/mandos/trunk : revision 397

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

55

import logging

56

import logging.handlers

57

import pwd

58

import contextlib

58

from contextlib import closing

59

import struct

60

import fcntl

61

import functools

62

import cPickle as pickle

63

import multiprocessing

64

62

65

63

import dbus

66

64

import dbus.service

81

79

SO_BINDTODEVICE = None

82

80

83

81

84

version = "1.2.1"

82

version = "1.0.14"

85

83

86

#logger = logging.getLogger(u'mandos')

87

84

logger = logging.Logger(u'mandos')

88

85

syslogger = (logging.handlers.SysLogHandler

89

86

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

157

154

u" after %i retries, exiting.",

158

155

self.rename_count)

159

156

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

157

self.name = self.server.GetAlternativeServiceName(self.name)

161

158

logger.info(u"Changing Zeroconf service name to %r ...",

162

self.name)

159

unicode(self.name))

163

160

syslogger.setFormatter(logging.Formatter

164

161

(u'Mandos (%s) [%%(process)d]:'

165

162

u' %%(levelname)s: %%(message)s'

166

163

% self.name))

167

164

self.remove()

168

try:

169

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

172

self.cleanup()

173

os._exit(1)

165

self.add()

174

166

self.rename_count += 1

175

167

def remove(self):

176

168

"""Derived from the Avahi example code"""

199

191

self.group.Commit()

200

192

def entry_group_state_changed(self, state, error):

201

193

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

194

logger.debug(u"Avahi state change: %i", state)

203

195

204

196

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

197

logger.debug(u"Zeroconf service established.")

218

210

self.group = None

219

211

def server_state_changed(self, state):

220

212

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

213

if state == avahi.SERVER_COLLISION:

223

214

logger.error(u"Zeroconf server name collision")

224

215

self.remove()

240

231

"""A representation of a client host served by this server.

241

232

242

233

Attributes:

243

_approved: bool(); 'None' if not yet approved/disapproved

244

approval_delay: datetime.timedelta(); Time to wait for approval

245

approval_duration: datetime.timedelta(); Duration of one approval

234

name: string; from the config file, used in log messages and

235

D-Bus identifiers

236

fingerprint: string (40 or 32 hexadecimal digits); used to

237

uniquely identify the client

238

secret: bytestring; sent verbatim (over TLS) to client

239

host: string; available for use by the checker command

240

created: datetime.datetime(); (UTC) object creation

241

last_enabled: datetime.datetime(); (UTC)

242

enabled: bool()

243

last_checked_ok: datetime.datetime(); (UTC) or None

244

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

246

interval: datetime.timedelta(); How often to start a new checker

247

disable_hook: If set, called by disable() as disable_hook(self)

246

248

checker: subprocess.Popen(); a running checker process used

247

249

to see if the client lives.

248

250

'None' if no process is running.

249

checker_callback_tag: a gobject event source tag, or None

250

checker_command: string; External command which is run to check

251

if client lives. %() expansions are done at

251

checker_initiator_tag: a gobject event source tag, or None

252

disable_initiator_tag: - '' -

253

checker_callback_tag: - '' -

254

checker_command: string; External command which is run to check if

255

client lives. %() expansions are done at

252

256

runtime with vars(self) as dict, so that for

253

257

instance %(name)s can be used in the command.

254

checker_initiator_tag: a gobject event source tag, or None

255

created: datetime.datetime(); (UTC) object creation

256

258

current_checker_command: string; current running checker_command

257

disable_hook: If set, called by disable() as disable_hook(self)

258

disable_initiator_tag: a gobject event source tag, or None

259

enabled: bool()

260

fingerprint: string (40 or 32 hexadecimal digits); used to

261

uniquely identify the client

262

host: string; available for use by the checker command

263

interval: datetime.timedelta(); How often to start a new checker

264

last_approval_request: datetime.datetime(); (UTC) or None

265

last_checked_ok: datetime.datetime(); (UTC) or None

266

last_enabled: datetime.datetime(); (UTC)

267

name: string; from the config file, used in log messages and

268

D-Bus identifiers

269

secret: bytestring; sent verbatim (over TLS) to client

270

timeout: datetime.timedelta(); How long from last_checked_ok

271

until this client is disabled

272

runtime_expansions: Allowed attributes for runtime expansion.

273

259

"""

274

260

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

280

261

@staticmethod

281

262

def _timedelta_to_milliseconds(td):

282

263

"Convert a datetime.timedelta() to milliseconds"

291

272

def interval_milliseconds(self):

292

273

"Return the 'interval' attribute in milliseconds"

293

274

return self._timedelta_to_milliseconds(self.interval)

294

295

def approval_delay_milliseconds(self):

296

return self._timedelta_to_milliseconds(self.approval_delay)

297

275

298

276

def __init__(self, name = None, disable_hook=None, config=None):

299

277

"""Note: the 'checker' key in 'config' sets the

312

290

if u"secret" in config:

313

291

self.secret = config[u"secret"].decode(u"base64")

314

292

elif u"secfile" in config:

315

with open(os.path.expanduser(os.path.expandvars

316

(config[u"secfile"])),

317

"rb") as secfile:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])),

296

"rb")) as secfile:

318

297

self.secret = secfile.read()

319

298

else:

320

299

raise TypeError(u"No secret or secfile for client %s"

322

301

self.host = config.get(u"host", u"")

323

302

self.created = datetime.datetime.utcnow()

324

303

self.enabled = False

325

self.last_approval_request = None

326

304

self.last_enabled = None

327

305

self.last_checked_ok = None

328

306

self.timeout = string_to_delta(config[u"timeout"])

335

313

self.checker_command = config[u"checker"]

336

314

self.current_checker_command = None

337

315

self.last_connect = None

338

self._approved = None

339

self.approved_by_default = config.get(u"approved_by_default",

340

True)

341

self.approvals_pending = 0

342

self.approval_delay = string_to_delta(

343

config[u"approval_delay"])

344

self.approval_duration = string_to_delta(

345

config[u"approval_duration"])

