/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2009-10-18 08:47:40 UTC
  • Revision ID: teddy@fukt.bsnet.se-20091018084740-fa1qgm22lg125r10
* plugins.d/splashy.c: Use exit codes from <sysexits.h>.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2010 Teddy Hogeborn
15
 
# Copyright © 2008-2010 Björn Påhlsson
 
14
# Copyright © 2008,2009 Teddy Hogeborn
 
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
55
55
import logging
56
56
import logging.handlers
57
57
import pwd
58
 
import contextlib
 
58
from contextlib import closing
59
59
import struct
60
60
import fcntl
61
61
import functools
62
 
import cPickle as pickle
63
 
import multiprocessing
64
62
 
65
63
import dbus
66
64
import dbus.service
81
79
        SO_BINDTODEVICE = None
82
80
 
83
81
 
84
 
version = "1.2.3"
 
82
version = "1.0.12"
85
83
 
86
 
#logger = logging.getLogger(u'mandos')
87
84
logger = logging.Logger(u'mandos')
88
85
syslogger = (logging.handlers.SysLogHandler
89
86
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
157
154
                            u" after %i retries, exiting.",
158
155
                            self.rename_count)
159
156
            raise AvahiServiceError(u"Too many renames")
160
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
157
        self.name = self.server.GetAlternativeServiceName(self.name)
161
158
        logger.info(u"Changing Zeroconf service name to %r ...",
162
 
                    self.name)
 
159
                    unicode(self.name))
163
160
        syslogger.setFormatter(logging.Formatter
164
161
                               (u'Mandos (%s) [%%(process)d]:'
165
162
                                u' %%(levelname)s: %%(message)s'
166
163
                                % self.name))
167
164
        self.remove()
168
 
        try:
169
 
            self.add()
170
 
        except dbus.exceptions.DBusException, error:
171
 
            logger.critical(u"DBusException: %s", error)
172
 
            self.cleanup()
173
 
            os._exit(1)
 
165
        self.add()
174
166
        self.rename_count += 1
175
167
    def remove(self):
176
168
        """Derived from the Avahi example code"""
199
191
        self.group.Commit()
200
192
    def entry_group_state_changed(self, state, error):
201
193
        """Derived from the Avahi example code"""
202
 
        logger.debug(u"Avahi entry group state change: %i", state)
 
194
        logger.debug(u"Avahi state change: %i", state)
203
195
        
204
196
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
197
            logger.debug(u"Zeroconf service established.")
206
198
        elif state == avahi.ENTRY_GROUP_COLLISION:
207
 
            logger.info(u"Zeroconf service name collision.")
 
199
            logger.warning(u"Zeroconf service name collision.")
208
200
            self.rename()
209
201
        elif state == avahi.ENTRY_GROUP_FAILURE:
210
202
            logger.critical(u"Avahi: Error in group state changed %s",
218
210
            self.group = None
219
211
    def server_state_changed(self, state):
220
212
        """Derived from the Avahi example code"""
221
 
        logger.debug(u"Avahi server state change: %i", state)
222
213
        if state == avahi.SERVER_COLLISION:
223
214
            logger.error(u"Zeroconf server name collision")
224
215
            self.remove()
240
231
    """A representation of a client host served by this server.
241
232
    
242
233
    Attributes:
243
 
    _approved:   bool(); 'None' if not yet approved/disapproved
244
 
    approval_delay: datetime.timedelta(); Time to wait for approval
245
 
    approval_duration: datetime.timedelta(); Duration of one approval
 
234
    name:       string; from the config file, used in log messages and
 
235
                        D-Bus identifiers
 
236
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
237
                 uniquely identify the client
 
238
    secret:     bytestring; sent verbatim (over TLS) to client
 
239
    host:       string; available for use by the checker command
 
240
    created:    datetime.datetime(); (UTC) object creation
 
241
    last_enabled: datetime.datetime(); (UTC)
 
242
    enabled:    bool()
 
243
    last_checked_ok: datetime.datetime(); (UTC) or None
 
244
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
245
                                      until this client is invalid
 
246
    interval:   datetime.timedelta(); How often to start a new checker
 
247
    disable_hook:  If set, called by disable() as disable_hook(self)
246
248
    checker:    subprocess.Popen(); a running checker process used
247
249
                                    to see if the client lives.
248
250
                                    'None' if no process is running.
249
 
    checker_callback_tag: a gobject event source tag, or None
250
 
    checker_command: string; External command which is run to check
251
 
                     if client lives.  %() expansions are done at
 
251
    checker_initiator_tag: a gobject event source tag, or None
 
252
    disable_initiator_tag: - '' -
 
253
    checker_callback_tag:  - '' -
 
254
    checker_command: string; External command which is run to check if
 
255
                     client lives.  %() expansions are done at
252
256
                     runtime with vars(self) as dict, so that for
253
257
                     instance %(name)s can be used in the command.
254
 
    checker_initiator_tag: a gobject event source tag, or None
255
 
    created:    datetime.datetime(); (UTC) object creation
256
258
    current_checker_command: string; current running checker_command
257
 
    disable_hook:  If set, called by disable() as disable_hook(self)
258
 
    disable_initiator_tag: a gobject event source tag, or None
259
 
    enabled:    bool()
260
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
261
 
                 uniquely identify the client
262
 
    host:       string; available for use by the checker command
263
 
    interval:   datetime.timedelta(); How often to start a new checker
264
 
    last_approval_request: datetime.datetime(); (UTC) or None
265
 
    last_checked_ok: datetime.datetime(); (UTC) or None
266
 
    last_enabled: datetime.datetime(); (UTC)
267
 
    name:       string; from the config file, used in log messages and
268
 
                        D-Bus identifiers
269
 
    secret:     bytestring; sent verbatim (over TLS) to client
270
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
271
 
                                      until this client is disabled
272
 
    runtime_expansions: Allowed attributes for runtime expansion.
273
259
    """
274
260
    
275
 
    runtime_expansions = (u"approval_delay", u"approval_duration",
276
 
                          u"created", u"enabled", u"fingerprint",
277
 
                          u"host", u"interval", u"last_checked_ok",
278
 
                          u"last_enabled", u"name", u"timeout")
279
 
    
280
261
    @staticmethod
281
262
    def _timedelta_to_milliseconds(td):
282
263
        "Convert a datetime.timedelta() to milliseconds"
291
272
    def interval_milliseconds(self):
292
273
        "Return the 'interval' attribute in milliseconds"
293
274
        return self._timedelta_to_milliseconds(self.interval)
294
 
 
295
 
    def approval_delay_milliseconds(self):
296
 
        return self._timedelta_to_milliseconds(self.approval_delay)
297
275
    
298
276
    def __init__(self, name = None, disable_hook=None, config=None):
299
277
        """Note: the 'checker' key in 'config' sets the
312
290
        if u"secret" in config:
313
291
            self.secret = config[u"secret"].decode(u"base64")
314
292
        elif u"secfile" in config:
315
 
            with open(os.path.expanduser(os.path.expandvars
316
 
                                         (config[u"secfile"])),
317
 
                      "rb") as secfile:
 
