/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2010-06-19 00:37:04 UTC
  • mto: (24.1.149 mandos)
  • mto: This revision was merged to the branch mainline in revision 417.
  • Revision ID: teddy@fukt.bsnet.se-20100619003704-vpicvssvv1ktg2om
* mandos (ClientHandler.handle): Set up the GnuTLS session object
                                 before reading the protocol number.
 (ClientHandler.handle/ProxyObject): New.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# methods "add" and "remove" in the "AvahiService" class, the
10
 
# "server_state_changed" and "entry_group_state_changed" functions,
11
 
# and some lines in "main".
 
9
# methods "add", "remove", "server_state_changed",
 
10
# "entry_group_state_changed", "cleanup", and "activate" in the
 
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
 
34
34
from __future__ import division, with_statement, absolute_import
35
35
 
36
 
import SocketServer
 
36
import SocketServer as socketserver
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
 
import ConfigParser
 
47
import ConfigParser as configparser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
 
from sets import Set
53
52
import subprocess
54
53
import atexit
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
 
from contextlib import closing
 
58
import contextlib
 
59
import struct
 
60
import fcntl
 
61
import functools
 
62
import cPickle as pickle
 
63
import select
60
64
 
61
65
import dbus
62
66
import dbus.service
65
69
from dbus.mainloop.glib import DBusGMainLoop
66
70
import ctypes
67
71
import ctypes.util
68
 
 
69
 
version = "1.0.6"
70
 
 
71
 
logger = logging.Logger('mandos')
 
72
import xml.dom.minidom
 
73
import inspect
 
74
 
 
75
try:
 
76
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
 
77
except AttributeError:
 
78
    try:
 
79
        from IN import SO_BINDTODEVICE
 
80
    except ImportError:
 
81
        SO_BINDTODEVICE = None
 
82
 
 
83
 
 
84
version = "1.0.14"
 
85
 
 
86
logger = logging.Logger(u'mandos')
72
87
syslogger = (logging.handlers.SysLogHandler
73
88
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
89
              address = "/dev/log"))
75
90
syslogger.setFormatter(logging.Formatter
76
 
                       ('Mandos [%(process)d]: %(levelname)s:'
77
 
                        ' %(message)s'))
 
91
                       (u'Mandos [%(process)d]: %(levelname)s:'
 
92
                        u' %(message)s'))
78
93
logger.addHandler(syslogger)
79
94
 
80
95
console = logging.StreamHandler()
81
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
 
                                       ' %(levelname)s: %(message)s'))
 
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
 
97
                                       u' %(levelname)s:'
 
98
                                       u' %(message)s'))
83
99
logger.addHandler(console)
84
100
 
85
101
class AvahiError(Exception):
98
114
 
99
115
class AvahiService(object):
100
116
    """An Avahi (Zeroconf) service.
 
117
    
101
118
    Attributes:
102
119
    interface: integer; avahi.IF_UNSPEC or an interface index.
103
120
               Used to optionally bind to the specified interface.
104
 
    name: string; Example: 'Mandos'
105
 
    type: string; Example: '_mandos._tcp'.
 
121
    name: string; Example: u'Mandos'
 
122
    type: string; Example: u'_mandos._tcp'.
106
123
                  See <http://www.dns-sd.org/ServiceTypes.html>
107
124
    port: integer; what port to announce
108
125
    TXT: list of strings; TXT record for the service
111
128
    max_renames: integer; maximum number of renames
112
129
    rename_count: integer; counter so we only rename after collisions
113
130
                  a sensible number of times
 
131
    group: D-Bus Entry Group
 
132
    server: D-Bus Server
 
133
    bus: dbus.SystemBus()
114
134
    """
115
135
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
136
                 servicetype = None, port = None, TXT = None,
117
 
                 domain = "", host = "", max_renames = 32768,
118
 
                 protocol = avahi.PROTO_UNSPEC):
 
137
                 domain = u"", host = u"", max_renames = 32768,
 
138
                 protocol = avahi.PROTO_UNSPEC, bus = None):
119
139
        self.interface = interface
120
140
        self.name = name
121
141
        self.type = servicetype
126
146
        self.rename_count = 0
127
147
        self.max_renames = max_renames
128
148
        self.protocol = protocol
 
