopt(socket.SOL_SOCKET,
1461
943
                                           SO_BINDTODEVICE,
1462
944
                                           str(self.interface
1463
 
                                               + '\0'))
1464
 
                except socket.error as error:
 
945
                                               + u'\0'))
 
946
                except socket.error, error:
1465
947
                    if error[0] == errno.EPERM:
1466
 
                        logger.error("No permission to"
1467
 
                                     " bind to interface %s",
 
948
                        logger.error(u"No permission to"
 
949
                                     u" bind to interface %s",
1468
950
                                     self.interface)
1469
951
                    elif error[0] == errno.ENOPROTOOPT:
1470
 
                        logger.error("SO_BINDTODEVICE not available;"
1471
 
                                     " cannot bind to interface %s",
 
952
                        logger.error(u"SO_BINDTODEVICE not available;"
 
953
                                     u" cannot bind to interface %s",
1472
954
                                     self.interface)
1473
955
                    else:
1474
956
                        raise
1476
958
        if self.server_address[0] or self.server_address[1]:
1477
959
            if not self.server_address[0]:
1478
960
                if self.address_family == socket.AF_INET6:
1479
 
                    any_address = "::" # in6addr_any
 
961
                    any_address = u"::" # in6addr_any
1480
962
                else:
1481
963
                    any_address = socket.INADDR_ANY
1482
964
                self.server_address = (any_address,
1500
982
        clients:        set of Client objects
1501
983
        gnutls_priority GnuTLS priority string
1502
984
        use_dbus:       Boolean; to emit D-Bus signals or not
 
985
        clients:        set of Client objects
 
986
        gnutls_priority GnuTLS priority string
 
987
        use_dbus:       Boolean; to emit D-Bus signals or not
1503
988
    
1504
989
    Assumes a gobject.MainLoop event loop.
1505
990
    """
1521
1006
            return socketserver.TCPServer.server_activate(self)
1522
1007
    def enable(self):
1523
1008
        self.enabled = True
1524
 
    def add_pipe(self, parent_pipe):
 
1009
    def add_pipe(self, pipe):
1525
1010
        # Call "handle_ipc" for both data and EOF events
1526
 
        gobject.io_add_watch(parent_pipe.fileno(),
1527
 
                             gobject.IO_IN | gobject.IO_HUP,
1528
 
                             functools.partial(self.handle_ipc,
1529
 
                                               parent_pipe = parent_pipe))
1530
 
        
1531
 
    def handle_ipc(self, source, condition, parent_pipe=None,
1532
 
                   client_object=None):
 
1011
        gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
 
1012
                             self.handle_ipc)
 
1013
    def handle_ipc(self, source, condition, file_objects={}):
1533
1014
        condition_names = {
1534
 
            gobject.IO_IN: "IN",   # There is data to read.
1535
 
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1015
            gobject.IO_IN: u"IN",   # There is data to read.
 
1016
            gobject.IO_OUT: u"OUT", # Data can be written (without
1536
1017
                                    # blocking).
1537
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1538
 
            gobject.IO_ERR: "ERR", # Error condition.
1539
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1018
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
 
1019
            gobject.IO_ERR: u"ERR", # Error condition.
 
1020
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
1540
1021
                                    # broken, usually for pipes and
1541
1022
                                    # sockets).
1542
1023
            }
1544
1025
                                       for cond, name in
1545
1026
                                       condition_names.iteritems()
1546
1027
                                       if cond & condition)
1547
 
        # error or the other end of multiprocessing.Pipe has closed
1548
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1549
 