293
            with closing(open(os.path.expanduser
 
294
                              (os.path.expandvars
 
295
                               (config[u"secfile"])),
 
296
                              "rb")) as secfile:
318
297
                self.secret = secfile.read()
319
298
        else:
320
299
            raise TypeError(u"No secret or secfile for client %s"
322
301
        self.host = config.get(u"host", u"")
323
302
        self.created = datetime.datetime.utcnow()
324
303
        self.enabled = False
325
 
        self.last_approval_request = None
326
304
        self.last_enabled = None
327
305
        self.last_checked_ok = None
328
306
        self.timeout = string_to_delta(config[u"timeout"])
335
313
        self.checker_command = config[u"checker"]
336
314
        self.current_checker_command = None
337
315
        self.last_connect = None
338
 
        self._approved = None
339
 
        self.approved_by_default = config.get(u"approved_by_default",
340
 
                                              True)
341
 
        self.approvals_pending = 0
342
 
        self.approval_delay = string_to_delta(
343
 
            config[u"approval_delay"])
344
 
        self.approval_duration = string_to_delta(
345
 
            config[u"approval_duration"])
346
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
347
316
    
348
 
    def send_changedstate(self):
349
 
        self.changedstate.acquire()
350
 
        self.changedstate.notify_all()
351
 
        self.changedstate.release()
352
 
        
353
317
    def enable(self):
354
318
        """Start this client's checker and timeout hooks"""
355
319
        if getattr(self, u"enabled", False):
356
320
            # Already enabled
357
321
            return
358
 
        self.send_changedstate()
359
322
        self.last_enabled = datetime.datetime.utcnow()
360
323
        # Schedule a new checker to be started an 'interval' from now,
361
324
        # and every interval from then on.
362
325
        self.checker_initiator_tag = (gobject.timeout_add
363
326
                                      (self.interval_milliseconds(),
364
327
                                       self.start_checker))
 
328
        # Also start a new checker *right now*.
 
329
        self.start_checker()
365
330
        # Schedule a disable() when 'timeout' has passed
366
331
        self.disable_initiator_tag = (gobject.timeout_add
367
332
                                   (self.timeout_milliseconds(),
368
333
                                    self.disable))
369
334
        self.enabled = True
370
 
        # Also start a new checker *right now*.
371
 
        self.start_checker()
372
335
    
373
 
    def disable(self, quiet=True):
 
336
    def disable(self):
374
337
        """Disable this client."""
375
338
        if not getattr(self, "enabled", False):
376
339
            return False
377
 
        if not quiet:
378
 
            self.send_changedstate()
379
 
        if not quiet:
380
 
            logger.info(u"Disabling client %s", self.name)
 
340
        logger.info(u"Disabling client %s", self.name)
381
341
        if getattr(self, u"disable_initiator_tag", False):
382
342
            gobject.source_remove(self.disable_initiator_tag)
383
343
            self.disable_initiator_tag = None
424
384
                                      (self.timeout_milliseconds(),
425
385
                                       self.disable))
426
386
    
427
 
    def need_approval(self):
428
 
        self.last_approval_request = datetime.datetime.utcnow()
429
 
    
430
387
    def start_checker(self):
431
388
        """Start a new checker subprocess if one is not running.
432
389
        
438
395
        # client would inevitably timeout, since no checker would get
439
396
        # a chance to run to completion.  If we instead leave running
440
397
        # checkers alone, the checker would have to take more time
441
 
        # than 'timeout' for the client to be disabled, which is as it
442
 
        # should be.
 
398
        # than 'timeout' for the client to be declared invalid, which
 
399
        # is as it should be.
443
400
        
444
401
        # If a checker exists, make sure it is not a zombie
445
402
        try:
461
418
                command = self.checker_command % self.host
462
419
            except TypeError:
463
420
                # Escape attributes for the shell
464
 
                escaped_attrs = dict(
465
 
                    (attr,
466
 
                     re.escape(unicode(str(getattr(self, attr, u"")),
467
 
                                       errors=
468
 
                                       u'replace')))
469
 
                    for attr in
470
 
                    self.runtime_expansions)
471
 
 
 
421
                escaped_attrs = dict((key,
 
422
                                      re.escape(unicode(str(val),
 
423
                                                        errors=
 
424
                                                        u'replace')))
 
425
                                     for key, val in
 
426
                                     vars(self).iteritems())
472
427
                try:
473
428
                    command = self.checker_command % escaped_attrs
474
429
                except TypeError, error:
512
467
        logger.debug(u"Stopping checker for %(name)s", vars(self))
513
468
        try:
514
469
            os.kill(self.checker.pid, signal.SIGTERM)
515
 
            #time.sleep(0.5)
 
470
            #os.sleep(0.5)
516
471
            #if self.checker.poll() is None:
517
472
            #    os.kill(self.checker.pid, signal.SIGKILL)
518
473
        except OSError, error:
519
474
            if error.errno != errno.ESRCH: # No such process
520
475
                raise
521
476
        self.checker = None
 
477
    
 
478
    def still_valid(self):
 
479
        """Has the timeout not yet passed for this client?"""
 
480
        if not getattr(self, u"enabled", False):
 
481
            return False
 
482
        now = datetime.datetime.utcnow()
 
483
        if self.last_checked_ok is None:
 
484
            return now < (self.created + self.timeout)
 
485
        else:
 
486
            return now < (self.last_checked_ok + self.timeout)
 
487
 
522
488
 
523
489
def dbus_service_property(dbus_interface, signature=u"v",
524
490
                          access=u"readwrite", byte_arrays=False):
532
498
    dbus.service.method, except there is only "signature", since the
533
499
    type from Get() and the type sent to Set() is the same.
534
500
    """
535
 
    # Encoding deeply encoded byte arrays is not supported yet by the
536
 
    # "Set" method, so we fail early here:
537
 
    if byte_arrays and signature != u"ay":
538
 
        raise ValueError(u"Byte arrays not supported for non-'ay'"
539
 
                         u" signature %r" % signature)
540
501
    def decorator(func):
541
502
        func._dbus_is_property = True
542
503
        func._dbus_interface = dbus_interface
628
589
        if prop._dbus_access == u"read":
629
590
            raise DBusPropertyAccessException(property_name)
630
591
        if prop._dbus_get_args_options[u"byte_arrays"]:
631
 
            # The byte_arrays option is not supported yet on
632
 
            # signatures other than "ay".
633
 
            if prop._dbus_signature != u"ay":
634
 
                raise ValueError
635
592
            value = dbus.ByteArray(''.join(unichr(byte)
636
593
                                           for byte in value))
637
594
        prop(value)
716
673
    dbus_object_path: dbus.ObjectPath
717
674
    bus: dbus.SystemBus()
718
675
    """
719
 
    
720
 
    runtime_expansions = (Client.runtime_expansions
721
 
                          + (u"dbus_object_path",))
722
 
    
723
676
    # dbus.service.Object doesn't use super(), so we can't either.
724
677
    
725
678
    def __init__(self, bus = None, *args, **kwargs):
726
 
        self._approvals_pending = 0
727
679
        self.bus = bus
728
680
        Client.__init__(self, *args, **kwargs)
729
681
        # Only now, when this client is initialized, can it show up on
730
682
        # the D-Bus
731
 
        client_object_name = unicode(self.name).translate(
732
 
            {ord(u"."): ord(u"_"),
733
 
             ord(u"-"): ord(u"_")})
734
683
        self.dbus_object_path = (dbus.ObjectPath
735
 
                                 (u"/clients/" + client_object_name))
 
684
                                 (u"/clients/"
 
685
                                  + self.name.replace(u".", u"_")))
736
686
        DBusObjectWithProperties.__init__(self, self.bus,
737
687
                                          self.dbus_object_path)
738
 