149
        self.group = None       # our entry group
 
150
        self.server = None
 
151
        self.bus = bus
129
152
    def rename(self):
130
153
        """Derived from the Avahi example code"""
131
154
        if self.rename_count >= self.max_renames:
133
156
                            u" after %i retries, exiting.",
134
157
                            self.rename_count)
135
158
            raise AvahiServiceError(u"Too many renames")
136
 
        self.name = server.GetAlternativeServiceName(self.name)
 
159
        self.name = self.server.GetAlternativeServiceName(self.name)
137
160
        logger.info(u"Changing Zeroconf service name to %r ...",
138
 
                    str(self.name))
 
161
                    unicode(self.name))
139
162
        syslogger.setFormatter(logging.Formatter
140
 
                               ('Mandos (%s): %%(levelname)s:'
141
 
                                ' %%(message)s' % self.name))
 
163
                               (u'Mandos (%s) [%%(process)d]:'
 
164
                                u' %%(levelname)s: %%(message)s'
 
165
                                % self.name))
142
166
        self.remove()
143
167
        self.add()
144
168
        self.rename_count += 1
145
169
    def remove(self):
146
170
        """Derived from the Avahi example code"""
147
 
        if group is not None:
148
 
            group.Reset()
 
171
        if self.group is not None:
 
172
            self.group.Reset()
149
173
    def add(self):
150
174
        """Derived from the Avahi example code"""
151
 
        global group
152
 
        if group is None:
153
 
            group = dbus.Interface(bus.get_object
154
 
                                   (avahi.DBUS_NAME,
155
 
                                    server.EntryGroupNew()),
156
 
                                   avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
 
            group.connect_to_signal('StateChanged',
158
 
                                    entry_group_state_changed)
 
175
        if self.group is None:
 
176
            self.group = dbus.Interface(
 
177
                self.bus.get_object(avahi.DBUS_NAME,
 
178
                                    self.server.EntryGroupNew()),
 
179
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
180
            self.group.connect_to_signal('StateChanged',
 
181
                                         self
 
182
                                         .entry_group_state_changed)
159
183
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
160
 
                     service.name, service.type)
161
 
        group.AddService(
162
 
                self.interface,         # interface
163
 
                self.protocol,          # protocol
164
 
                dbus.UInt32(0),         # flags
165
 
                self.name, self.type,
166
 
                self.domain, self.host,
167
 
                dbus.UInt16(self.port),
168
 
                avahi.string_array_to_txt_array(self.TXT))
169
 
        group.Commit()
170
 
 
171
 
# From the Avahi example code:
172
 
group = None                            # our entry group
173
 
# End of Avahi example code
174
 
 
175
 
 
176
 
def _datetime_to_dbus(dt, variant_level=0):
177
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
178
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
179
 
 
180
 
 
181
 
class Client(dbus.service.Object):
 
184
                     self.name, self.type)
 
185
        self.group.AddService(
 
186
            self.interface,
 
187
            self.protocol,
 
188
            dbus.UInt32(0),     # flags
 
189
            self.name, self.type,
 
190
            self.domain, self.host,
 
191
            dbus.UInt16(self.port),
 
192
            avahi.string_array_to_txt_array(self.TXT))
 
193
        self.group.Commit()
 
194
    def entry_group_state_changed(self, state, error):
 
195
        """Derived from the Avahi example code"""
 
196
        logger.debug(u"Avahi state change: %i", state)
 
197
        
 
198
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
199
            logger.debug(u"Zeroconf service established.")
 
200
        elif state == avahi.ENTRY_GROUP_COLLISION:
 
201
            logger.warning(u"Zeroconf service name collision.")
 
202
            self.rename()
 
203
        elif state == avahi.ENTRY_GROUP_FAILURE:
 
204
            logger.critical(u"Avahi: Error in group state changed %s",
 
205
                            unicode(error))
 
206
            raise AvahiGroupError(u"State changed: %s"
 
207
                                  % unicode(error))
 
208
    def cleanup(self):
 
209
        """Derived from the Avahi example code"""
 
210
        if self.group is not None:
 
211
            self.group.Free()
 
212
            self.group = None
 
213
    def server_state_changed(self, state):
 
214
        """Derived from the Avahi example code"""
 
215
        if state == avahi.SERVER_COLLISION:
 
216
            logger.error(u"Zeroconf server name collision")
 
217
            self.remove()
 
218
        elif state == avahi.SERVER_RUNNING:
 
219
            self.add()
 
220
    def activate(self):
 
221
        """Derived from the Avahi example code"""
 
222
        if self.server is None:
 
223
            self.server = dbus.Interface(
 
224
                self.bus.get_object(avahi.DBUS_NAME,
 
225
                                    avahi.DBUS_PATH_SERVER),
 
226
                avahi.DBUS_INTERFACE_SERVER)
 
227
        self.server.connect_to_signal(u"StateChanged",
 
228
                                 self.server_state_changed)
 
229
        self.server_state_changed(self.server.GetState())
 
230
 
 
231
 
 
232
class Client(object):
182
233
    """A representation of a client host served by this server.
 