            return False
1550
 
        
1551
 
        # Read a request from the child
1552
 
        request = parent_pipe.recv()
1553
 
        command = request[0]
1554
 
        
1555
 
        if command == 'init':
1556
 
            fpr = request[1]
1557
 
            address = request[2]
1558
 
            
1559
 
            for c in self.clients:
1560
 
                if c.fingerprint == fpr:
1561
 
                    client = c
1562
 
                    break
1563
 
            else:
1564
 
                logger.warning("Client not found for fingerprint: %s, ad"
1565
 
                               "dress: %s", fpr, address)
1566
 
                if self.use_dbus:
1567
 
                    # Emit D-Bus signal
1568
 
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
1569
 
                parent_pipe.send(False)
1570
 
                return False
1571
 
            
1572
 
            gobject.io_add_watch(parent_pipe.fileno(),
1573
 
                                 gobject.IO_IN | gobject.IO_HUP,
1574
 
                                 functools.partial(self.handle_ipc,
1575
 
                                                   parent_pipe = parent_pipe,
1576
 
                                                   client_object = client))
1577
 
            parent_pipe.send(True)
1578
 
            # remove the old hook in favor of the new above hook on same fileno
1579
 
            return False
1580
 
        if command == 'funcall':
1581
 
            funcname = request[1]
1582
 
            args = request[2]
1583
 
            kwargs = request[3]
1584
 
            
1585
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1586
 
 
1587
 
        if command == 'getattr':
1588
 
            attrname = request[1]
1589
 
            if callable(client_object.__getattribute__(attrname)):
1590
 
                parent_pipe.send(('function',))
1591
 
            else:
1592
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1593
 
        
1594
 
        if command == 'setattr':
1595
 
            attrname = request[1]
1596
 
            value = request[2]
1597
 
            setattr(client_object, attrname, value)
1598
 
 
 
1028
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
 
1029
                     conditions_string)
 
1030
        
 
1031
        # Turn the pipe file descriptor into a Python file object
 
1032
        if source not in file_objects:
 
1033
            file_objects[source] = os.fdopen(source, u"r", 1)
 
1034
        
 
1035
        # Read a line from the file object
 
1036
        cmdline = file_objects[source].readline()
 
1037
        if not cmdline:             # Empty line means end of file
 
1038
            # close the IPC pipe
 
1039
            file_objects[source].close()
 
1040
            del file_objects[source]
 
1041
            
 
1042
            # Stop calling this function
 
1043
            return False
 
1044
        
 
1045
        logger.debug(u"IPC command: %r", cmdline)
 
1046
        
 
1047
        # Parse and act on command
 
1048
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
 
1049
        
 
1050
        if cmd == u"NOTFOUND":
 
1051
            logger.warning(u"Client not found for fingerprint: %s",
 
1052
                           args)
 
1053
            if self.use_dbus:
 
1054
                # Emit D-Bus signal
 
1055
                mandos_dbus_service.ClientNotFound(args)
 
1056
        elif cmd == u"INVALID":
 
1057
            for client in self.clients:
 
1058
                if client.name == args:
 
1059
                    logger.warning(u"Client %s is invalid", args)
 
1060
                    if self.use_dbus:
 
1061
                        # Emit D-Bus signal
 
1062
                        client.Rejected()
 
1063
                    break
 
1064
            else:
 
1065
                logger.error(u"Unknown client %s is invalid", args)
 
1066
        elif cmd == u"SENDING":
 
1067
            for client in self.clients:
 
1068
                if client.name == args:
 
1069
                    logger.info(u"Sending secret to %s", client.name)
 
1070
                    client.checked_ok()
 
1071
                    if self.use_dbus:
 
1072
                        # Emit D-Bus signal
 
1073
                        client.ReceivedSecret()
 
1074
                    break
 
1075
            else:
 
1076
                logger.error(u"Sending secret to unknown client %s",
 
1077
                             args)
 
1078
        else:
 
1079
            logger.error(u"Unknown IPC command: %r", cmdline)
 
1080
        
 
1081
        # Keep calling this function
1599
1082
        return True
1600
1083
 
1601
1084
 
1602
1085
def string_to_delta(interval):
1603
1086
    """Parse a string and return a datetime.timedelta
1604
1087
    
1605
 
    >>> string_to_delta('7d')
 
1088
    >>> string_to_delta(u'7d')
1606
1089
    datetime.timedelta(7)
1607
 
    >>> string_to_delta('60s')
 
1090
    >>> string_to_delta(u'60s')
1608
1091
    datetime.timedelta(0, 60)
1609
 
    >>> string_to_delta('60m')
 
1092
    >>> string_to_delta(u'60m')
1610
1093
    datetime.timedelta(0, 3600)
1611
 
    >>> string_to_delta('24h')
 
1094
    >>> string_to_delta(u'24h')
1612
1095
    datetime.timedelta(1)
1613
 
    >>> string_to_delta('1w')
 
1096
    >>> string_to_delta(u'1w')
1614
1097
    datetime.timedelta(7)
1615
 
    >>> string_to_delta('5m 30s')
 
1098
    >>> string_to_delta(u'5m 30s')
1616
1099
    datetime.timedelta(0, 330)
1617
1100
    """
1618
1101
    timevalue = datetime.timedelta(0)
1620
1103
        try:
1621
1104
            suffix = unicode(s[-1])
1622
1105
            value = int(s[:-1])
1623
 
            if suffix == "d":
 