        
739
 
    def _get_approvals_pending(self):
740
 
        return self._approvals_pending
741
 
    def _set_approvals_pending(self, value):
742
 
        old_value = self._approvals_pending
743
 
        self._approvals_pending = value
744
 
        bval = bool(value)
745
 
        if (hasattr(self, "dbus_object_path")
746
 
            and bval is not bool(old_value)):
747
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
748
 
            self.PropertyChanged(dbus.String(u"ApprovalPending"),
749
 
                                 dbus_bool)
750
 
 
751
 
    approvals_pending = property(_get_approvals_pending,
752
 
                                 _set_approvals_pending)
753
 
    del _get_approvals_pending, _set_approvals_pending
754
688
    
755
689
    @staticmethod
756
690
    def _datetime_to_dbus(dt, variant_level=0):
763
697
        r = Client.enable(self)
764
698
        if oldstate != self.enabled:
765
699
            # Emit D-Bus signals
766
 
            self.PropertyChanged(dbus.String(u"Enabled"),
 
700
            self.PropertyChanged(dbus.String(u"enabled"),
767
701
                                 dbus.Boolean(True, variant_level=1))
768
702
            self.PropertyChanged(
769
 
                dbus.String(u"LastEnabled"),
 
703
                dbus.String(u"last_enabled"),
770
704
                self._datetime_to_dbus(self.last_enabled,
771
705
                                       variant_level=1))
772
706
        return r
773
707
    
774
 
    def disable(self, quiet = False):
 
708
    def disable(self, signal = True):
775
709
        oldstate = getattr(self, u"enabled", False)
776
 
        r = Client.disable(self, quiet=quiet)
777
 
        if not quiet and oldstate != self.enabled:
 
710
        r = Client.disable(self)
 
711
        if signal and oldstate != self.enabled:
778
712
            # Emit D-Bus signal
779
 
            self.PropertyChanged(dbus.String(u"Enabled"),
 
713
            self.PropertyChanged(dbus.String(u"enabled"),
780
714
                                 dbus.Boolean(False, variant_level=1))
781
715
        return r
782
716
    
794
728
        self.checker_callback_tag = None
795
729
        self.checker = None
796
730
        # Emit D-Bus signal
797
 
        self.PropertyChanged(dbus.String(u"CheckerRunning"),
 
731
        self.PropertyChanged(dbus.String(u"checker_running"),
798
732
                             dbus.Boolean(False, variant_level=1))
799
733
        if os.WIFEXITED(condition):
800
734
            exitstatus = os.WEXITSTATUS(condition)
815
749
        r = Client.checked_ok(self, *args, **kwargs)
816
750
        # Emit D-Bus signal
817
751
        self.PropertyChanged(
818
 
            dbus.String(u"LastCheckedOK"),
 
752
            dbus.String(u"last_checked_ok"),
819
753
            (self._datetime_to_dbus(self.last_checked_ok,
820
754
                                    variant_level=1)))
821
755
        return r
822
756
    
823
 
    def need_approval(self, *args, **kwargs):
824
 
        r = Client.need_approval(self, *args, **kwargs)
825
 
        # Emit D-Bus signal
826
 
        self.PropertyChanged(
827
 
            dbus.String(u"LastApprovalRequest"),
828
 
            (self._datetime_to_dbus(self.last_approval_request,
829
 
                                    variant_level=1)))
830
 
        return r
831
 
    
832
757
    def start_checker(self, *args, **kwargs):
833
758
        old_checker = self.checker
834
759
        if self.checker is not None:
842
767
            # Emit D-Bus signal
843
768
            self.CheckerStarted(self.current_checker_command)
844
769
            self.PropertyChanged(
845
 
                dbus.String(u"CheckerRunning"),
 
770
                dbus.String(u"checker_running"),
846
771
                dbus.Boolean(True, variant_level=1))
847
772
        return r
848
773
    
851
776
        r = Client.stop_checker(self, *args, **kwargs)
852
777
        if (old_checker is not None
853
778
            and getattr(self, u"checker", None) is None):
854
 
            self.PropertyChanged(dbus.String(u"CheckerRunning"),
 
779
            self.PropertyChanged(dbus.String(u"checker_running"),
855
780
                                 dbus.Boolean(False, variant_level=1))
856
781
        return r
857
 
 
858
 
    def _reset_approved(self):
859
 
        self._approved = None
860
 
        return False
861
 
    
862
 
    def approve(self, value=True):
863
 
        self.send_changedstate()
864
 
        self._approved = value
865
 
        gobject.timeout_add(self._timedelta_to_milliseconds
866
 
                            (self.approval_duration),
867
 
                            self._reset_approved)
868
 
    
869
 
    
870
 
    ## D-Bus methods, signals & properties
 
782
    
 
783
    ## D-Bus methods & signals
871
784
    _interface = u"se.bsnet.fukt.Mandos.Client"
872
785
    
873
 
    ## Signals
 
786
    # CheckedOK - method
 
787
    @dbus.service.method(_interface)
 
788
    def CheckedOK(self):
 
789
        return self.checked_ok()
874
790
    
875
791
    # CheckerCompleted - signal
876
792
    @dbus.service.signal(_interface, signature=u"nxs")
893
809
    # GotSecret - signal
894
810
    @dbus.service.signal(_interface)
895
811
    def GotSecret(self):
896
 
        """D-Bus signal
897
 
        Is sent after a successful transfer of secret from the Mandos
898
 
        server to mandos-client
899
 
        """
 
812
        "D-Bus signal"
900
813
        pass
901
814
    
902
815
    # Rejected - signal
903
 
    @dbus.service.signal(_interface, signature=u"s")
904
 
    def Rejected(self, reason):
 
816
    @dbus.service.signal(_interface)
 
817
    def Rejected(self):
905
818
        "D-Bus signal"
906
819
        pass
907
820
    
908
 
    # NeedApproval - signal
909
 
    @dbus.service.signal(_interface, signature=u"tb")
910
 
    def NeedApproval(self, timeout, default):
911
 
        "D-Bus signal"
912
 
        return self.need_approval()
913
 
    
914
 
    ## Methods
915
 
    
916
 
    # Approve - method
917
 
    @dbus.service.method(_interface, in_signature=u"b")
918
 
    def Approve(self, value):
919
 
        self.approve(value)
920
 
    
921
 
    # CheckedOK - method
922
 
    @dbus.service.method(_interface)
923
 
    def CheckedOK(self):
924
 
        return self.checked_ok()
925
 
    
926
821
    # Enable - method
927
822
    @dbus.service.method(_interface)
928
823
    def Enable(self):
946
841
    def StopChecker(self):
947
842
        self.stop_checker()
948
843
    
949
 
    ## Properties
950
 
    
951
 
    # ApprovalPending - property
952
 
    @dbus_service_property(_interface, signature=u"b", access=u"read")
953
 
    def ApprovalPending_dbus_property(self):
954
 
        return dbus.Boolean(bool(self.approvals_pending))
955
 
    
956
 
    # ApprovedByDefault - property
957
 
    @dbus_service_property(_interface, signature=u"b",
958
 
                           access=u"readwrite")
959
 
    def ApprovedByDefault_dbus_property(self, value=None):
960
 
        if value is None:       # get
961
 
            return dbus.Boolean(self.approved_by_default)
962
 
        self.approved_by_default = bool(value)
963
 
        # Emit D-Bus signal
964
 
        self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
965
 
                             dbus.Boolean(value, variant_level=1))
966
 
    
967
 
    # ApprovalDelay - property
968
 
    @dbus_service_property(_interface, signature=u"t",
969
 
                           access=u"readwrite")
970
 
    def ApprovalDelay_dbus_property(self, value=None):
971
 
        if value is None:       # get
972
 
            return dbus.UInt64(self.approval_delay_milliseconds())
973
 
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
974
 
        # Emit D-Bus signal
975
 
        self.PropertyChanged(dbus.String(u"ApprovalDelay"),
976
 
                             dbus.UInt64(value, variant_level=1))
977
 
    
978
 
    # ApprovalDuration - property
979
 
    @dbus_service_property(_interface, signature=u"t",
980
 
                           access=u"readwrite")
981
 
    def ApprovalDuration_dbus_property(self, value=None):
982
 
        if value is None:       # get
983
 
            return dbus.UInt64(self._timedelta_to_milliseconds(
984
 
                    self.approval_duration))
985
 
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
986
 
        # Emit D-Bus signal
987
 
        self.PropertyChanged(dbus.String(u"ApprovalDuration"),
988
 
                             dbus.UInt64(value, variant_level=1))
989
 
    
990
 
    # Name - property
 
844
    # name - property
991
845
    @dbus_service_property(_interface, signature=u"s", access=u"read")
992
 
    def Name_dbus_property(self):
 