234
    
183
235
    Attributes:
184
236
    name:       string; from the config file, used in log messages and
185
237
                        D-Bus identifiers
192
244
    enabled:    bool()
193
245
    last_checked_ok: datetime.datetime(); (UTC) or None
194
246
    timeout:    datetime.timedelta(); How long from last_checked_ok
195
 
                                      until this client is invalid
 
247
                                      until this client is disabled
196
248
    interval:   datetime.timedelta(); How often to start a new checker
197
249
    disable_hook:  If set, called by disable() as disable_hook(self)
198
250
    checker:    subprocess.Popen(); a running checker process used
199
251
                                    to see if the client lives.
200
252
                                    'None' if no process is running.
201
253
    checker_initiator_tag: a gobject event source tag, or None
202
 
    disable_initiator_tag:    - '' -
 
254
    disable_initiator_tag: - '' -
203
255
    checker_callback_tag:  - '' -
204
256
    checker_command: string; External command which is run to check if
205
257
                     client lives.  %() expansions are done at
206
258
                     runtime with vars(self) as dict, so that for
207
259
                     instance %(name)s can be used in the command.
208
260
    current_checker_command: string; current running checker_command
209
 
    use_dbus: bool(); Whether to provide D-Bus interface and signals
210
 
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
211
261
    """
 
262
    
 
263
    @staticmethod
 
264
    def _timedelta_to_milliseconds(td):
 
265
        "Convert a datetime.timedelta() to milliseconds"
 
266
        return ((td.days * 24 * 60 * 60 * 1000)
 
267
                + (td.seconds * 1000)
 
268
                + (td.microseconds // 1000))
 
269
    
212
270
    def timeout_milliseconds(self):
213
271
        "Return the 'timeout' attribute in milliseconds"
214
 
        return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
 
                + (self.timeout.seconds * 1000)
216
 
                + (self.timeout.microseconds // 1000))
 
272
        return self._timedelta_to_milliseconds(self.timeout)
217
273
    
218
274
    def interval_milliseconds(self):
219
275
        "Return the 'interval' attribute in milliseconds"
220
 
        return ((self.interval.days * 24 * 60 * 60 * 1000)
221
 
                + (self.interval.seconds * 1000)
222
 
                + (self.interval.microseconds // 1000))
 
276
        return self._timedelta_to_milliseconds(self.interval)
223
277
    
224
 
    def __init__(self, name = None, disable_hook=None, config=None,
225
 
                 use_dbus=True):
 
278
    def __init__(self, name = None, disable_hook=None, config=None):
226
279
        """Note: the 'checker' key in 'config' sets the
227
280
        'checker_command' attribute and *not* the 'checker'
228
281
        attribute."""
230
283
        if config is None:
231
284
            config = {}
232
285
        logger.debug(u"Creating client %r", self.name)
233
 
        self.use_dbus = False   # During __init__
234
286
        # Uppercase and remove spaces from fingerprint for later
235
287
        # comparison purposes with return value from the fingerprint()
236
288
        # function
237
 
        self.fingerprint = (config["fingerprint"].upper()
 
289
        self.fingerprint = (config[u"fingerprint"].upper()
238
290
                            .replace(u" ", u""))
239
291
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
240
 
        if "secret" in config:
241
 
            self.secret = config["secret"].decode(u"base64")
242
 
        elif "secfile" in config:
243
 
            with closing(open(os.path.expanduser
244
 
                              (os.path.expandvars
245
 
                               (config["secfile"])))) as secfile:
 
292
        if u"secret" in config:
 
293
            self.secret = config[u"secret"].decode(u"base64")
 
294
        elif u"secfile" in config:
 