1106
            if suffix == u"d":
1624
1107
                delta = datetime.timedelta(value)
1625
 
            elif suffix == "s":
 
1108
            elif suffix == u"s":
1626
1109
                delta = datetime.timedelta(0, value)
1627
 
            elif suffix == "m":
 
1110
            elif suffix == u"m":
1628
1111
                delta = datetime.timedelta(0, 0, 0, 0, value)
1629
 
            elif suffix == "h":
 
1112
            elif suffix == u"h":
1630
1113
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1631
 
            elif suffix == "w":
 
1114
            elif suffix == u"w":
1632
1115
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1633
1116
            else:
1634
 
                raise ValueError("Unknown suffix %r" % suffix)
1635
 
        except (ValueError, IndexError) as e:
1636
 
            raise ValueError(*(e.args))
 
1117
                raise ValueError
 
1118
        except (ValueError, IndexError):
 
1119
            raise ValueError
1637
1120
        timevalue += delta
1638
1121
    return timevalue
1639
1122
 
1645
1128
    global if_nametoindex
1646
1129
    try:
1647
1130
        if_nametoindex = (ctypes.cdll.LoadLibrary
1648
 
                          (ctypes.util.find_library("c"))
 
1131
                          (ctypes.util.find_library(u"c"))
1649
1132
                          .if_nametoindex)
1650
1133
    except (OSError, AttributeError):
1651
 
        logger.warning("Doing if_nametoindex the hard way")
 
1134
        logger.warning(u"Doing if_nametoindex the hard way")
1652
1135
        def if_nametoindex(interface):
1653
1136
            "Get an interface index the hard way, i.e. using fcntl()"
1654
1137
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1655
 
            with contextlib.closing(socket.socket()) as s:
 
1138
            with closing(socket.socket()) as s:
1656
1139
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1657
 
                                    struct.pack(str("16s16x"),
 
1140
                                    struct.pack(str(u"16s16x"),
1658
1141
                                                interface))
1659
 
            interface_index = struct.unpack(str("I"),
 
1142
            interface_index = struct.unpack(str(u"I"),
1660
1143
                                            ifreq[16:20])[0]
1661
1144
            return interface_index
1662
1145
    return if_nametoindex(interface)
1670
1153
        sys.exit()
1671
1154
    os.setsid()
1672
1155
    if not nochdir:
1673
 
        os.chdir("/")
 
1156
        os.chdir(u"/")
1674
1157
    if os.fork():
1675
1158
        sys.exit()
1676
1159
    if not noclose:
1678
1161
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1679
1162
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1680
1163
            raise OSError(errno.ENODEV,
1681
 
                          "%s not a character device"
1682
 
                          % os.path.devnull)
 
1164
                          u"/dev/null not a character device")
1683
1165
        os.dup2(null, sys.stdin.fileno())
1684
1166
        os.dup2(null, sys.stdout.fileno())
1685
1167
        os.dup2(null, sys.stderr.fileno())
1689
1171
 
1690
1172
def main():
1691
1173
    
1692
 
    ##################################################################
 
1174
    ######################################################################
1693
1175
    # Parsing of options, both command line and config file
1694
1176
    
1695
 
    parser = argparse.ArgumentParser()
1696
 
    parser.add_argument("-v", "--version", action="version",
1697
 
                        version = "%%(prog)s %s" % version,
1698
 
                        help="show version number and exit")
1699
 
    parser.add_argument("-i", "--interface", metavar="IF",
1700
 
                        help="Bind to interface IF")
1701
 
    parser.add_argument("-a", "--address",
1702
 
                        help="Address to listen for requests on")
1703
 
    parser.add_argument("-p", "--port", type=int,
1704
 
                        help="Port number to receive requests on")
1705
 
    parser.add_argument("--check", action="store_true",
1706
 
                        help="Run self-test")
1707
 
    parser.add_argument("--debug", action="store_true",
1708
 
                        help="Debug mode; run in foreground and log"
1709
 
                        " to terminal")
1710
 
    parser.add_argument("--debuglevel", metavar="LEVEL",
1711
 
                        help="Debug level for stdout output")
1712
 
    parser.add_argument("--priority", help="GnuTLS"
1713
 
                        " priority string (see GnuTLS documentation)")
1714
 
    parser.add_argument("--servicename",
1715
 
                        metavar="NAME", help="Zeroconf service name")
1716
 
    parser.add_argument("--configdir",
1717
 
                        default="/etc/mandos", metavar="DIR",
1718
 
                        help="Directory to search for configuration"
1719
 
                        " files")
1720
 
    parser.add_argument("--no-dbus", action="store_false",
1721
 
                        dest="use_dbus", help="Do not provide D-Bus"
1722
 
                        " system bus interface")
1723
 
    parser.add_argument("--no-ipv6", action="store_false",
1724
 
                        dest="use_ipv6", help="Do not use IPv6")
1725
 
    options = parser.parse_args()
 