346

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

347

316

348

def send_changedstate(self):

349

self.changedstate.acquire()

350

self.changedstate.notify_all()

351

self.changedstate.release()

352

353

317

def enable(self):

354

318

"""Start this client's checker and timeout hooks"""

355

319

if getattr(self, u"enabled", False):

356

320

# Already enabled

357

321

return

358

self.send_changedstate()

359

322

self.last_enabled = datetime.datetime.utcnow()

360

323

# Schedule a new checker to be started an 'interval' from now,

361

324

# and every interval from then on.

362

325

self.checker_initiator_tag = (gobject.timeout_add

363

326

(self.interval_milliseconds(),

364

327

self.start_checker))

328

# Also start a new checker *right now*.

329

self.start_checker()

365

330

# Schedule a disable() when 'timeout' has passed

366

331

self.disable_initiator_tag = (gobject.timeout_add

367

332

(self.timeout_milliseconds(),

368

333

self.disable))

369

334

self.enabled = True

370

# Also start a new checker *right now*.

371

self.start_checker()

372

335

373

def disable(self, quiet=True):

336

def disable(self):

374

337

"""Disable this client."""

375

338

if not getattr(self, "enabled", False):

376

339

return False

377

if not quiet:

378

self.send_changedstate()

379

if not quiet:

380

logger.info(u"Disabling client %s", self.name)

340

logger.info(u"Disabling client %s", self.name)

381

341

if getattr(self, u"disable_initiator_tag", False):

382

342

gobject.source_remove(self.disable_initiator_tag)

383

343

self.disable_initiator_tag = None

424

384

(self.timeout_milliseconds(),

425

385

self.disable))

426

386

427

def need_approval(self):

428

self.last_approval_request = datetime.datetime.utcnow()

429

430

387

def start_checker(self):

431

388

"""Start a new checker subprocess if one is not running.

432

389

438

395

# client would inevitably timeout, since no checker would get

439

396

# a chance to run to completion. If we instead leave running

440

397

# checkers alone, the checker would have to take more time

441

# than 'timeout' for the client to be disabled, which is as it

442

# should be.

398

# than 'timeout' for the client to be declared invalid, which

399

# is as it should be.

443

400

444

401

# If a checker exists, make sure it is not a zombie

445

402

try:

461

418

command = self.checker_command % self.host

462

419

except TypeError:

463

420

# Escape attributes for the shell

464

escaped_attrs = dict(

465

(attr,

466

re.escape(unicode(str(getattr(self, attr, u"")),

467

errors=

468

u'replace')))

469

for attr in

470

self.runtime_expansions)

471

421

escaped_attrs = dict((key,

422

re.escape(unicode(str(val),

423

errors=

424

u'replace')))

425

for key, val in

426

vars(self).iteritems())

472

427

try:

473

428

command = self.checker_command % escaped_attrs

474

429

except TypeError, error:

512

467

logger.debug(u"Stopping checker for %(name)s", vars(self))

513

468

try:

514

469

os.kill(self.checker.pid, signal.SIGTERM)

515

#time.sleep(0.5)

470

#os.sleep(0.5)

516

471

#if self.checker.poll() is None:

517

472

# os.kill(self.checker.pid, signal.SIGKILL)

518

473

except OSError, error:

519

474

if error.errno != errno.ESRCH: # No such process

520

475

raise

521

476

self.checker = None

477

478

def still_valid(self):

479

"""Has the timeout not yet passed for this client?"""

480

if not getattr(self, u"enabled", False):

481

return False

482

now = datetime.datetime.utcnow()

483

if self.last_checked_ok is None:

484

return now < (self.created + self.timeout)

485

else:

486

return now < (self.last_checked_ok + self.timeout)

487

522

488

523

489

def dbus_service_property(dbus_interface, signature=u"v",

524

490

access=u"readwrite", byte_arrays=False):

532

498

dbus.service.method, except there is only "signature", since the

533

499

type from Get() and the type sent to Set() is the same.

534

500

"""

535

# Encoding deeply encoded byte arrays is not supported yet by the

536

# "Set" method, so we fail early here:

537

if byte_arrays and signature != u"ay":

538

raise ValueError(u"Byte arrays not supported for non-'ay'"

539

u" signature %r" % signature)

540

501

def decorator(func):

541

502

func._dbus_is_property = True

542

503

func._dbus_interface = dbus_interface

628

589

if prop._dbus_access == u"read":

629

590

raise DBusPropertyAccessException(property_name)

630

591

if prop._dbus_get_args_options[u"byte_arrays"]:

631

# The byte_arrays option is not supported yet on

632

# signatures other than "ay".

633

if prop._dbus_signature != u"ay":

634

raise ValueError

635

592

value = dbus.ByteArray(''.join(unichr(byte)

636

593

for byte in value))

637

594

prop(value)

716

673

dbus_object_path: dbus.ObjectPath

717

674

bus: dbus.SystemBus()

718

675

"""

719

720

runtime_expansions = (Client.runtime_expansions

721

+ (u"dbus_object_path",))

722

723

676

# dbus.service.Object doesn't use super(), so we can't either.

724

677

725

678

def __init__(self, bus = None, *args, **kwargs):

726

self._approvals_pending = 0

727

679

self.bus = bus

728

680

Client.__init__(self, *args, **kwargs)

729

681

# Only now, when this client is initialized, can it show up on

730

682

# the D-Bus

731

client_object_name = unicode(self.name).translate(

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

734

683

self.dbus_object_path = (dbus.ObjectPath

735

(u"/clients/" + client_object_name))

684

(u"/clients/"

685

+ self.name.replace(u".", u"_")))

736

686

DBusObjectWithProperties.__init__(self, self.bus,

737

687

self.dbus_object_path)

738

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

750

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

754

688

755

689

@staticmethod

756

690

def _datetime_to_dbus(dt, variant_level=0):

763

697

r = Client.enable(self)

764

698

if oldstate != self.enabled:

765

699

# Emit D-Bus signals

766

self.PropertyChanged(dbus.String(u"Enabled"),

700

self.PropertyChanged(dbus.String(u"enabled"),

767

701

dbus.Boolean(True, variant_level=1))

768

702

self.PropertyChanged(

769

dbus.String(u"LastEnabled"),

703

dbus.String(u"last_enabled"),

770

704

self._datetime_to_dbus(self.last_enabled,

771

705

variant_level=1))

772

706

return r

773

707

774

def disable(self, quiet = False):

708

def disable(self, signal = True):

775

709

oldstate = getattr(self, u"enabled", False)

776

r = Client.disable(self, quiet=quiet)

777

if not quiet and oldstate != self.enabled:

710

r = Client.disable(self)

711

if signal and oldstate != self.enabled:

778

712

# Emit D-Bus signal

779

self.PropertyChanged(dbus.String(u"Enabled"),

713

self.PropertyChanged(dbus.String(u"enabled"),

780

714

dbus.Boolean(False, variant_level=1))

781

715

return r

782

716

794

728

self.checker_callback_tag = None

795

729

self.checker = None

796

730

# Emit D-Bus signal

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

731

self.PropertyChanged(dbus.String(u"checker_running"),

798

732

dbus.Boolean(False, variant_level=1))

799

733

if os.WIFEXITED(condition):

800

734

exitstatus = os.WEXITSTATUS(condition)

815

749

r = Client.checked_ok(self, *args, **kwargs)

816

750

# Emit D-Bus signal

817

751

self.PropertyChanged(

818

dbus.String(u"LastCheckedOK"),

752

dbus.String(u"last_checked_ok"),

819

753

(self._datetime_to_dbus(self.last_checked_ok,

820

754

variant_level=1)))

821

755

return r

822

756

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

830

return r

831

832

757

def start_checker(self, *args, **kwargs):

833

758

old_checker = self.checker

834

759

if self.checker is not None:

842

767

# Emit D-Bus signal

843

768

self.CheckerStarted(self.current_checker_command)

844

769

self.PropertyChanged(

845

dbus.String(u"CheckerRunning"),

770

dbus.String(u"checker_running"),

846

771

dbus.Boolean(True, variant_level=1))

847

772

return r

848

773

851

776

r = Client.stop_checker(self, *args, **kwargs)

852

777

if (old_checker is not None

853

778

and getattr(self, u"checker", None) is None):

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

779

self.PropertyChanged(dbus.String(u"checker_running"),

855

780

dbus.Boolean(False, variant_level=1))

856

781

return r

857

858

def _reset_approved(self):

859

self._approved = None

860

return False

861

862

def approve(self, value=True):

863

self.send_changedstate()

864

self._approved = value

865

gobject.timeout_add(self._timedelta_to_milliseconds

866

(self.approval_duration),

867

self._reset_approved)

868

869

870

## D-Bus methods, signals & properties

782

783

## D-Bus methods & signals

871

784

_interface = u"se.bsnet.fukt.Mandos.Client"

872

785

873

## Signals

786

# CheckedOK - method

787

@dbus.service.method(_interface)

788

def CheckedOK(self):

789

return self.checked_ok()

874

790

875

791

# CheckerCompleted - signal

876

792

@dbus.service.signal(_interface, signature=u"nxs")

893

809

# GotSecret - signal

894

810

@dbus.service.signal(_interface)

895

811

def GotSecret(self):

896

"""D-Bus signal

897

Is sent after a successful transfer of secret from the Mandos

898

server to mandos-client

899

"""

812

"D-Bus signal"

900

813

pass

901

814

902

815

# Rejected - signal

903

@dbus.service.signal(_interface, signature=u"s")

904

def Rejected(self, reason):

816

@dbus.service.signal(_interface)

817

def Rejected(self):

905

818

"D-Bus signal"

906

819

pass

907

820

908

# NeedApproval - signal

909

@dbus.service.signal(_interface, signature=u"tb")

910

def NeedApproval(self, timeout, default):

911

"D-Bus signal"

912

return self.need_approval()

913

914

## Methods

915

916

# Approve - method

917

@dbus.service.method(_interface, in_signature=u"b")

918

def Approve(self, value):

919

self.approve(value)

920

921

# CheckedOK - method

922

@dbus.service.method(_interface)

923

def CheckedOK(self):

924

return self.checked_ok()

925

926

821

# Enable - method

927

822

@dbus.service.method(_interface)

928

823

def Enable(self):

946

841

def StopChecker(self):

947

842

self.stop_checker()

948

843

949

## Properties

950

951

# ApprovalPending - property

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

953

def ApprovalPending_dbus_property(self):

954

return dbus.Boolean(bool(self.approvals_pending))

955

956

# ApprovedByDefault - property

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

959

def ApprovedByDefault_dbus_property(self, value=None):

960

if value is None: # get

961

return dbus.Boolean(self.approved_by_default)

962

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

966

967

# ApprovalDelay - property

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

970

def ApprovalDelay_dbus_property(self, value=None):

971

if value is None: # get

972

return dbus.UInt64(self.approval_delay_milliseconds())

973

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

977

978

# ApprovalDuration - property

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

981

def ApprovalDuration_dbus_property(self, value=None):

982

if value is None: # get

983

return dbus.UInt64(self._timedelta_to_milliseconds(

984

self.approval_duration))

985

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

989

990

# Name - property

844

# name - property

991

845

@dbus_service_property(_interface, signature=u"s", access=u"read")

992

def Name_dbus_property(self):

846

def name_dbus_property(self):

993

847

return dbus.String(self.name)

994

848

995

# Fingerprint - property

849

# fingerprint - property

996

850

@dbus_service_property(_interface, signature=u"s", access=u"read")

997

def Fingerprint_dbus_property(self):

851

def fingerprint_dbus_property(self):

998

852

return dbus.String(self.fingerprint)

999

853

1000

# Host - property

854

# host - property

1001

855

@dbus_service_property(_interface, signature=u"s",

1002

856

access=u"readwrite")

1003

def Host_dbus_property(self, value=None):