295
            with open(os.path.expanduser(os.path.expandvars
 
296
                                         (config[u"secfile"])),
 
297
                      "rb") as secfile:
246
298
                self.secret = secfile.read()
247
299
        else:
248
300
            raise TypeError(u"No secret or secfile for client %s"
249
301
                            % self.name)
250
 
        self.host = config.get("host", "")
 
302
        self.host = config.get(u"host", u"")
251
303
        self.created = datetime.datetime.utcnow()
252
304
        self.enabled = False
253
305
        self.last_enabled = None
254
306
        self.last_checked_ok = None
255
 
        self.timeout = string_to_delta(config["timeout"])
256
 
        self.interval = string_to_delta(config["interval"])
 
307
        self.timeout = string_to_delta(config[u"timeout"])
 
308
        self.interval = string_to_delta(config[u"interval"])
257
309
        self.disable_hook = disable_hook
258
310
        self.checker = None
259
311
        self.checker_initiator_tag = None
260
312
        self.disable_initiator_tag = None
261
313
        self.checker_callback_tag = None
262
 
        self.checker_command = config["checker"]
 
314
        self.checker_command = config[u"checker"]
263
315
        self.current_checker_command = None
264
316
        self.last_connect = None
265
 
        # Only now, when this client is initialized, can it show up on
266
 
        # the D-Bus
267
 
        self.use_dbus = use_dbus
268
 
        if self.use_dbus:
269
 
            self.dbus_object_path = (dbus.ObjectPath
270
 
                                     ("/clients/"
271
 
                                      + self.name.replace(".", "_")))
272
 
            dbus.service.Object.__init__(self, bus,
273
 
                                         self.dbus_object_path)
274
317
    
275
318
    def enable(self):
276
319
        """Start this client's checker and timeout hooks"""
 
320
        if getattr(self, u"enabled", False):
 
321
            # Already enabled
 
322
            return
277
323
        self.last_enabled = datetime.datetime.utcnow()
278
324
        # Schedule a new checker to be started an 'interval' from now,
279
325
        # and every interval from then on.
280
326
        self.checker_initiator_tag = (gobject.timeout_add
281
327
                                      (self.interval_milliseconds(),
282
328
                                       self.start_checker))
283
 
        # Also start a new checker *right now*.
284
 
        self.start_checker()
285
329
        # Schedule a disable() when 'timeout' has passed
286
330
        self.disable_initiator_tag = (gobject.timeout_add
287
331
                                   (self.timeout_milliseconds(),
288
332
                                    self.disable))
289
333
        self.enabled = True
290
 
        if self.use_dbus:
291
 
            # Emit D-Bus signals
292
 
            self.PropertyChanged(dbus.String(u"enabled"),
293
 
                                 dbus.Boolean(True, variant_level=1))
294
 
            self.PropertyChanged(dbus.String(u"last_enabled"),
295
 
                                 (_datetime_to_dbus(self.last_enabled,
296
 
                                                    variant_level=1)))
 
334
        # Also start a new checker *right now*.
 
335
        self.start_checker()
297
336
    
298
 
    def disable(self):
 
337
    def disable(self, quiet=True):
299
338
        """Disable this client."""
300
339
        if not getattr(self, "enabled", False):
301
340
            return False
302
 
        logger.info(u"Disabling client %s", self.name)
303
 
        if getattr(self, "disable_initiator_tag", False):
 
341
        if not quiet:
 
342
            logger.info(u"Disabling client %s", self.name)
 
343
        if getattr(self, u"disable_initiator_tag", False):
304
344
            gobject.source_remove(self.disable_initiator_tag)
305
345
            self.disable_initiator_tag = None
306
 
        if getattr(self, "checker_initiator_tag", False):
 
346
        if getattr(self, u"checker_initiator_tag", False):
307
347
            gobject.source_remove(self.checker_initiator_tag)
308
348
            self.checker_initiator_tag = None
309
349
        self.stop_checker()
310
350
        if self.disable_hook:
311
351
            self.disable_hook(self)
312
352
        self.enabled = False
313
 
        if self.use_dbus:
314
 
            # Emit D-Bus signal
315
 
            self.PropertyChanged(dbus.String(u"enabled"),
316
 
                                 dbus.Boolean(False, variant_level=1))
317
353
        # Do not run this again if called by a gobject.timeout_add
318
354
        return False
319
355
    