846
    def name_dbus_property(self):
993
847
        return dbus.String(self.name)
994
848
    
995
 
    # Fingerprint - property
 
849
    # fingerprint - property
996
850
    @dbus_service_property(_interface, signature=u"s", access=u"read")
997
 
    def Fingerprint_dbus_property(self):
 
851
    def fingerprint_dbus_property(self):
998
852
        return dbus.String(self.fingerprint)
999
853
    
1000
 
    # Host - property
 
854
    # host - property
1001
855
    @dbus_service_property(_interface, signature=u"s",
1002
856
                           access=u"readwrite")
1003
 
    def Host_dbus_property(self, value=None):
 
857
    def host_dbus_property(self, value=None):
1004
858
        if value is None:       # get
1005
859
            return dbus.String(self.host)
1006
860
        self.host = value
1007
861
        # Emit D-Bus signal
1008
 
        self.PropertyChanged(dbus.String(u"Host"),
 
862
        self.PropertyChanged(dbus.String(u"host"),
1009
863
                             dbus.String(value, variant_level=1))
1010
864
    
1011
 
    # Created - property
 
865
    # created - property
1012
866
    @dbus_service_property(_interface, signature=u"s", access=u"read")
1013
 
    def Created_dbus_property(self):
 
867
    def created_dbus_property(self):
1014
868
        return dbus.String(self._datetime_to_dbus(self.created))
1015
869
    
1016
 
    # LastEnabled - property
 
870
    # last_enabled - property
1017
871
    @dbus_service_property(_interface, signature=u"s", access=u"read")
1018
 
    def LastEnabled_dbus_property(self):
 
872
    def last_enabled_dbus_property(self):
1019
873
        if self.last_enabled is None:
1020
874
            return dbus.String(u"")
1021
875
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
1022
876
    
1023
 
    # Enabled - property
 
877
    # enabled - property
1024
878
    @dbus_service_property(_interface, signature=u"b",
1025
879
                           access=u"readwrite")
1026
 
    def Enabled_dbus_property(self, value=None):
 
880
    def enabled_dbus_property(self, value=None):
1027
881
        if value is None:       # get
1028
882
            return dbus.Boolean(self.enabled)
1029
883
        if value:
1031
885
        else:
1032
886
            self.disable()
1033
887
    
1034
 
    # LastCheckedOK - property
 
888
    # last_checked_ok - property
1035
889
    @dbus_service_property(_interface, signature=u"s",
1036
890
                           access=u"readwrite")
1037
 
    def LastCheckedOK_dbus_property(self, value=None):
 
891
    def last_checked_ok_dbus_property(self, value=None):
1038
892
        if value is not None:
1039
893
            self.checked_ok()
1040
894
            return
1043
897
        return dbus.String(self._datetime_to_dbus(self
1044
898
                                                  .last_checked_ok))
1045
899
    
1046
 
    # LastApprovalRequest - property
1047
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
1048
 
    def LastApprovalRequest_dbus_property(self):
1049
 
        if self.last_approval_request is None:
1050
 
            return dbus.String(u"")
1051
 
        return dbus.String(self.
1052
 
                           _datetime_to_dbus(self
1053
 
                                             .last_approval_request))
1054
 
    
1055
 
    # Timeout - property
 
900
    # timeout - property
1056
901
    @dbus_service_property(_interface, signature=u"t",
1057
902
                           access=u"readwrite")
1058
 
    def Timeout_dbus_property(self, value=None):
 
903
    def timeout_dbus_property(self, value=None):
1059
904
        if value is None:       # get
1060
905
            return dbus.UInt64(self.timeout_milliseconds())
1061
906
        self.timeout = datetime.timedelta(0, 0, 0, value)
1062
907
        # Emit D-Bus signal
1063
 
        self.PropertyChanged(dbus.String(u"Timeout"),
 
908
        self.PropertyChanged(dbus.String(u"timeout"),
1064
909
                             dbus.UInt64(value, variant_level=1))
1065
910
        if getattr(self, u"disable_initiator_tag", None) is None:
1066
911
            return
1080
925
            self.disable_initiator_tag = (gobject.timeout_add
1081
926
                                          (time_to_die, self.disable))
1082
927
    
1083
 
    # Interval - property
 
928
    # interval - property
1084
929
    @dbus_service_property(_interface, signature=u"t",
1085
930
                           access=u"readwrite")
1086
 
    def Interval_dbus_property(self, value=None):
 
931
    def interval_dbus_property(self, value=None):
1087
932
        if value is None:       # get
1088
933
            return dbus.UInt64(self.interval_milliseconds())
1089
934
        self.interval = datetime.timedelta(0, 0, 0, value)
1090
935
        # Emit D-Bus signal
1091
 
        self.PropertyChanged(dbus.String(u"Interval"),
 
936
        self.PropertyChanged(dbus.String(u"interval"),
1092
937
                             dbus.UInt64(value, variant_level=1))
1093
938
        if getattr(self, u"checker_initiator_tag", None) is None:
1094
939
            return
1098
943
                                      (value, self.start_checker))
1099
944
        self.start_checker()    # Start one now, too
1100
945
 
1101
 
    # Checker - property
 
946
    # checker - property
1102
947
    @dbus_service_property(_interface, signature=u"s",
1103
948
                           access=u"readwrite")
1104
 
    def Checker_dbus_property(self, value=None):
 
949
    def checker_dbus_property(self, value=None):
1105
950
        if value is None:       # get
1106
951
            return dbus.String(self.checker_command)
1107
952
        self.checker_command = value
1108
953
        # Emit D-Bus signal
1109
 
        self.PropertyChanged(dbus.String(u"Checker"),
 
954
        self.PropertyChanged(dbus.String(u"checker"),
1110
955
                             dbus.String(self.checker_command,
1111
956
                                         variant_level=1))
1112
957
    
1113
 
    # CheckerRunning - property
 
958
    # checker_running - property
1114
959
    @dbus_service_property(_interface, signature=u"b",
1115
960
                           access=u"readwrite")
1116
 
    def CheckerRunning_dbus_property(self, value=None):
 
961
    def checker_running_dbus_property(self, value=None):
1117
962
        if value is None:       # get
1118
963
            return dbus.Boolean(self.checker is not None)
1119
964
        if value:
1121
966
        else:
1122
967
            self.stop_checker()
1123
968
    
1124
 
    # ObjectPath - property
 
969
    # object_path - property
1125
970
    @dbus_service_property(_interface, signature=u"o", access=u"read")
1126
 
    def ObjectPath_dbus_property(self):
 