1177
    parser = optparse.OptionParser(version = "%%prog %s" % version)
 
1178
    parser.add_option("-i", u"--interface", type=u"string",
 
1179
                      metavar="IF", help=u"Bind to interface IF")
 
1180
    parser.add_option("-a", u"--address", type=u"string",
 
1181
                      help=u"Address to listen for requests on")
 
1182
    parser.add_option("-p", u"--port", type=u"int",
 
1183
                      help=u"Port number to receive requests on")
 
1184
    parser.add_option("--check", action=u"store_true",
 
1185
                      help=u"Run self-test")
 
1186
    parser.add_option("--debug", action=u"store_true",
 
1187
                      help=u"Debug mode; run in foreground and log to"
 
1188
                      u" terminal")
 
1189
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
 
1190
                      u" priority string (see GnuTLS documentation)")
 
1191
    parser.add_option("--servicename", type=u"string",
 
1192
                      metavar=u"NAME", help=u"Zeroconf service name")
 
1193
    parser.add_option("--configdir", type=u"string",
 
1194
                      default=u"/etc/mandos", metavar=u"DIR",
 
1195
                      help=u"Directory to search for configuration"
 
1196
                      u" files")
 
1197
    parser.add_option("--no-dbus", action=u"store_false",
 
1198
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
 
1199
                      u" system bus interface")
 
1200
    parser.add_option("--no-ipv6", action=u"store_false",
 
1201
                      dest=u"use_ipv6", help=u"Do not use IPv6")
 
1202
    options = parser.parse_args()[0]
1726
1203
    
1727
1204
    if options.check:
1728
1205
        import doctest
1730
1207
        sys.exit()
1731
1208
    
1732
1209
    # Default values for config file for server-global settings
1733
 
    server_defaults = { "interface": "",
1734
 
                        "address": "",
1735
 
                        "port": "",
1736
 
                        "debug": "False",
1737
 
                        "priority":
1738
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1739
 
                        "servicename": "Mandos",
1740
 
                        "use_dbus": "True",
1741
 
                        "use_ipv6": "True",
1742
 
                        "debuglevel": "",
 
1210
    server_defaults = { u"interface": u"",
 
1211
                        u"address": u"",
 
1212
                        u"port": u"",
 
1213
                        u"debug": u"False",
 
1214
                        u"priority":
 
1215
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1216
                        u"servicename": u"Mandos",
 
1217
                        u"use_dbus": u"True",
 
1218
                        u"use_ipv6": u"True",
1743
1219
                        }
1744
1220
    
1745
1221
    # Parse config file for server-global settings
1746
1222
    server_config = configparser.SafeConfigParser(server_defaults)
1747
1223
    del server_defaults
1748
1224
    server_config.read(os.path.join(options.configdir,
1749
 
                                    "mandos.conf"))
 
1225
                                    u"mandos.conf"))
1750
1226
    # Convert the SafeConfigParser object to a dict
1751
1227
    server_settings = server_config.defaults()
1752
1228
    # Use the appropriate methods on the non-string config options
1753
 
    for option in ("debug", "use_dbus", "use_ipv6"):
1754
 
        server_settings[option] = server_config.getboolean("DEFAULT",
 
1229
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
 
1230
        server_settings[option] = server_config.getboolean(u"DEFAULT",
1755
1231
                                                           option)
1756
1232
    if server_settings["port"]:
1757
 
        server_settings["port"] = server_config.getint("DEFAULT",
1758
 
                                                       "port")
 
1233
        server_settings["port"] = server_config.getint(u"DEFAULT",
 
1234
                                                       u"port")
1759
1235
    del server_config
1760
1236
    
1761
1237
    # Override the settings from the config file with command line
1762
1238
    # options, if set.
1763
 
    for option in ("interface", "address", "port", "debug",
1764
 
                   "priority", "servicename", "configdir",
1765
 
                   "use_dbus", "use_ipv6", "debuglevel"):
 