325
361
        """The checker has completed, so take appropriate actions."""
326
362
        self.checker_callback_tag = None
327
363
        self.checker = None
328
 
        if self.use_dbus:
329
 
            # Emit D-Bus signal
330
 
            self.PropertyChanged(dbus.String(u"checker_running"),
331
 
                                 dbus.Boolean(False, variant_level=1))
332
364
        if os.WIFEXITED(condition):
333
365
            exitstatus = os.WEXITSTATUS(condition)
334
366
            if exitstatus == 0:
338
370
            else:
339
371
                logger.info(u"Checker for %(name)s failed",
340
372
                            vars(self))
341
 
            if self.use_dbus:
342
 
                # Emit D-Bus signal
343
 
                self.CheckerCompleted(dbus.Int16(exitstatus),
344
 
                                      dbus.Int64(condition),
345
 
                                      dbus.String(command))
346
373
        else:
347
374
            logger.warning(u"Checker for %(name)s crashed?",
348
375
                           vars(self))
349
 
            if self.use_dbus:
350
 
                # Emit D-Bus signal
351
 
                self.CheckerCompleted(dbus.Int16(-1),
352
 
                                      dbus.Int64(condition),
353
 
                                      dbus.String(command))
354
376
    
355
377
    def checked_ok(self):
356
378
        """Bump up the timeout for this client.
 
379
        
357
380
        This should only be called when the client has been seen,
358
381
        alive and well.
359
382
        """
362
385
        self.disable_initiator_tag = (gobject.timeout_add
363
386
                                      (self.timeout_milliseconds(),
364
387
                                       self.disable))
365
 
        if self.use_dbus:
366
 
            # Emit D-Bus signal
367
 
            self.PropertyChanged(
368
 
                dbus.String(u"last_checked_ok"),
369
 
                (_datetime_to_dbus(self.last_checked_ok,
370
 
                                   variant_level=1)))
371
388
    
372
389
    def start_checker(self):
373
390
        """Start a new checker subprocess if one is not running.
 
391
        
374
392
        If a checker already exists, leave it running and do
375
393
        nothing."""
376
394
        # The reason for not killing a running checker is that if we
379
397
        # client would inevitably timeout, since no checker would get
380
398
        # a chance to run to completion.  If we instead leave running
381
399
        # checkers alone, the checker would have to take more time
382
 
        # than 'timeout' for the client to be declared invalid, which
383
 
        # is as it should be.
 
400
        # than 'timeout' for the client to be disabled, which is as it
 
401
        # should be.
384
402
        
385
403
        # If a checker exists, make sure it is not a zombie
386
 
        if self.checker is not None:
 
404
        try:
387
405
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
406
        except (AttributeError, OSError), error:
 
407
            if (isinstance(error, OSError)
 
408
                and error.errno != errno.ECHILD):
 
409
                raise error
 
410
        else:
388
411
            if pid:
389
 
                logger.warning("Checker was a zombie")
 
412
                logger.warning(u"Checker was a zombie")
390
413
                gobject.source_remove(self.checker_callback_tag)
391
414
                self.checker_callback(pid, status,
392
415
                                      self.current_checker_command)
397
420
                command = self.checker_command % self.host
398
421
            except TypeError:
399
422
                # Escape attributes for the shell
400
 
                escaped_attrs = dict((key, re.escape(str(val)))
 
423
                escaped_attrs = dict((key,
 
424
                                      re.escape(unicode(str(val),
 
425
                                                        errors=
 
426
                                                        u'replace')))
401
427
                                     for key, val in
402
428
                                     vars(self).iteritems())
403
429
                try:
406
432
                    logger.error(u'Could not format string "%s":'
407
433
                                 u' %s', self.checker_command, error)
408
434
                    return True # Try again later
409
 
                self.current_checker_command = command
 
435
            self.current_checker_command = command
410
436
            try:
411
437
                logger.info(u"Starting checker %r for %s",
412
438
                            command, self.name)
416
442
                # always replaced by /dev/null.)
417
443
                self.checker = subprocess.Popen(command,
418
444
                                                close_fds=True,
419
 
                                                shell=True, cwd="/")
420
 
                if self.use_dbus:
421
 
                    # Emit D-Bus signal
422
 
                    self.CheckerStarted(command)
423
 
                    self.PropertyChanged(
424
 
                        dbus.String("checker_running"),
425
 
                        dbus.Boolean(True, variant_level=1))
 