971
    def object_path_dbus_property(self):
1127
972
        return self.dbus_object_path # is already a dbus.ObjectPath
1128
973
    
1129
 
    # Secret = property
 
974
    # secret = property
1130
975
    @dbus_service_property(_interface, signature=u"ay",
1131
976
                           access=u"write", byte_arrays=True)
1132
 
    def Secret_dbus_property(self, value):
 
977
    def secret_dbus_property(self, value):
1133
978
        self.secret = str(value)
1134
979
    
1135
980
    del _interface
1136
981
 
1137
982
 
1138
 
class ProxyClient(object):
1139
 
    def __init__(self, child_pipe, fpr, address):
1140
 
        self._pipe = child_pipe
1141
 
        self._pipe.send(('init', fpr, address))
1142
 
        if not self._pipe.recv():
1143
 
            raise KeyError()
1144
 
 
1145
 
    def __getattribute__(self, name):
1146
 
        if(name == '_pipe'):
1147
 
            return super(ProxyClient, self).__getattribute__(name)
1148
 
        self._pipe.send(('getattr', name))
1149
 
        data = self._pipe.recv()
1150
 
        if data[0] == 'data':
1151
 
            return data[1]
1152
 
        if data[0] == 'function':
1153
 
            def func(*args, **kwargs):
1154
 
                self._pipe.send(('funcall', name, args, kwargs))
1155
 
                return self._pipe.recv()[1]
1156
 
            return func
1157
 
 
1158
 
    def __setattr__(self, name, value):
1159
 
        if(name == '_pipe'):
1160
 
            return super(ProxyClient, self).__setattr__(name, value)
1161
 
        self._pipe.send(('setattr', name, value))
1162
 
 
1163
 
 
1164
983
class ClientHandler(socketserver.BaseRequestHandler, object):
1165
984
    """A class to handle client connections.
1166
985
    
1168
987
    Note: This will run in its own forked process."""
1169
988
    
1170
989
    def handle(self):
1171
 
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1172
 
            logger.info(u"TCP connection from: %s",
1173
 
                        unicode(self.client_address))
1174
 
            logger.debug(u"Pipe FD: %d",
1175
 
                         self.server.child_pipe.fileno())
1176
 
 
 
990
        logger.info(u"TCP connection from: %s",
 
991
                    unicode(self.client_address))
 
992
        logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
 
993
        # Open IPC pipe to parent process
 
994
        with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1177
995
            session = (gnutls.connection
1178
996
                       .ClientSession(self.request,
1179
997
                                      gnutls.connection
1180
998
                                      .X509Credentials()))
1181
 
 
 
999
            
 
1000
            line = self.request.makefile().readline()
 
1001
            logger.debug(u"Protocol version: %r", line)
 
1002
            try:
 
1003
                if int(line.strip().split()[0]) > 1:
 
1004
                    raise RuntimeError
 
1005
            except (ValueError, IndexError, RuntimeError), error:
 
1006
                logger.error(u"Unknown protocol version: %s", error)
 
1007
                return
 
1008
            
1182
1009
            # Note: gnutls.connection.X509Credentials is really a
1183
1010
            # generic GnuTLS certificate credentials object so long as
1184
1011
            # no X.509 keys are added to it.  Therefore, we can use it
1185
1012
            # here despite using OpenPGP certificates.
1186
 
 
 
1013
            
1187
1014
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1188
1015
            #                      u"+AES-256-CBC", u"+SHA1",
1189
1016
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
1195
1022
            (gnutls.library.functions
1196
1023
             .gnutls_priority_set_direct(session._c_object,
1197
1024
                                         priority, None))
1198
 
 
1199
 
            # Start communication using the Mandos protocol
1200
 
            # Get protocol number
1201
 
            line = self.request.makefile().readline()
1202
 
            logger.debug(u"Protocol version: %r", line)
1203
 
            try:
1204
 
                if int(line.strip().split()[0]) > 1:
1205
 
                    raise RuntimeError
1206
 
            except (ValueError, IndexError, RuntimeError), error:
1207
 
                logger.error(u"Unknown protocol version: %s", error)
1208
 
                return
1209
 
 
1210
 
            # Start GnuTLS connection
 
1025
            
1211
1026
            try:
1212
1027
                session.handshake()
1213
1028
            except gnutls.errors.GNUTLSError, error:
1216
1031
                # established.  Just abandon the request.
1217
1032
                return
1218
1033
            logger.debug(u"Handshake succeeded")
1219
 
 
1220
 
            approval_required = False
1221
1034
            try:
1222
 
                try:
1223
 
                    fpr = self.fingerprint(self.peer_certificate
1224
 
                                           (session))
1225
 
                except (TypeError, gnutls.errors.GNUTLSError), error:
1226
 
                    logger.warning(u"Bad certificate: %s", error)
1227
 
                    return
1228
 
                logger.debug(u"Fingerprint: %s", fpr)
1229
 
 
1230
 
                try:
1231
 
                    client = ProxyClient(child_pipe, fpr,
1232
 
                                         self.client_address)
1233
 
                except KeyError:
1234
 
                    return
1235
 
                
1236
 
                if client.approval_delay:
1237
 
                    delay = client.approval_delay
1238
 
                    client.approvals_pending += 1
1239
 
                    approval_required = True
1240
 
                
1241
 
                while True:
1242
 
                    if not client.enabled:
1243
 
                        logger.warning(u"Client %s is disabled",
1244
 
                                       client.name)
1245
 
                        if self.server.use_dbus:
1246
 
                            # Emit D-Bus signal
1247
 
                            client.Rejected("Disabled")                    
1248
 
                        return
1249
 
                    
1250
 
                    if client._approved or not client.approval_delay:
1251
 
                        #We are approved or approval is disabled
1252
 
                        break
1253
 
                    elif client._approved is None:
1254
 
                        logger.info(u"Client %s needs approval",
1255
 
                                    client.name)
1256
 
                        if self.server.use_dbus:
1257
 
                            # Emit D-Bus signal
1258
 
                            client.NeedApproval(
1259
 
                                client.approval_delay_milliseconds(),
1260
 
                                client.approved_by_default)
1261
 
                    else:
1262
 
                        logger.warning(u"Client %s was not approved",
1263
 
                                       client.name)
1264
 
                        if self.server.use_dbus:
1265
 
                            # Emit D-Bus signal
1266
 
                            client.Rejected("Denied")
1267
 
                        return
1268
 
                    
1269
 
                    #wait until timeout or approved
1270
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1271
 
                    time = datetime.datetime.now()
1272
 
                    client.changedstate.acquire()
1273
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1274
 
                    client.changedstate.release()
1275
 
                    time2 = datetime.datetime.now()
1276
 
                    if (time2 - time) >= delay:
1277
 
                        if not client.approved_by_default:
1278
 
                            logger.warning("Client %s timed out while"
1279
 
                                           " waiting for approval",
1280
 
                                           client.name)
1281
 
                            if self.server.use_dbus:
1282
 
                                # Emit D-Bus signal
1283
 
                                client.Rejected("Approval timed out")
1284
 
                            return
1285
 
                        else:
1286
 
                            break
1287
 
                    else:
1288
 
                        delay -= time2 - time
1289
 
                
1290
 
                sent_size = 0
1291
 
                while sent_size < len(client.secret):
1292
 
                    try:
1293
 
                        sent = session.send(client.secret[sent_size:])
1294
 
                    except (gnutls.errors.GNUTLSError), error:
1295
 
                        logger.warning("gnutls send failed")
1296
 
                        return
1297
 
                    logger.debug(u"Sent: %d, remaining: %d",
1298
 
                                 sent, len(client.secret)
1299
 
                                 - (sent_size + sent))
1300
 
                    sent_size += sent
1301
 
 
1302
 
                logger.info(u"Sending secret to %s", client.name)
1303
 
                # bump the timeout as if seen
1304
 
                client.checked_ok()
1305
 
                if self.server.use_dbus:
1306
 
                    # Emit D-Bus signal
1307
 
                    client.GotSecret()
 