1239
    for option in (u"interface", u"address", u"port", u"debug",
 
1240
                   u"priority", u"servicename", u"configdir",
 
1241
                   u"use_dbus", u"use_ipv6"):
1766
1242
        value = getattr(options, option)
1767
1243
        if value is not None:
1768
1244
            server_settings[option] = value
1776
1252
    ##################################################################
1777
1253
    
1778
1254
    # For convenience
1779
 
    debug = server_settings["debug"]
1780
 
    debuglevel = server_settings["debuglevel"]
1781
 
    use_dbus = server_settings["use_dbus"]
1782
 
    use_ipv6 = server_settings["use_ipv6"]
1783
 
 
1784
 
    if server_settings["servicename"] != "Mandos":
 
1255
    debug = server_settings[u"debug"]
 
1256
    use_dbus = server_settings[u"use_dbus"]
 
1257
    use_ipv6 = server_settings[u"use_ipv6"]
 
1258
    
 
1259
    if not debug:
 
1260
        syslogger.setLevel(logging.WARNING)
 
1261
        console.setLevel(logging.WARNING)
 
1262
    
 
1263
    if server_settings[u"servicename"] != u"Mandos":
1785
1264
        syslogger.setFormatter(logging.Formatter
1786
 
                               ('Mandos (%s) [%%(process)d]:'
1787
 
                                ' %%(levelname)s: %%(message)s'
1788
 
                                % server_settings["servicename"]))
 
1265
                               (u'Mandos (%s) [%%(process)d]:'
 
1266
                                u' %%(levelname)s: %%(message)s'
 
1267
                                % server_settings[u"servicename"]))
1789
1268
    
1790
1269
    # Parse config file with clients
1791
 
    client_defaults = { "timeout": "1h",
1792
 
                        "interval": "5m",
1793
 
                        "checker": "fping -q -- %%(host)s",
1794
 
                        "host": "",
1795
 
                        "approval_delay": "0s",
1796
 
                        "approval_duration": "1s",
 
1270
    client_defaults = { u"timeout": u"1h",
 
1271
                        u"interval": u"5m",
 
1272
                        u"checker": u"fping -q -- %%(host)s",
 
1273
                        u"host": u"",
1797
1274
                        }
1798
1275
    client_config = configparser.SafeConfigParser(client_defaults)
1799
 
    client_config.read(os.path.join(server_settings["configdir"],
1800
 
                                    "clients.conf"))
 
1276
    client_config.read(os.path.join(server_settings[u"configdir"],
 
1277
                                    u"clients.conf"))
1801
1278
    
1802
1279
    global mandos_dbus_service
1803
1280
    mandos_dbus_service = None
1804
1281
    
1805
 
    tcp_server = MandosServer((server_settings["address"],
1806
 
                               server_settings["port"]),
 
1282
    tcp_server = MandosServer((server_settings[u"address"],
 
1283
                               server_settings[u"port"]),
1807
1284
                              ClientHandler,
1808
 
                              interface=(server_settings["interface"]
1809
 
                                         or None),
 
1285
                              interface=server_settings[u"interface"],
1810
1286
                              use_ipv6=use_ipv6,
1811
1287
                              gnutls_priority=
1812
 
                              server_settings["priority"],
 
1288
                              server_settings[u"priority"],
1813
1289
                              use_dbus=use_dbus)
1814
 
    if not debug:
1815
 
        pidfilename = "/var/run/mandos.pid"
1816
 
        try:
1817
 
            pidfile = open(pidfilename, "w")
1818
 
        except IOError:
1819
 
            logger.error("Could not open file %r", pidfilename)
 
1290
    pidfilename = u"/var/run/mandos.pid"
 
1291
    try:
 
1292
        pidfile = open(pidfilename, u"w")
 
1293
    except IOError:
 
1294
        logger.error(u"Could not open file %r", pidfilename)
1820
1295
    
1821
1296
    try:
1822
 
        uid = pwd.getpwnam("_mandos").pw_uid
1823
 
        gid = pwd.getpwnam("_mandos").pw_gid
 
1297
        uid = pwd.getpwnam(u"_mandos").pw_uid
 
1298
        gid = pwd.getpwnam(u"_mandos").pw_gid
1824
1299
    except KeyError:
1825
1300
        try:
1826
 
            uid = pwd.getpwnam("mandos").pw_uid
1827
 
            gid = pwd.getpwnam("mandos").pw_gid
 
1301
            uid = pwd.getpwnam(u"mandos").pw_uid
 
1302
            gid = pwd.getpwnam(u"mandos").pw_gid
1828
1303
        except KeyError:
1829
1304
            try:
1830
 
                uid = pwd.getpwnam("nobody").pw_uid
1831
 
                gid = pwd.getpwnam("nobody").pw_gid
 
1305
                uid = pwd.getpwnam(u"nobody").pw_uid
 
1306
                gid = pwd.getpwnam(u"nobody").pw_gid
1832
1307
            except KeyError:
1833
1308
                uid = 65534
1834
1309
                gid = 65534
1835
1310
    try:
1836
1311
        os.setgid(gid)
1837
1312
        os.setuid(uid)
1838
 
    except OSError as error:
 