445
                                                shell=True, cwd=u"/")
426
446
                self.checker_callback_tag = (gobject.child_watch_add
427
447
                                             (self.checker.pid,
428
448
                                              self.checker_callback,
444
464
        if self.checker_callback_tag:
445
465
            gobject.source_remove(self.checker_callback_tag)
446
466
            self.checker_callback_tag = None
447
 
        if getattr(self, "checker", None) is None:
 
467
        if getattr(self, u"checker", None) is None:
448
468
            return
449
469
        logger.debug(u"Stopping checker for %(name)s", vars(self))
450
470
        try:
451
471
            os.kill(self.checker.pid, signal.SIGTERM)
452
 
            #os.sleep(0.5)
 
472
            #time.sleep(0.5)
453
473
            #if self.checker.poll() is None:
454
474
            #    os.kill(self.checker.pid, signal.SIGKILL)
455
475
        except OSError, error:
456
476
            if error.errno != errno.ESRCH: # No such process
457
477
                raise
458
478
        self.checker = None
459
 
        if self.use_dbus:
 
479
 
 
480
 
 
481
def dbus_service_property(dbus_interface, signature=u"v",
 
482
                          access=u"readwrite", byte_arrays=False):
 
483
    """Decorators for marking methods of a DBusObjectWithProperties to
 
484
    become properties on the D-Bus.
 
485
    
 
486
    The decorated method will be called with no arguments by "Get"
 
487
    and with one argument by "Set".
 
488
    
 
489
    The parameters, where they are supported, are the same as
 
490
    dbus.service.method, except there is only "signature", since the
 
491
    type from Get() and the type sent to Set() is the same.
 
492
    """
 
493
    # Encoding deeply encoded byte arrays is not supported yet by the
 
494
    # "Set" method, so we fail early here:
 
495
    if byte_arrays and signature != u"ay":
 
496
        raise ValueError(u"Byte arrays not supported for non-'ay'"
 
497
                         u" signature %r" % signature)
 
498
    def decorator(func):
 
499
        func._dbus_is_property = True
 
500
        func._dbus_interface = dbus_interface
 
501
        func._dbus_signature = signature
 
502
        func._dbus_access = access
 
503
        func._dbus_name = func.__name__
 
504
        if func._dbus_name.endswith(u"_dbus_property"):
 
505
            func._dbus_name = func._dbus_name[:-14]
 
506
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
 
507
        return func
 
508
    return decorator
 
509
 
 
510
 
 
511
class DBusPropertyException(dbus.exceptions.DBusException):
 
512
    """A base class for D-Bus property-related exceptions
 
513
    """
 
514
    def __unicode__(self):
 
515
        return unicode(str(self))
 
516
 
 
517
 
 
518
class DBusPropertyAccessException(DBusPropertyException):
 
519
    """A property's access permissions disallows an operation.
 
520
    """
 
521
    pass
 
522
 
 
523
 
 
524
class DBusPropertyNotFound(DBusPropertyException):
 
525
    """An attempt was made to access a non-existing property.
 
526
    """
 
527
    pass
 
528
 
 
529
 
 
530
class DBusObjectWithProperties(dbus.service.Object):
 
531
    """A D-Bus object with properties.
 
532
 
 
533
    Classes inheriting from this can use the dbus_service_property
 
534
    decorator to expose methods as D-Bus properties.  It exposes the
 
535
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
536
    """
 
537
    
 
538
    @staticmethod
 
539
    def _is_dbus_property(obj):
 
540
        return getattr(obj, u"_dbus_is_property", False)
 
541
    
 
542
    def _get_all_dbus_properties(self):
 
543
        """Returns a generator of (name, attribute) pairs
 
544
        """
 
545
        return ((prop._dbus_name, prop)
 
546
                for name, prop in
 
547
                inspect.getmembers(self, self._is_dbus_property))
 
548
    
 
549
    def _get_dbus_property(self, interface_name, property_name):
 
550
        """Returns a bound method if one exists which is a D-Bus
 
551
        property with the specified name and interface.
 
552
        """
 
553
        for name in (property_name,
 
554
                     property_name + u"_dbus_property"):
 
555
            prop = getattr(self, name, None)
 
556
            if (prop is None
 
557
                or not self._is_dbus_property(prop)
 
558
                or prop._dbus_name != property_name
 
559
                or (interface_name and prop._dbus_interface
 
560
                    and interface_name != prop._dbus_interface)):
 
561
                continue
 
562
            return prop
 
563
        # No such property
 
564
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
 
565
                                   + interface_name + u"."
 