857

def host_dbus_property(self, value=None):

1004

858

if value is None: # get

1005

859

return dbus.String(self.host)

1006

860

self.host = value

1007

861

# Emit D-Bus signal

1008

self.PropertyChanged(dbus.String(u"Host"),

862

self.PropertyChanged(dbus.String(u"host"),

1009

863

dbus.String(value, variant_level=1))

1010

864

1011

# Created - property

865

# created - property

1012

866

@dbus_service_property(_interface, signature=u"s", access=u"read")

1013

def Created_dbus_property(self):

867

def created_dbus_property(self):

1014

868

return dbus.String(self._datetime_to_dbus(self.created))

1015

869

1016

# LastEnabled - property

870

# last_enabled - property

1017

871

@dbus_service_property(_interface, signature=u"s", access=u"read")

1018

def LastEnabled_dbus_property(self):

872

def last_enabled_dbus_property(self):

1019

873

if self.last_enabled is None:

1020

874

return dbus.String(u"")

1021

875

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1022

876

1023

# Enabled - property

877

# enabled - property

1024

878

@dbus_service_property(_interface, signature=u"b",

1025

879

access=u"readwrite")

1026

def Enabled_dbus_property(self, value=None):

880

def enabled_dbus_property(self, value=None):

1027

881

if value is None: # get

1028

882

return dbus.Boolean(self.enabled)

1029

883

if value:

1031

885

else:

1032

886

self.disable()

1033

887

1034

# LastCheckedOK - property

888

# last_checked_ok - property

1035

889

@dbus_service_property(_interface, signature=u"s",

1036

890

access=u"readwrite")

1037

def LastCheckedOK_dbus_property(self, value=None):

891

def last_checked_ok_dbus_property(self, value=None):

1038

892

if value is not None:

1039

893

self.checked_ok()

1040

894

return

1043

897

return dbus.String(self._datetime_to_dbus(self

1044

898

.last_checked_ok))

1045

899

1046

# LastApprovalRequest - property

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1048

def LastApprovalRequest_dbus_property(self):

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1054

1055

# Timeout - property

900

# timeout - property

1056

901

@dbus_service_property(_interface, signature=u"t",

1057

902

access=u"readwrite")

1058

def Timeout_dbus_property(self, value=None):

903

def timeout_dbus_property(self, value=None):

1059

904

if value is None: # get

1060

905

return dbus.UInt64(self.timeout_milliseconds())

1061

906

self.timeout = datetime.timedelta(0, 0, 0, value)

1062

907

# Emit D-Bus signal

1063

self.PropertyChanged(dbus.String(u"Timeout"),

908

self.PropertyChanged(dbus.String(u"timeout"),

1064

909

dbus.UInt64(value, variant_level=1))

1065

910

if getattr(self, u"disable_initiator_tag", None) is None:

1066

911

return

1080

925

self.disable_initiator_tag = (gobject.timeout_add

1081

926

(time_to_die, self.disable))

1082

927

1083

# Interval - property

928

# interval - property

1084

929

@dbus_service_property(_interface, signature=u"t",

1085

930

access=u"readwrite")

1086

def Interval_dbus_property(self, value=None):

931

def interval_dbus_property(self, value=None):

1087

932

if value is None: # get

1088

933

return dbus.UInt64(self.interval_milliseconds())

1089

934

self.interval = datetime.timedelta(0, 0, 0, value)

1090

935

# Emit D-Bus signal

1091

self.PropertyChanged(dbus.String(u"Interval"),

936

self.PropertyChanged(dbus.String(u"interval"),

1092

937

dbus.UInt64(value, variant_level=1))

1093

938

if getattr(self, u"checker_initiator_tag", None) is None:

1094

939

return

1098

943

(value, self.start_checker))

1099

944

self.start_checker() # Start one now, too

1100

945

1101

# Checker - property

946

# checker - property

1102

947

@dbus_service_property(_interface, signature=u"s",

1103

948

access=u"readwrite")

1104

def Checker_dbus_property(self, value=None):

949

def checker_dbus_property(self, value=None):

1105

950

if value is None: # get

1106

951

return dbus.String(self.checker_command)

1107

952

self.checker_command = value

1108

953

# Emit D-Bus signal

1109

self.PropertyChanged(dbus.String(u"Checker"),

954

self.PropertyChanged(dbus.String(u"checker"),

1110

955

dbus.String(self.checker_command,

1111

956

variant_level=1))

1112

957

1113

# CheckerRunning - property

958

# checker_running - property

1114

959

@dbus_service_property(_interface, signature=u"b",

1115

960

access=u"readwrite")

1116

def CheckerRunning_dbus_property(self, value=None):

961

def checker_running_dbus_property(self, value=None):

1117

962

if value is None: # get

1118

963

return dbus.Boolean(self.checker is not None)

1119

964

if value:

1121

966

else:

1122

967

self.stop_checker()

1123

968

1124

# ObjectPath - property

969

# object_path - property

1125

970

@dbus_service_property(_interface, signature=u"o", access=u"read")

1126

def ObjectPath_dbus_property(self):

971

def object_path_dbus_property(self):

1127

972

return self.dbus_object_path # is already a dbus.ObjectPath

1128

973

1129

# Secret = property

974

# secret = property

1130

975

@dbus_service_property(_interface, signature=u"ay",

1131

976

access=u"write", byte_arrays=True)

1132

def Secret_dbus_property(self, value):

977

def secret_dbus_property(self, value):

1133

978

self.secret = str(value)

1134

979

1135

980

del _interface

1136

981

1137

982

1138

class ProxyClient(object):

1139

def __init__(self, child_pipe, fpr, address):

1140

self._pipe = child_pipe

1141

self._pipe.send(('init', fpr, address))

1142

if not self._pipe.recv():

1143

raise KeyError()

1144

1145

def __getattribute__(self, name):

1146

if(name == '_pipe'):

1147

return super(ProxyClient, self).__getattribute__(name)

1148

self._pipe.send(('getattr', name))

1149

data = self._pipe.recv()

1150

if data[0] == 'data':

1151

return data[1]

1152

if data[0] == 'function':

1153

def func(*args, **kwargs):

1154

self._pipe.send(('funcall', name, args, kwargs))

1155

return self._pipe.recv()[1]

1156

return func

1157

1158

def __setattr__(self, name, value):

1159

if(name == '_pipe'):

1160

return super(ProxyClient, self).__setattr__(name, value)

1161

self._pipe.send(('setattr', name, value))

1162

1163

1164

983

class ClientHandler(socketserver.BaseRequestHandler, object):

1165

984

"""A class to handle client connections.