1313
    except OSError, error:
1839
1314
        if error[0] != errno.EPERM:
1840
1315
            raise error
1841
1316
    
1842
 
    if not debug and not debuglevel:
1843
 
        syslogger.setLevel(logging.WARNING)
1844
 
        console.setLevel(logging.WARNING)
1845
 
    if debuglevel:
1846
 
        level = getattr(logging, debuglevel.upper())
1847
 
        syslogger.setLevel(level)
1848
 
        console.setLevel(level)
1849
 
 
 
1317
    # Enable all possible GnuTLS debugging
1850
1318
    if debug:
1851
 
        # Enable all possible GnuTLS debugging
1852
 
        
1853
1319
        # "Use a log level over 10 to enable all debugging options."
1854
1320
        # - GnuTLS manual
1855
1321
        gnutls.library.functions.gnutls_global_set_log_level(11)
1856
1322
        
1857
1323
        @gnutls.library.types.gnutls_log_func
1858
1324
        def debug_gnutls(level, string):
1859
 
            logger.debug("GnuTLS: %s", string[:-1])
 
1325
            logger.debug(u"GnuTLS: %s", string[:-1])
1860
1326
        
1861
1327
        (gnutls.library.functions
1862
1328
         .gnutls_global_set_log_function(debug_gnutls))
1863
 
        
1864
 
        # Redirect stdin so all checkers get /dev/null
1865
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1866
 
        os.dup2(null, sys.stdin.fileno())
1867
 
        if null > 2:
1868
 
            os.close(null)
1869
 
    else:
1870
 
        # No console logging
1871
 
        logger.removeHandler(console)
1872
 
    
1873
 
    # Need to fork before connecting to D-Bus
1874
 
    if not debug:
1875
 
        # Close all input and output, do double fork, etc.
1876
 
        daemon()
1877
1329
    
1878
1330
    global main_loop
1879
1331
    # From the Avahi example code
1882
1334
    bus = dbus.SystemBus()
1883
1335
    # End of Avahi example code
1884
1336
    if use_dbus:
1885
 
        try:
1886
 
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1887
 
                                            bus, do_not_queue=True)
1888
 
        except dbus.exceptions.NameExistsException as e:
1889
 
            logger.error(unicode(e) + ", disabling D-Bus")
1890
 
            use_dbus = False
1891
 
            server_settings["use_dbus"] = False
1892
 
            tcp_server.use_dbus = False
 
1337
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1893
1338
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1894
 
    service = AvahiService(name = server_settings["servicename"],
1895
 
                           servicetype = "_mandos._tcp",
 
1339
    service = AvahiService(name = server_settings[u"servicename"],
 
1340
                           servicetype = u"_mandos._tcp",
1896
1341
                           protocol = protocol, bus = bus)
1897
1342
    if server_settings["interface"]:
1898
1343
        service.interface = (if_nametoindex
1899
 
                             (str(server_settings["interface"])))
1900
 
    
1901
 
    global multiprocessing_manager
1902
 
    multiprocessing_manager = multiprocessing.Manager()
 
1344
                             (str(server_settings[u"interface"])))
1903
1345
    
1904
1346
    client_class = Client
1905
1347
    if use_dbus:
1906
1348
        client_class = functools.partial(ClientDBus, bus = bus)
1907
 
    def client_config_items(config, section):
1908
 
        special_settings = {
1909
 
            "approved_by_default":
1910
 
                lambda: config.getboolean(section,
1911
 
                                          "approved_by_default"),
1912
 
            }
1913
 
        for name, value in config.items(section):
1914
 
            try:
1915
 
                yield (name, special_settings[name]())
1916
 
            except KeyError:
1917
 
                yield (name, value)
1918
 
    
1919
1349
    tcp_server.clients.update(set(
1920
1350
            client_class(name = section,
1921
 
                         config= dict(client_config_items(
1922
 
                        client_config, section)))
 
1351
                         config= dict(client_config.items(section)))
1923
1352
            for section in client_config.sections()))
1924
1353
    if not tcp_server.clients:
1925
 
        logger.warning("No clients defined")
 
1354
        logger.warning(u"No clients defined")
 
1355
    
 
1356
    if debug:
 
1357
        # Redirect stdin so all checkers get /dev/null
 
1358
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1359
        os.dup2(null, sys.stdin.fileno())
 
1360
        if null > 2:
 
1361
            os.close(null)
 
1362
    else:
 
1363
        # No console logging
 
1364
        logger.removeHandler(console)
 
1365
        # Close all input and output, do double fork, etc.
 