566
                                   + property_name)
 
567
    
 
568
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
 
569
                         out_signature=u"v")
 
570
    def Get(self, interface_name, property_name):
 
571
        """Standard D-Bus property Get() method, see D-Bus standard.
 
572
        """
 
573
        prop = self._get_dbus_property(interface_name, property_name)
 
574
        if prop._dbus_access == u"write":
 
575
            raise DBusPropertyAccessException(property_name)
 
576
        value = prop()
 
577
        if not hasattr(value, u"variant_level"):
 
578
            return value
 
579
        return type(value)(value, variant_level=value.variant_level+1)
 
580
    
 
581
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
 
582
    def Set(self, interface_name, property_name, value):
 
583
        """Standard D-Bus property Set() method, see D-Bus standard.
 
584
        """
 
585
        prop = self._get_dbus_property(interface_name, property_name)
 
586
        if prop._dbus_access == u"read":
 
587
            raise DBusPropertyAccessException(property_name)
 
588
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
589
            # The byte_arrays option is not supported yet on
 
590
            # signatures other than "ay".
 
591
            if prop._dbus_signature != u"ay":
 
592
                raise ValueError
 
593
            value = dbus.ByteArray(''.join(unichr(byte)
 
594
                                           for byte in value))
 
595
        prop(value)
 
596
    
 
597
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
 
598
                         out_signature=u"a{sv}")
 
599
    def GetAll(self, interface_name):
 
600
        """Standard D-Bus property GetAll() method, see D-Bus
 
601
        standard.
 
602
 
 
603
        Note: Will not include properties with access="write".
 
604
        """
 
605
        all = {}
 
606
        for name, prop in self._get_all_dbus_properties():
 
607
            if (interface_name
 
608
                and interface_name != prop._dbus_interface):
 
609
                # Interface non-empty but did not match
 
610
                continue
 
611
            # Ignore write-only properties
 
612
            if prop._dbus_access == u"write":
 
613
                continue
 
614
            value = prop()
 
615
            if not hasattr(value, u"variant_level"):
 
616
                all[name] = value
 
617
                continue
 
618
            all[name] = type(value)(value, variant_level=
 
619
                                    value.variant_level+1)
 
620
        return dbus.Dictionary(all, signature=u"sv")
 
621
    
 
622
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
623
                         out_signature=u"s",
 
624
                         path_keyword='object_path',
 
625
                         connection_keyword='connection')
 
626
    def Introspect(self, object_path, connection):
 
627
        """Standard D-Bus method, overloaded to insert property tags.
 
628
        """
 
629
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
630
                                                   connection)
 
631
        try:
 
632
            document = xml.dom.minidom.parseString(xmlstring)
 
633
            def make_tag(document, name, prop):
 
634
                e = document.createElement(u"property")
 
635
                e.setAttribute(u"name", name)
 
636
                e.setAttribute(u"type", prop._dbus_signature)
 
637
                e.setAttribute(u"access", prop._dbus_access)
 
638
                return e
 
639
            for if_tag in document.getElementsByTagName(u"interface"):
 
640
                for tag in (make_tag(document, name, prop)
 
641
                            for name, prop
 
642
                            in self._get_all_dbus_properties()
 
643
                            if prop._dbus_interface
 
644
                            == if_tag.getAttribute(u"name")):
 
645
                    if_tag.appendChild(tag)
 
646
                # Add the names to the return values for the
 
647
                # "org.freedesktop.DBus.Properties" methods
 
648
                if (if_tag.getAttribute(u"name")
 
649
                    == u"org.freedesktop.DBus.Properties"):
 
650
                    for cn in if_tag.getElementsByTagName(u"method"):
 
651
                        if cn.getAttribute(u"name") == u"Get":
 
652
                            for arg in cn.getElementsByTagName(u"arg"):
 
653
                                if (arg.getAttribute(u"direction")
 
654
                                    == u"out"):
 
655
                                    arg.setAttribute(u"name", u"value")
 
656
                        elif cn.getAttribute(u"name") == u"GetAll":
 
657
                            for arg in cn.getElementsByTagName(u"arg"):
 