1035
                fpr = self.fingerprint(self.peer_certificate(session))
 
1036
            except (TypeError, gnutls.errors.GNUTLSError), error:
 
1037
                logger.warning(u"Bad certificate: %s", error)
 
1038
                session.bye()
 
1039
                return
 
1040
            logger.debug(u"Fingerprint: %s", fpr)
1308
1041
            
1309
 
            finally:
1310
 
                if approval_required:
1311
 
                    client.approvals_pending -= 1
1312
 
                try:
1313
 
                    session.bye()
1314
 
                except (gnutls.errors.GNUTLSError), error:
1315
 
                    logger.warning("GnuTLS bye failed")
 
1042
            for c in self.server.clients:
 
1043
                if c.fingerprint == fpr:
 
1044
                    client = c
 
1045
                    break
 
1046
            else:
 
1047
                ipc.write(u"NOTFOUND %s %s\n"
 
1048
                          % (fpr, unicode(self.client_address)))
 
1049
                session.bye()
 
1050
                return
 
1051
            # Have to check if client.still_valid(), since it is
 
1052
            # possible that the client timed out while establishing
 
1053
            # the GnuTLS session.
 
1054
            if not client.still_valid():
 
1055
                ipc.write(u"INVALID %s\n" % client.name)
 
1056
                session.bye()
 
1057
                return
 
1058
            ipc.write(u"SENDING %s\n" % client.name)
 
1059
            sent_size = 0
 
1060
            while sent_size < len(client.secret):
 
1061
                sent = session.send(client.secret[sent_size:])
 
1062
                logger.debug(u"Sent: %d, remaining: %d",
 
1063
                             sent, len(client.secret)
 
1064
                             - (sent_size + sent))
 
1065
                sent_size += sent
 
1066
            session.bye()
1316
1067
    
1317
1068
    @staticmethod
1318
1069
    def peer_certificate(session):
1378
1129
        return hex_fpr
1379
1130
 
1380
1131
 
1381
 
class MultiprocessingMixIn(object):
1382
 
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1383
 
    def sub_process_main(self, request, address):
1384
 
        try:
1385
 
            self.finish_request(request, address)
1386
 
        except:
1387
 
            self.handle_error(request, address)
1388
 
        self.close_request(request)
1389
 
            
1390
 
    def process_request(self, request, address):
1391
 
        """Start a new process to process the request."""
1392
 
        multiprocessing.Process(target = self.sub_process_main,
1393
 
                                args = (request, address)).start()
1394
 
 
1395
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1396
 
    """ adds a pipe to the MixIn """
 
1132
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
 
1133
    """Like socketserver.ForkingMixIn, but also pass a pipe."""
1397
1134
    def process_request(self, request, client_address):
1398
1135
        """Overrides and wraps the original process_request().
1399
1136
        
1400
1137
        This function creates a new pipe in self.pipe
1401
1138
        """
1402
 
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1403
 
 
1404
 
        super(MultiprocessingMixInWithPipe,
 
1139
        self.pipe = os.pipe()
 
1140
        super(ForkingMixInWithPipe,
1405
1141
              self).process_request(request, client_address)
1406
 
        self.child_pipe.close()
1407
 
        self.add_pipe(parent_pipe)
1408
 
 
1409
 
    def add_pipe(self, parent_pipe):
 
1142
        os.close(self.pipe[1])  # close write end
 
1143
        self.add_pipe(self.pipe[0])
 
1144
    def add_pipe(self, pipe):
1410
1145
        """Dummy function; override as necessary"""
1411
 
        pass
1412
 
 
1413
 
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
 
1146
        os.close(pipe)
 
1147
 
 
1148
 
 
1149
class IPv6_TCPServer(ForkingMixInWithPipe,
1414
1150
                     socketserver.TCPServer, object):
1415
1151
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1416
1152
    
1501
1237
            return socketserver.TCPServer.server_activate(self)
1502
1238
    def enable(self):
1503
1239
        self.enabled = True
1504
 
    def add_pipe(self, parent_pipe):
 
1240
    def add_pipe(self, pipe):
1505
1241
        # Call "handle_ipc" for both data and EOF events
1506
 
        gobject.io_add_watch(parent_pipe.fileno(),
1507
 
                             gobject.IO_IN | gobject.IO_HUP,
1508
 
                             functools.partial(self.handle_ipc,
1509
 
                                               parent_pipe = parent_pipe))
1510
 
        
1511
 
    def handle_ipc(self, source, condition, parent_pipe=None,
1512
 
                   client_object=None):
 
1242
        gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
 
1243
                             self.handle_ipc)
 
1244
    def handle_ipc(self, source, condition, file_objects={}):
1513
1245
        condition_names = {
1514
1246
            gobject.IO_IN: u"IN",   # There is data to read.
1515
1247
            gobject.IO_OUT: u"OUT", # Data can be written (without
1524
1256
                                       for cond, name in
1525
1257
                                       condition_names.iteritems()
1526
1258
                                       if cond & condition)
1527
 
        # error or the other end of multiprocessing.Pipe has closed
1528
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1529
 
            return False
1530
 
        
1531
 
        # Read a request from the child
1532
 
        request = parent_pipe.recv()
1533
 
        command = request[0]
1534
 
        
1535
 
        if command == 'init':
1536
 
            fpr = request[1]
1537
 
            address = request[2]
1538
 
            
1539
 
            for c in self.clients:
1540
 
                if c.fingerprint == fpr:
1541
 
                    client = c
1542
 
                    break
1543
 
            else:
1544
 
                logger.warning(u"Client not found for fingerprint: %s, ad"
1545
 
                               u"dress: %s", fpr, address)
1546
 
                if self.use_dbus:
1547
 
                    # Emit D-Bus signal
1548
 
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
1549
 
                parent_pipe.send(False)
1550
 
                return False
1551
 
            
1552
 
            gobject.io_add_watch(parent_pipe.fileno(),
1553
 
                                 gobject.IO_IN | gobject.IO_HUP,
1554
 
                                 functools.partial(self.handle_ipc,
1555
 
                                                   parent_pipe = parent_pipe,
1556
 
                                                   client_object = client))
1557
 
            parent_pipe.send(True)
1558
 
            # remove the old hook in favor of the new above hook on same fileno
1559
 
            return False
1560
 
        if command == 'funcall':
1561
 
            funcname = request[1]
1562
 
            args = request[2]
1563
 
            kwargs = request[3]
1564
 
            
1565
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1566
 
 
1567
 
        if command == 'getattr':
1568
 
            attrname = request[1]
1569
 
            if callable(client_object.__getattribute__(attrname)):
1570
 
                parent_pipe.send(('function',))
1571
 
            else:
1572
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1573
 
        
1574
 
        if command == 'setattr':
1575
 
            attrname = request[1]
1576
 
            value = request[2]
1577
 
            setattr(client_object, attrname, value)
1578
 
 
 
1259
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
 
1260
                     conditions_string)
 
1261
        
 
1262
        # Turn the pipe file descriptor into a Python file object
 
1263
        if source not in file_objects:
 
1264
            file_objects[source] = os.fdopen(source, u"r", 1)
 