1366
        daemon()
 
1367
    
 
1368
    try:
 
1369
        with closing(pidfile):
 
1370
            pid = os.getpid()
 
1371
            pidfile.write(str(pid) + "\n")
 
1372
        del pidfile
 
1373
    except IOError:
 
1374
        logger.error(u"Could not write to file %r with PID %d",
 
1375
                     pidfilename, pid)
 
1376
    except NameError:
 
1377
        # "pidfile" was never created
 
1378
        pass
 
1379
    del pidfilename
 
1380
    
 
1381
    def cleanup():
 
1382
        "Cleanup function; run on exit"
 
1383
        service.cleanup()
1926
1384
        
 
1385
        while tcp_server.clients:
 
1386
            client = tcp_server.clients.pop()
 
1387
            client.disable_hook = None
 
1388
            client.disable()
 
1389
    
 
1390
    atexit.register(cleanup)
 
1391
    
1927
1392
    if not debug:
1928
 
        try:
1929
 
            with pidfile:
1930
 
                pid = os.getpid()
1931
 
                pidfile.write(str(pid) + "\n".encode("utf-8"))
1932
 
            del pidfile
1933
 
        except IOError:
1934
 
            logger.error("Could not write to file %r with PID %d",
1935
 
                         pidfilename, pid)
1936
 
        except NameError:
1937
 
            # "pidfile" was never created
1938
 
            pass
1939
 
        del pidfilename
1940
 
        
1941
1393
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1942
 
 
1943
1394
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1944
1395
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1945
1396
    
1947
1398
        class MandosDBusService(dbus.service.Object):
1948
1399
            """A D-Bus proxy object"""
1949
1400
            def __init__(self):
1950
 
                dbus.service.Object.__init__(self, bus, "/")
1951
 
            _interface = "se.bsnet.fukt.Mandos"
1952
 
            
1953
 
            @dbus.service.signal(_interface, signature="o")
1954
 
            def ClientAdded(self, objpath):
1955
 
                "D-Bus signal"
1956
 
                pass
1957
 
            
1958
 
            @dbus.service.signal(_interface, signature="ss")
1959
 
            def ClientNotFound(self, fingerprint, address):
1960
 
                "D-Bus signal"
1961
 
                pass
1962
 
            
1963
 
            @dbus.service.signal(_interface, signature="os")
 
1401
                dbus.service.Object.__init__(self, bus, u"/")
 
1402
            _interface = u"se.bsnet.fukt.Mandos"
 
1403
            
 
1404
            @dbus.service.signal(_interface, signature=u"oa{sv}")
 
1405
            def ClientAdded(self, objpath, properties):
 
1406
                "D-Bus signal"
 
1407
                pass
 
1408
            
 
1409
            @dbus.service.signal(_interface, signature=u"s")
 
1410
            def ClientNotFound(self, fingerprint):
 
1411
                "D-Bus signal"
 
1412
                pass
 
1413
            
 
1414
            @dbus.service.signal(_interface, signature=u"os")
1964
1415
            def ClientRemoved(self, objpath, name):
1965
1416
                "D-Bus signal"
1966
1417
                pass
1967
1418
            
1968
 
            @dbus.service.method(_interface, out_signature="ao")
 
1419
            @dbus.service.method(_interface, out_signature=u"ao")
1969
1420
            def GetAllClients(self):
1970
1421
                "D-Bus method"
1971
1422
                return dbus.Array(c.dbus_object_path
1972
1423
                                  for c in tcp_server.clients)
1973
1424
            
1974
1425
            @dbus.service.method(_interface,
1975
 
                                 out_signature="a{oa{sv}}")
 
1426
                                 out_signature=u"a{oa{sv}}")
1976
1427
            def GetAllClientsWithProperties(self):
1977
1428
                "D-Bus method"
1978
1429
                return dbus.Dictionary(
1979
 
                    ((c.dbus_object_path, c.GetAll(""))
 