1166

985

1168

987

Note: This will run in its own forked process."""

1169

988

1170

989

def handle(self):

1171

with contextlib.closing(self.server.child_pipe) as child_pipe:

1172

logger.info(u"TCP connection from: %s",

1173

unicode(self.client_address))

1174

logger.debug(u"Pipe FD: %d",

1175

self.server.child_pipe.fileno())

1176

990

logger.info(u"TCP connection from: %s",

991

unicode(self.client_address))

992

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

993

# Open IPC pipe to parent process

994

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1177

995

session = (gnutls.connection

1178

996

.ClientSession(self.request,

1179

997

gnutls.connection

1180

998

.X509Credentials()))

1181

999

1000

line = self.request.makefile().readline()

1001

logger.debug(u"Protocol version: %r", line)

1002

try:

1003

if int(line.strip().split()[0]) > 1:

1004

raise RuntimeError

1005

except (ValueError, IndexError, RuntimeError), error:

1006

logger.error(u"Unknown protocol version: %s", error)

1007

return

1008

1182

1009

# Note: gnutls.connection.X509Credentials is really a

1183

1010

# generic GnuTLS certificate credentials object so long as

1184

1011

# no X.509 keys are added to it. Therefore, we can use it

1185

1012

# here despite using OpenPGP certificates.

1186

1013

1187

1014

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1188

1015

# u"+AES-256-CBC", u"+SHA1",

1189

1016

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1195

1022

(gnutls.library.functions

1196

1023

.gnutls_priority_set_direct(session._c_object,

1197

1024

priority, None))

1198

1199

# Start communication using the Mandos protocol

1200

# Get protocol number

1201

line = self.request.makefile().readline()

1202

logger.debug(u"Protocol version: %r", line)

1203

try:

1204

if int(line.strip().split()[0]) > 1:

1205

raise RuntimeError

1206

except (ValueError, IndexError, RuntimeError), error:

1207

logger.error(u"Unknown protocol version: %s", error)

1208

return

1209

1210

# Start GnuTLS connection

1025

1211

1026

try:

1212

1027

session.handshake()

1213

1028

except gnutls.errors.GNUTLSError, error:

1216

1031

# established. Just abandon the request.

1217

1032

return

1218

1033

logger.debug(u"Handshake succeeded")

1219

1220

approval_required = False

1221

1034

try:

1222

try:

1223

fpr = self.fingerprint(self.peer_certificate

1224

(session))

1225

except (TypeError, gnutls.errors.GNUTLSError), error:

1226

logger.warning(u"Bad certificate: %s", error)

1227

return

1228

logger.debug(u"Fingerprint: %s", fpr)

1229

1230

try:

1231

client = ProxyClient(child_pipe, fpr,

1232

self.client_address)

1233

except KeyError:

1234

return

1235

1236

if client.approval_delay:

1237

delay = client.approval_delay

1238

client.approvals_pending += 1

1239

approval_required = True

1240

1241

while True:

1242

if not client.enabled:

1243

logger.warning(u"Client %s is disabled",

1244

client.name)

1245

if self.server.use_dbus:

1246

# Emit D-Bus signal

1247

client.Rejected("Disabled")

1248

return

1249

1250

if client._approved or not client.approval_delay:

1251

#We are approved or approval is disabled

1252

break

1253

elif client._approved is None:

1254

logger.info(u"Client %s needs approval",

1255

client.name)

1256

if self.server.use_dbus:

1257

# Emit D-Bus signal

1258

client.NeedApproval(

1259

client.approval_delay_milliseconds(),

1260

client.approved_by_default)

1261

else:

1262

logger.warning(u"Client %s was not approved",

1263

client.name)

1264

if self.server.use_dbus:

1265

# Emit D-Bus signal

1266

client.Rejected("Denied")

1267

return

1268

1269

#wait until timeout or approved

1270

#x = float(client._timedelta_to_milliseconds(delay))

1271

time = datetime.datetime.now()

1272

client.changedstate.acquire()

1273

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1274

client.changedstate.release()

1275

time2 = datetime.datetime.now()

1276

if (time2 - time) >= delay:

1277

if not client.approved_by_default:

1278

logger.warning("Client %s timed out while"

1279

" waiting for approval",

1280

client.name)

1281

if self.server.use_dbus:

1282

# Emit D-Bus signal

1283

client.Rejected("Approval timed out")

1284

return

1285

else:

1286

break

1287

else:

1288

delay -= time2 - time

1289

1290

sent_size = 0

1291

while sent_size < len(client.secret):

1292

try:

1293

sent = session.send(client.secret[sent_size:])

1294

except (gnutls.errors.GNUTLSError), error:

1295

logger.warning("gnutls send failed")

1296

return

1297

logger.debug(u"Sent: %d, remaining: %d",

1298

sent, len(client.secret)

1299

- (sent_size + sent))

1300

sent_size += sent

1301

1302

logger.info(u"Sending secret to %s", client.name)

1303

# bump the timeout as if seen

1304

client.checked_ok()

1305

if self.server.use_dbus:

1306

# Emit D-Bus signal

1307

client.GotSecret()

1035

fpr = self.fingerprint(self.peer_certificate(session))

1036

except (TypeError, gnutls.errors.GNUTLSError), error:

1037

logger.warning(u"Bad certificate: %s", error)

1038

session.bye()

1039

return

1040

logger.debug(u"Fingerprint: %s", fpr)

1308

1041

1309

finally:

1310

if approval_required:

1311

client.approvals_pending -= 1

1312

try:

1313

session.bye()

1314

except (gnutls.errors.GNUTLSError), error:

1315

logger.warning("GnuTLS bye failed")

1042

for c in self.server.clients:

1043

if c.fingerprint == fpr:

1044

client = c

1045

break

1046

else:

1047

ipc.write(u"NOTFOUND %s %s\n"

1048

% (fpr, unicode(self.client_address)))

1049

session.bye()

1050

return

1051

# Have to check if client.still_valid(), since it is

1052

# possible that the client timed out while establishing

1053

# the GnuTLS session.

1054

if not client.still_valid():

1055

ipc.write(u"INVALID %s\n" % client.name)

1056

session.bye()

1057

return

1058

ipc.write(u"SENDING %s\n" % client.name)

1059

sent_size = 0

1060

while sent_size < len(client.secret):

1061

sent = session.send(client.secret[sent_size:])

1062

logger.debug(u"Sent: %d, remaining: %d",

1063

sent, len(client.secret)

1064

- (sent_size + sent))

1065

sent_size += sent

1066

session.bye()

1316

1067

1317

1068

@staticmethod

1318

1069

def peer_certificate(session):

1378

1129

return hex_fpr

1379

1130

1380

1131

1381

class MultiprocessingMixIn(object):

1382

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1383

def sub_process_main(self, request, address):

1384

try:

1385

self.finish_request(request, address)

1386

except:

1387

self.handle_error(request, address)

1388

self.close_request(request)

1389

1390

def process_request(self, request, address):

1391

"""Start a new process to process the request."""

1392

multiprocessing.Process(target = self.sub_process_main,

1393

args = (request, address)).start()

1394

1395

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1396

""" adds a pipe to the MixIn """

1132

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1133

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1397

1134

def process_request(self, request, client_address):

1398

1135

"""Overrides and wraps the original process_request().

1399

1136

1400

1137

This function creates a new pipe in self.pipe

1401

1138

"""

1402

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1403

1404

super(MultiprocessingMixInWithPipe,

1139

self.pipe = os.pipe()

1140

super(ForkingMixInWithPipe,

1405

1141

self).process_request(request, client_address)

1406

self.child_pipe.close()

1407

self.add_pipe(parent_pipe)

1408

1409

def add_pipe(self, parent_pipe):

1142

os.close(self.pipe[1]) # close write end

1143

self.add_pipe(self.pipe[0])

1144

def add_pipe(self, pipe):

1410

1145

"""Dummy function; override as necessary"""

1411

pass

1412

1413

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1146

os.close(pipe)

1147

1148

1149

class IPv6_TCPServer(ForkingMixInWithPipe,

1414

1150

socketserver.TCPServer, object):

1415

1151

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1416

1152

1501

1237

return socketserver.TCPServer.server_activate(self)

1502

1238

def enable(self):

1503

1239

self.enabled = True

1504

def add_pipe(self, parent_pipe):

1240

def add_pipe(self, pipe):

1505

1241

# Call "handle_ipc" for both data and EOF events

1506

gobject.io_add_watch(parent_pipe.fileno(),

1507

gobject.IO_IN | gobject.IO_HUP,

1508

functools.partial(self.handle_ipc,

1509

parent_pipe = parent_pipe))

1510

1511

def handle_ipc(self, source, condition, parent_pipe=None,

1512

client_object=None):

1242

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1243

self.handle_ipc)

1244

def handle_ipc(self, source, condition, file_objects={}):

1513

1245

condition_names = {

1514

1246

gobject.IO_IN: u"IN", # There is data to read.

1515

1247

gobject.IO_OUT: u"OUT", # Data can be written (without

1524

1256

for cond, name in

1525

1257

condition_names.iteritems()

1526

1258

if cond & condition)

1527

# error or the other end of multiprocessing.Pipe has closed

1528

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1529

return False

1530

1531

# Read a request from the child

1532

request = parent_pipe.recv()

1533

command = request[0]

1534

1535

if command == 'init':

1536

fpr = request[1]

1537

address = request[2]

1538

1539

for c in self.clients:

1540

if c.fingerprint == fpr:

1541

client = c

1542

break

1543

else:

1544

logger.warning(u"Client not found for fingerprint: %s, ad"

1545

u"dress: %s", fpr, address)

1546

if self.use_dbus:

1547

# Emit D-Bus signal

1548

mandos_dbus_service.ClientNotFound(fpr, address[0])

1549

parent_pipe.send(False)

1550

return False

1551

1552

gobject.io_add_watch(parent_pipe.fileno(),

1553

gobject.IO_IN | gobject.IO_HUP,

1554

functools.partial(self.handle_ipc,

1555

parent_pipe = parent_pipe,

1556

client_object = client))

1557

parent_pipe.send(True)

1558

# remove the old hook in favor of the new above hook on same fileno

1559

return False

1560

if command == 'funcall':

1561

funcname = request[1]

1562

args = request[2]

1563

kwargs = request[3]

1564

1565

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1566

1567

if command == 'getattr':

1568

attrname = request[1]

1569

if callable(client_object.__getattribute__(attrname)):

1570

parent_pipe.send(('function',))

1571

else:

1572

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1573

1574

if command == 'setattr':

1575

attrname = request[1]

1576

value = request[2]

1577

setattr(client_object, attrname, value)

1578

1259

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1260

conditions_string)

1261

1262

# Turn the pipe file descriptor into a Python file object

1263

if source not in file_objects:

1264

file_objects[source] = os.fdopen(source, u"r", 1)

1265

1266

# Read a line from the file object

1267

cmdline = file_objects[source].readline()

1268

if not cmdline: # Empty line means end of file

1269

# close the IPC pipe

1270

file_objects[source].close()

1271

del file_objects[source]

1272

1273

# Stop calling this function

1274

return False

1275

1276

logger.debug(u"IPC command: %r", cmdline)

1277

1278

# Parse and act on command

1279

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1280

1281

if cmd == u"NOTFOUND":