1265
        
 
1266
        # Read a line from the file object
 
1267
        cmdline = file_objects[source].readline()
 
1268
        if not cmdline:             # Empty line means end of file
 
1269
            # close the IPC pipe
 
1270
            file_objects[source].close()
 
1271
            del file_objects[source]
 
1272
            
 
1273
            # Stop calling this function
 
1274
            return False
 
1275
        
 
1276
        logger.debug(u"IPC command: %r", cmdline)
 
1277
        
 
1278
        # Parse and act on command
 
1279
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
 
1280
        
 
1281
        if cmd == u"NOTFOUND":
 
1282
            logger.warning(u"Client not found for fingerprint: %s",
 
1283
                           args)
 
1284
            if self.use_dbus:
 
1285
                # Emit D-Bus signal
 
1286
                mandos_dbus_service.ClientNotFound(args)
 
1287
        elif cmd == u"INVALID":
 
1288
            for client in self.clients:
 
1289
                if client.name == args:
 
1290
                    logger.warning(u"Client %s is invalid", args)
 
1291
                    if self.use_dbus:
 
1292
                        # Emit D-Bus signal
 
1293
                        client.Rejected()
 
1294
                    break
 
1295
            else:
 
1296
                logger.error(u"Unknown client %s is invalid", args)
 
1297
        elif cmd == u"SENDING":
 
1298
            for client in self.clients:
 
1299
                if client.name == args:
 
1300
                    logger.info(u"Sending secret to %s", client.name)
 
1301
                    client.checked_ok()
 
1302
                    if self.use_dbus:
 
1303
                        # Emit D-Bus signal
 
1304
                        client.GotSecret()
 
1305
                    break
 
1306
            else:
 
1307
                logger.error(u"Sending secret to unknown client %s",
 
1308
                             args)
 
1309
        else:
 
1310
            logger.error(u"Unknown IPC command: %r", cmdline)
 
1311
        
 
1312
        # Keep calling this function
1579
1313
        return True
1580
1314
 
1581
1315
 
1611
1345
            elif suffix == u"w":
1612
1346
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1613
1347
            else:
1614
 
                raise ValueError(u"Unknown suffix %r" % suffix)
1615
 
        except (ValueError, IndexError), e:
1616
 
            raise ValueError(e.message)
 
1348
                raise ValueError
 
1349
        except (ValueError, IndexError):
 
1350
            raise ValueError
1617
1351
        timevalue += delta
1618
1352
    return timevalue
1619
1353
 
1632
1366
        def if_nametoindex(interface):
1633
1367
            "Get an interface index the hard way, i.e. using fcntl()"
1634
1368
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1635
 
            with contextlib.closing(socket.socket()) as s:
 
1369
            with closing(socket.socket()) as s:
1636
1370
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1637
1371
                                    struct.pack(str(u"16s16x"),
1638
1372
                                                interface))
1684
1418
    parser.add_option("--debug", action=u"store_true",
1685
1419
                      help=u"Debug mode; run in foreground and log to"
1686
1420
                      u" terminal")
1687
 
    parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
1688
 
                      help=u"Debug level for stdout output")
1689
1421
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
1422
                      u" priority string (see GnuTLS documentation)")
1691
1423
    parser.add_option("--servicename", type=u"string",
1716
1448
                        u"servicename": u"Mandos",
1717
1449
                        u"use_dbus": u"True",
1718
1450
                        u"use_ipv6": u"True",
1719
 
                        u"debuglevel": u"",
1720
1451
                        }
1721
1452
    
1722
1453
    # Parse config file for server-global settings
1739
1470
    # options, if set.
1740
1471
    for option in (u"interface", u"address", u"port", u"debug",
1741
1472
                   u"priority", u"servicename", u"configdir",
1742
 
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
 
1473
                   u"use_dbus", u"use_ipv6"):
1743
1474
        value = getattr(options, option)
1744
1475
        if value is not None:
1745
1476
            server_settings[option] = value
1754
1485
    
1755
1486
    # For convenience
1756
1487
    debug = server_settings[u"debug"]
1757
 
    debuglevel = server_settings[u"debuglevel"]
1758
1488
    use_dbus = server_settings[u"use_dbus"]
1759
1489
    use_ipv6 = server_settings[u"use_ipv6"]
1760
 
 
 
1490
    
 
1491
    if not debug:
 
1492
        syslogger.setLevel(logging.WARNING)
 
1493
        console.setLevel(logging.WARNING)
 
1494
    
1761
1495
    if server_settings[u"servicename"] != u"Mandos":
1762
1496
        syslogger.setFormatter(logging.Formatter
1763
1497
                               (u'Mandos (%s) [%%(process)d]:'
1769
1503
                        u"interval": u"5m",
1770
1504
                        u"checker": u"fping -q -- %%(host)s",
1771
1505
                        u"host": u"",
1772
 
                        u"approval_delay": u"0s",
1773
 
                        u"approval_duration": u"1s",
1774
1506
                        }
1775
1507
    client_config = configparser.SafeConfigParser(client_defaults)
1776
1508
    client_config.read(os.path.join(server_settings[u"configdir"],
1782
1514
    tcp_server = MandosServer((server_settings[u"address"],
1783
1515
                               server_settings[u"port"]),
1784
1516
                              ClientHandler,
1785
 
                              interface=(server_settings[u"interface"]
1786
 
                                         or None),
 
1517
                              interface=server_settings[u"interface"],
1787
1518
                              use_ipv6=use_ipv6,
1788
1519
                              gnutls_priority=
1789
1520
                              server_settings[u"priority"],
1790
1521
                              use_dbus=use_dbus)
1791
 
    if not debug:
1792
 
        pidfilename = u"/var/run/mandos.pid"
1793
 
        try:
1794
 
            pidfile = open(pidfilename, u"w")
1795
 
        except IOError:
1796
 
            logger.error(u"Could not open file %r", pidfilename)
 
1522
    pidfilename = u"/var/run/mandos.pid"
 
1523
    try:
 
1524
        pidfile = open(pidfilename, u"w")
 
1525
    except IOError:
 
1526
        logger.error(u"Could not open file %r", pidfilename)
1797
1527
    
1798
1528
    try:
1799
1529
        uid = pwd.getpwnam(u"_mandos").pw_uid
1816
1546
        if error[0] != errno.EPERM:
1817
1547
            raise error
1818
1548
    
1819
 
    if not debug and not debuglevel:
1820
 
        syslogger.setLevel(logging.WARNING)
1821
 
        console.setLevel(logging.WARNING)
1822
 
    if debuglevel:
1823
 
        level = getattr(logging, debuglevel.upper())
1824
 
        syslogger.setLevel(level)
1825
 
        console.setLevel(level)
1826
 
 
 
1549
    # Enable all possible GnuTLS debugging
1827
1550
    if debug:
1828
 
        # Enable all possible GnuTLS debugging
1829
 
        
1830
1551
        # "Use a log level over 10 to enable all debugging options."
1831
1552
        # - GnuTLS manual
1832
1553
        gnutls.library.functions.gnutls_global_set_log_level(11)
1837
1558
        
1838
1559
        (gnutls.library.functions
1839
1560
         .gnutls_global_set_log_function(debug_gnutls))
1840
 