1430
                    ((c.dbus_object_path, c.GetAllProperties())
1980
1431
                     for c in tcp_server.clients),
1981
 
                    signature="oa{sv}")
 
1432
                    signature=u"oa{sv}")
1982
1433
            
1983
 
            @dbus.service.method(_interface, in_signature="o")
 
1434
            @dbus.service.method(_interface, in_signature=u"o")
1984
1435
            def RemoveClient(self, object_path):
1985
1436
                "D-Bus method"
1986
1437
                for c in tcp_server.clients:
1988
1439
                        tcp_server.clients.remove(c)
1989
1440
                        c.remove_from_connection()
1990
1441
                        # Don't signal anything except ClientRemoved
1991
 
                        c.disable(quiet=True)
 
1442
                        c.disable(signal=False)
1992
1443
                        # Emit D-Bus signal
1993
1444
                        self.ClientRemoved(object_path, c.name)
1994
1445
                        return
1995
 
                raise KeyError(object_path)
 
1446
                raise KeyError
1996
1447
            
1997
1448
            del _interface
1998
1449
        
1999
1450
        mandos_dbus_service = MandosDBusService()
2000
1451
    
2001
 
    def cleanup():
2002
 
        "Cleanup function; run on exit"
2003
 
        service.cleanup()
2004
 
        
2005
 
        while tcp_server.clients:
2006
 
            client = tcp_server.clients.pop()
2007
 
            if use_dbus:
2008
 
                client.remove_from_connection()
2009
 
            client.disable_hook = None
2010
 
            # Don't signal anything except ClientRemoved
2011
 
            client.disable(quiet=True)
2012
 
            if use_dbus:
2013
 
                # Emit D-Bus signal
2014
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2015
 
                                                  client.name)
2016
 
    
2017
 
    atexit.register(cleanup)
2018
 
    
2019
1452
    for client in tcp_server.clients:
2020
1453
        if use_dbus:
2021
1454
            # Emit D-Bus signal
2022
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
1455
            mandos_dbus_service.ClientAdded(client.dbus_object_path,
 
1456
                                            client.GetAllProperties())
2023
1457
        client.enable()
2024
1458
    
2025
1459
    tcp_server.enable()
2028
1462
    # Find out what port we got
2029
1463
    service.port = tcp_server.socket.getsockname()[1]
2030
1464
    if use_ipv6:
2031
 
        logger.info("Now listening on address %r, port %d,"
 
1465
        logger.info(u"Now listening on address %r, port %d,"
2032
1466
                    " flowinfo %d, scope_id %d"
2033
1467
                    % tcp_server.socket.getsockname())
2034
1468
    else:                       # IPv4
2035
 
        logger.info("Now listening on address %r, port %d"
 
1469
        logger.info(u"Now listening on address %r, port %d"
2036
1470
                    % tcp_server.socket.getsockname())
2037
1471
    
2038
1472
    #service.interface = tcp_server.socket.getsockname()[3]
2041
1475
        # From the Avahi example code
2042
1476
        try:
2043
1477
            service.activate()
2044
 
        except dbus.exceptions.DBusException as error:
2045
 
            logger.critical("DBusException: %s", error)
2046
 
            cleanup()
 
1478
        except dbus.exceptions.DBusException, error:
 
1479
            logger.critical(u"DBusException: %s", error)
2047
1480
            sys.exit(1)
2048
1481
        # End of Avahi example code
2049
1482
        
2052
1485
                             (tcp_server.handle_request
2053
1486
                              (*args[2:], **kwargs) or True))
2054
1487
        
2055
 
        logger.debug("Starting main loop")
 
1488
        logger.debug(u"Starting main loop")
2056
1489
        main_loop.run()
2057
 
    except AvahiError as error:
2058
 
        logger.critical("AvahiError: %s", error)
2059
 
        cleanup()
 
1490
    except AvahiError, error:
 
1491
        logger.critical(u"AvahiError: %s", error)
2060
1492
        sys.exit(1)
2061
1493
    except KeyboardInterrupt:
2062
1494
        if debug:
2063
 
            print("", file=sys.stderr)
2064
 
        logger.debug("Server received KeyboardInterrupt")
2065
 
    logger.debug("Server exiting")
2066
 
    # Must run before the D-Bus bus name gets deregistered
2067
 
    cleanup()
 
1495
            print >> sys.stderr
 
1496
        logger.debug(u"Server received KeyboardInterrupt")
 
1497
    logger.debug(u"Server exiting")
2068
1498
 
2069
1499
if __name__ == '__main__':
2070
1500
    main()