1282

logger.warning(u"Client not found for fingerprint: %s",

1283

args)

1284

if self.use_dbus:

1285

# Emit D-Bus signal

1286

mandos_dbus_service.ClientNotFound(args)

1287

elif cmd == u"INVALID":

1288

for client in self.clients:

1289

if client.name == args:

1290

logger.warning(u"Client %s is invalid", args)

1291

if self.use_dbus:

1292

# Emit D-Bus signal

1293

client.Rejected()

1294

break

1295

else:

1296

logger.error(u"Unknown client %s is invalid", args)

1297

elif cmd == u"SENDING":

1298

for client in self.clients:

1299

if client.name == args:

1300

logger.info(u"Sending secret to %s", client.name)

1301

client.checked_ok()

1302

if self.use_dbus:

1303

# Emit D-Bus signal

1304

client.GotSecret()

1305

break

1306

else:

1307

logger.error(u"Sending secret to unknown client %s",

1308

args)

1309

else:

1310

logger.error(u"Unknown IPC command: %r", cmdline)

1311

1312

# Keep calling this function

1579

1313

return True

1580

1314

1581

1315

1611

1345

elif suffix == u"w":

1612

1346

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1613

1347

else:

1614

raise ValueError(u"Unknown suffix %r" % suffix)

1615

except (ValueError, IndexError), e:

1616

raise ValueError(e.message)

1348

raise ValueError

1349

except (ValueError, IndexError):

1350

raise ValueError

1617

1351

timevalue += delta

1618

1352

return timevalue

1619

1353

1632

1366

def if_nametoindex(interface):

1633

1367

"Get an interface index the hard way, i.e. using fcntl()"

1634

1368

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1635

with contextlib.closing(socket.socket()) as s:

1369

with closing(socket.socket()) as s:

1636

1370

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1637

1371

struct.pack(str(u"16s16x"),

1638

1372

interface))

1684

1418

parser.add_option("--debug", action=u"store_true",

1685

1419

help=u"Debug mode; run in foreground and log to"

1686

1420

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",

1688

help=u"Debug level for stdout output")

1689

1421

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1690

1422

u" priority string (see GnuTLS documentation)")

1691

1423

parser.add_option("--servicename", type=u"string",

1716

1448

u"servicename": u"Mandos",

1717

1449

u"use_dbus": u"True",

1718

1450

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

1720

1451

}

1721

1452

1722

1453

# Parse config file for server-global settings

1739

1470

# options, if set.

1740

1471

for option in (u"interface", u"address", u"port", u"debug",

1741

1472

u"priority", u"servicename", u"configdir",

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

1473

u"use_dbus", u"use_ipv6"):

1743

1474

value = getattr(options, option)

1744

1475

if value is not None:

1745

1476

server_settings[option] = value

1754

1485

1755

1486

# For convenience

1756

1487

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1758

1488

use_dbus = server_settings[u"use_dbus"]

1759

1489

use_ipv6 = server_settings[u"use_ipv6"]

1760

1490

1491

if not debug:

1492

syslogger.setLevel(logging.WARNING)

1493

console.setLevel(logging.WARNING)

1494

1761

1495

if server_settings[u"servicename"] != u"Mandos":

1762

1496

syslogger.setFormatter(logging.Formatter

1763

1497

(u'Mandos (%s) [%%(process)d]:'

1769

1503

u"interval": u"5m",

1770

1504

u"checker": u"fping -q -- %%(host)s",

1771

1505

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1774

1506

}

1775

1507

client_config = configparser.SafeConfigParser(client_defaults)

1776

1508

client_config.read(os.path.join(server_settings[u"configdir"],

1782

1514

tcp_server = MandosServer((server_settings[u"address"],

1783

1515

server_settings[u"port"]),

1784

1516

ClientHandler,

1785

interface=(server_settings[u"interface"]

1786

or None),

1517

interface=server_settings[u"interface"],

1787

1518

use_ipv6=use_ipv6,

1788

1519

gnutls_priority=

1789

1520

server_settings[u"priority"],

1790

1521

use_dbus=use_dbus)

1791

if not debug:

1792

pidfilename = u"/var/run/mandos.pid"

1793

try:

1794

pidfile = open(pidfilename, u"w")

1795

except IOError:

1796

logger.error(u"Could not open file %r", pidfilename)

1522

pidfilename = u"/var/run/mandos.pid"

1523

try:

1524

pidfile = open(pidfilename, u"w")

1525

except IOError:

1526

logger.error(u"Could not open file %r", pidfilename)

1797

1527

1798

1528

try:

1799

1529

uid = pwd.getpwnam(u"_mandos").pw_uid

1816

1546

if error[0] != errno.EPERM:

1817

1547

raise error

1818

1548

1819

if not debug and not debuglevel:

1820

syslogger.setLevel(logging.WARNING)

1821

console.setLevel(logging.WARNING)

1822

if debuglevel:

1823

level = getattr(logging, debuglevel.upper())

1824

syslogger.setLevel(level)

1825

console.setLevel(level)

1826

1549

# Enable all possible GnuTLS debugging

1827

1550

if debug:

1828

# Enable all possible GnuTLS debugging

1829

1830

1551

# "Use a log level over 10 to enable all debugging options."

1831

1552

# - GnuTLS manual

1832

1553

gnutls.library.functions.gnutls_global_set_log_level(11)

1837

1558

1838

1559

(gnutls.library.functions

1839

1560

.gnutls_global_set_log_function(debug_gnutls))

1840

1841

# Redirect stdin so all checkers get /dev/null

1842

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1843

os.dup2(null, sys.stdin.fileno())

1844

if null > 2:

1845

os.close(null)

1846

else:

1847

# No console logging

1848

logger.removeHandler(console)

1849

1850

1561

1851

1562

global main_loop

1852

1563

# From the Avahi example code

1855

1566

bus = dbus.SystemBus()

1856

1567

# End of Avahi example code

1857

1568

if use_dbus:

1858

try:

1859

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1860

bus, do_not_queue=True)

1861

except dbus.exceptions.NameExistsException, e:

1862

logger.error(unicode(e) + u", disabling D-Bus")

1863

use_dbus = False

1864

server_settings[u"use_dbus"] = False

1865

tcp_server.use_dbus = False

1569

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1866

1570

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1867

1571

service = AvahiService(name = server_settings[u"servicename"],

1868

1572

servicetype = u"_mandos._tcp",

1870

1574

if server_settings["interface"]:

1871

1575

service.interface = (if_nametoindex

1872

1576

(str(server_settings[u"interface"])))

1873

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

1878

global multiprocessing_manager

1879

multiprocessing_manager = multiprocessing.Manager()

1880

1577

1881

1578

client_class = Client

1882

1579

if use_dbus:

1883

1580

client_class = functools.partial(ClientDBus, bus = bus)

1884

def client_config_items(config, section):

1885

special_settings = {

1886

"approved_by_default":

1887

lambda: config.getboolean(section,

1888

"approved_by_default"),

1889

}

1890

for name, value in config.items(section):

1891

try:

1892

yield (name, special_settings[name]())

1893

except KeyError:

1894

yield (name, value)

1895

1896

1581

tcp_server.clients.update(set(

1897

1582

client_class(name = section,

1898

config= dict(client_config_items(

1899

client_config, section)))

1583

config= dict(client_config.items(section)))

1900

1584

for section in client_config.sections()))

1901

1585

if not tcp_server.clients:

1902

1586

logger.warning(u"No clients defined")

1587

1588

if debug:

1589

# Redirect stdin so all checkers get /dev/null

1590

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1591

os.dup2(null, sys.stdin.fileno())

1592

if null > 2:

1593

os.close(null)

1594

else:

1595

# No console logging

1596

logger.removeHandler(console)

1597

# Close all input and output, do double fork, etc.

1598

daemon()

1599

1600

try:

1601

with closing(pidfile):

1602

pid = os.getpid()

1603

pidfile.write(str(pid) + "\n")

1604

del pidfile

1605

except IOError:

1606

logger.error(u"Could not write to file %r with PID %d",

1607

pidfilename, pid)

1608

except NameError:

1609

# "pidfile" was never created

1610

pass

1611

del pidfilename

1612

1613

def cleanup():

1614

"Cleanup function; run on exit"

1615

service.cleanup()

1903

1616

1617

while tcp_server.clients:

1618

client = tcp_server.clients.pop()

1619

client.disable_hook = None

1620

client.disable()

1621

1622

atexit.register(cleanup)

1623

1904

1624

if not debug:

1905

try:

1906

with pidfile:

1907

pid = os.getpid()

1908

pidfile.write(str(pid) + "\n")

1909

del pidfile

1910

except IOError:

1911

logger.error(u"Could not write to file %r with PID %d",

1912

pidfilename, pid)

1913

except NameError:

1914

# "pidfile" was never created

1915

pass

1916

del pidfilename

1917

1918

1625

signal.signal(signal.SIGINT, signal.SIG_IGN)

1919

1920

1626

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1921

1627

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1922

1628

1927

1633

dbus.service.Object.__init__(self, bus, u"/")

1928

1634

_interface = u"se.bsnet.fukt.Mandos"

1929

1635

1930

@dbus.service.signal(_interface, signature=u"o")

1931

def ClientAdded(self, objpath):

1636

@dbus.service.signal(_interface, signature=u"oa{sv}")

1637

def ClientAdded(self, objpath, properties):

1932

1638

"D-Bus signal"

1933

1639

pass

1934

1640

1935

@dbus.service.signal(_interface, signature=u"ss")

1936

def ClientNotFound(self, fingerprint, address):

1641

@dbus.service.signal(_interface, signature=u"s")

1642

def ClientNotFound(self, fingerprint):

1937

1643

"D-Bus signal"

1938

1644

pass

1939

1645

1965

1671

tcp_server.clients.remove(c)

1966

1672

c.remove_from_connection()

1967

1673

# Don't signal anything except ClientRemoved

1968

c.disable(quiet=True)

1674

c.disable(signal=False)

1969

1675

# Emit D-Bus signal

1970

1676

self.ClientRemoved(object_path, c.name)

1971

1677

return

1972

raise KeyError(object_path)

1678

raise KeyError

1973

1679

1974

1680

del _interface

1975

1681

1976

1682

mandos_dbus_service = MandosDBusService()

1977

1683

1978

def cleanup():

1979

"Cleanup function; run on exit"

1980

service.cleanup()

1981

1982

while tcp_server.clients:

1983

client = tcp_server.clients.pop()

1984

if use_dbus:

1985

client.remove_from_connection()

1986

client.disable_hook = None

1987

# Don't signal anything except ClientRemoved

1988

client.disable(quiet=True)

1989

if use_dbus:

1990

# Emit D-Bus signal

1991

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1992

client.name)

1993

1994

atexit.register(cleanup)

1995

1996

1684

for client in tcp_server.clients:

1997

1685

if use_dbus:

1998

1686

# Emit D-Bus signal

1999

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1687

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1688

client.GetAll(u""))

2000

1689

client.enable()

2001

1690

2002

1691

tcp_server.enable()

2020

1709

service.activate()

2021

1710

except dbus.exceptions.DBusException, error:

2022

1711

logger.critical(u"DBusException: %s", error)

2023

cleanup()

2024

1712

sys.exit(1)

2025

1713

# End of Avahi example code

2026

1714

2033

1721

main_loop.run()

2034

1722

except AvahiError, error:

2035

1723

logger.critical(u"AvahiError: %s", error)

2036

cleanup()

2037

1724

sys.exit(1)

2038

1725

except KeyboardInterrupt:

2039

1726

if debug:

2040

1727

print >> sys.stderr

2041

1728

logger.debug(u"Server received KeyboardInterrupt")

2042

1729

logger.debug(u"Server exiting")

2043

# Must run before the D-Bus bus name gets deregistered

2044

cleanup()

2045

1730

2046

1731

if __name__ == '__main__':

2047

1732

main()