        
1841
 
        # Redirect stdin so all checkers get /dev/null
1842
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1843
 
        os.dup2(null, sys.stdin.fileno())
1844
 
        if null > 2:
1845
 
            os.close(null)
1846
 
    else:
1847
 
        # No console logging
1848
 
        logger.removeHandler(console)
1849
 
    
1850
 
    # Need to fork before connecting to D-Bus
1851
 
    if not debug:
1852
 
        # Close all input and output, do double fork, etc.
1853
 
        daemon()
1854
1561
    
1855
1562
    global main_loop
1856
1563
    # From the Avahi example code
1859
1566
    bus = dbus.SystemBus()
1860
1567
    # End of Avahi example code
1861
1568
    if use_dbus:
1862
 
        try:
1863
 
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1864
 
                                            bus, do_not_queue=True)
1865
 
        except dbus.exceptions.NameExistsException, e:
1866
 
            logger.error(unicode(e) + u", disabling D-Bus")
1867
 
            use_dbus = False
1868
 
            server_settings[u"use_dbus"] = False
1869
 
            tcp_server.use_dbus = False
 
1569
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1870
1570
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1871
1571
    service = AvahiService(name = server_settings[u"servicename"],
1872
1572
                           servicetype = u"_mandos._tcp",
1875
1575
        service.interface = (if_nametoindex
1876
1576
                             (str(server_settings[u"interface"])))
1877
1577
    
1878
 
    global multiprocessing_manager
1879
 
    multiprocessing_manager = multiprocessing.Manager()
1880
 
    
1881
1578
    client_class = Client
1882
1579
    if use_dbus:
1883
1580
        client_class = functools.partial(ClientDBus, bus = bus)
1884
 
    def client_config_items(config, section):
1885
 
        special_settings = {
1886
 
            "approved_by_default":
1887
 
                lambda: config.getboolean(section,
1888
 
                                          "approved_by_default"),
1889
 
            }
1890
 
        for name, value in config.items(section):
1891
 
            try:
1892
 
                yield (name, special_settings[name]())
1893
 
            except KeyError:
1894
 
                yield (name, value)
1895
 
    
1896
1581
    tcp_server.clients.update(set(
1897
1582
            client_class(name = section,
1898
 
                         config= dict(client_config_items(
1899
 
                        client_config, section)))
 
1583
                         config= dict(client_config.items(section)))
1900
1584
            for section in client_config.sections()))
1901
1585
    if not tcp_server.clients:
1902
1586
        logger.warning(u"No clients defined")
 
1587
    
 
1588
    if debug:
 
1589
        # Redirect stdin so all checkers get /dev/null
 
1590
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1591
        os.dup2(null, sys.stdin.fileno())
 
1592
        if null > 2:
 
1593
            os.close(null)
 
1594
    else:
 
1595
        # No console logging
 
1596
        logger.removeHandler(console)
 
1597
        # Close all input and output, do double fork, etc.
 
1598
        daemon()
 
1599
    
 
1600
    try:
 
1601
        with closing(pidfile):
 
1602
            pid = os.getpid()
 
1603
            pidfile.write(str(pid) + "\n")
 
1604
        del pidfile
 
1605
    except IOError:
 
1606
        logger.error(u"Could not write to file %r with PID %d",
 
1607
                     pidfilename, pid)
 
1608
    except NameError:
 
1609
        # "pidfile" was never created
 
1610
        pass
 
1611
    del pidfilename
 
1612
    
 
1613
    def cleanup():
 
1614
        "Cleanup function; run on exit"
 
1615
        service.cleanup()
1903
1616
        
 
1617
        while tcp_server.clients:
 
1618
            client = tcp_server.clients.pop()
 
1619
            client.disable_hook = None
 
1620
            client.disable()
 
1621
    
 
1622
    atexit.register(cleanup)
 
1623
    
1904
1624
    if not debug:
1905
 
        try:
1906
 
            with pidfile:
1907
 
                pid = os.getpid()
1908
 
                pidfile.write(str(pid) + "\n")
1909
 
            del pidfile
1910
 
        except IOError:
1911
 
            logger.error(u"Could not write to file %r with PID %d",
1912
 
                         pidfilename, pid)
1913
 
        except NameError:
1914
 
            # "pidfile" was never created
1915
 
            pass
1916
 
        del pidfilename
1917
 
        
1918
1625
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1919
 
 
1920
1626
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1921
1627
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1922
1628
    
1927
1633
                dbus.service.Object.__init__(self, bus, u"/")
1928
1634
            _interface = u"se.bsnet.fukt.Mandos"
1929
1635
            
1930
 
            @dbus.service.signal(_interface, signature=u"o")
1931
 
            def ClientAdded(self, objpath):
 
1636
            @dbus.service.signal(_interface, signature=u"oa{sv}")
 
1637
            def ClientAdded(self, objpath, properties):
1932
1638
                "D-Bus signal"
1933
1639
                pass
1934
1640
            
1935
 
            @dbus.service.signal(_interface, signature=u"ss")
1936
 
            def ClientNotFound(self, fingerprint, address):
 
1641
            @dbus.service.signal(_interface, signature=u"s")
 
1642
            def ClientNotFound(self, fingerprint):
1937
1643
                "D-Bus signal"
1938
1644
                pass
1939
1645
            
1965
1671
                        tcp_server.clients.remove(c)
1966
1672
                        c.remove_from_connection()
1967
1673
                        # Don't signal anything except ClientRemoved
1968
 
                        c.disable(quiet=True)
 
1674
                        c.disable(signal=False)
1969
1675
                        # Emit D-Bus signal
1970
1676
                        self.ClientRemoved(object_path, c.name)
1971
1677
                        return
1972
 
                raise KeyError(object_path)
 
1678
                raise KeyError
1973
1679
            
1974
1680
            del _interface
1975
1681
        
1976
1682
        mandos_dbus_service = MandosDBusService()
1977
1683
    
1978
 
    def cleanup():
1979
 
        "Cleanup function; run on exit"
1980
 
        service.cleanup()
1981
 
        
1982
 
        while tcp_server.clients:
1983
 
            client = tcp_server.clients.pop()
1984
 
            if use_dbus:
1985
 
                client.remove_from_connection()
1986
 
            client.disable_hook = None
1987
 
            # Don't signal anything except ClientRemoved
1988
 
            client.disable(quiet=True)
1989
 
            if use_dbus:
1990
 
                # Emit D-Bus signal
1991
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1992
 
                                                  client.name)
1993
 
    
1994
 
    atexit.register(cleanup)
1995
 
    
1996
1684
    for client in tcp_server.clients:
1997
1685
        if use_dbus:
1998
1686
            # Emit D-Bus signal
1999
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
1687
            mandos_dbus_service.ClientAdded(client.dbus_object_path,
 
1688
                                            client.GetAll(u""))
2000
1689
        client.enable()
2001
1690
    
2002
1691
    tcp_server.enable()
2020
1709
            service.activate()
2021
1710
        except dbus.exceptions.DBusException, error:
2022
1711
            logger.critical(u"DBusException: %s", error)
2023
 
            cleanup()
2024
1712
            sys.exit(1)
2025
1713
        # End of Avahi example code
2026
1714
        
2033
1721
        main_loop.run()
2034
1722
    except AvahiError, error:
2035
1723
        logger.critical(u"AvahiError: %s", error)
2036
 
        cleanup()
2037
1724
        sys.exit(1)
2038
1725
    except KeyboardInterrupt:
2039
1726
        if debug:
2040
1727
            print >> sys.stderr
2041
1728
        logger.debug(u"Server received KeyboardInterrupt")
2042
1729
    logger.debug(u"Server exiting")
2043
 
    # Must run before the D-Bus bus name gets deregistered
2044
 
    cleanup()
2045
1730
 
2046
1731
if __name__ == '__main__':
2047
1732
    main()