658
                                if (arg.getAttribute(u"direction")
 
659
                                    == u"out"):
 
660
                                    arg.setAttribute(u"name", u"props")
 
661
            xmlstring = document.toxml(u"utf-8")
 
662
            document.unlink()
 
663
        except (AttributeError, xml.dom.DOMException,
 
664
                xml.parsers.expat.ExpatError), error:
 
665
            logger.error(u"Failed to override Introspection method",
 
666
                         error)
 
667
        return xmlstring
 
668
 
 
669
 
 
670
class ClientDBus(Client, DBusObjectWithProperties):
 
671
    """A Client class using D-Bus
 
672
    
 
673
    Attributes:
 
674
    dbus_object_path: dbus.ObjectPath
 
675
    bus: dbus.SystemBus()
 
676
    """
 
677
    # dbus.service.Object doesn't use super(), so we can't either.
 
678
    
 
679
    def __init__(self, bus = None, *args, **kwargs):
 
680
        self.bus = bus
 
681
        Client.__init__(self, *args, **kwargs)
 
682
        # Only now, when this client is initialized, can it show up on
 
683
        # the D-Bus
 
684
        self.dbus_object_path = (dbus.ObjectPath
 
685
                                 (u"/clients/"
 
686
                                  + self.name.replace(u".", u"_")))
 
687
        DBusObjectWithProperties.__init__(self, self.bus,
 
688
                                          self.dbus_object_path)
 
689
    
 
690
    @staticmethod
 
691
    def _datetime_to_dbus(dt, variant_level=0):
 
692
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
693
        return dbus.String(dt.isoformat(),
 
694
                           variant_level=variant_level)
 
695
    
 
696
    def enable(self):
 
697
        oldstate = getattr(self, u"enabled", False)
 
698
        r = Client.enable(self)
 
699
        if oldstate != self.enabled:
 
700
            # Emit D-Bus signals
 
701
            self.PropertyChanged(dbus.String(u"enabled"),
 
702
                                 dbus.Boolean(True, variant_level=1))
 
703
            self.PropertyChanged(
 
704
                dbus.String(u"last_enabled"),
 
705
                self._datetime_to_dbus(self.last_enabled,
 
706
                                       variant_level=1))
 
707
        return r
 
708
    
 
709
    def disable(self, quiet = False):
 
710
        oldstate = getattr(self, u"enabled", False)
 
711
        r = Client.disable(self, quiet=quiet)
 
712
        if not quiet and oldstate != self.enabled:
 
713
            # Emit D-Bus signal
 
714
            self.PropertyChanged(dbus.String(u"enabled"),
 
715
                                 dbus.Boolean(False, variant_level=1))
 
716
        return r
 
717
    
 
718
    def __del__(self, *args, **kwargs):
 
719
        try:
 
720
            self.remove_from_connection()
 
721
        except LookupError:
 
722
            pass
 
723
        if hasattr(DBusObjectWithProperties, u"__del__"):
 
724
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
 
725
        Client.__del__(self, *args, **kwargs)
 
726
    
 
727
    def checker_callback(self, pid, condition, command,
 
728
                         *args, **kwargs):
 
729
        self.checker_callback_tag = None
 
730
        self.checker = None
 
731
        # Emit D-Bus signal
 
732
        self.PropertyChanged(dbus.String(u"checker_running"),
 
733
                             dbus.Boolean(False, variant_level=1))
 
734
        if os.WIFEXITED(condition):
 
735
            exitstatus = os.WEXITSTATUS(condition)
 
736
            # Emit D-Bus signal
 
737
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
738
                                  dbus.Int64(condition),
 
739
                                  dbus.String(command))
 
740
        else:
 
741
            # Emit D-Bus signal
 
742
            self.CheckerCompleted(dbus.Int16(-1),
 
743
                                  dbus.Int64(condition),
 
744
                                  dbus.String(command))
 
745
        
 
746
        return Client.checker_callback(self, pid, condition, command,
 
747
                                       *args, **kwargs)
 
748
    
 
749
    def checked_ok(self, *args, **kwargs):
 
750
        r = Client.checked_ok(self, *args, **kwargs)
 
751
        # Emit D-Bus signal
 
752
        self.PropertyChanged(
 
753
            dbus.String(u"last_checked_ok"),
 
754
            (self._datetime_to_dbus(self.last_checked_ok,
 
755
                                    variant_level=1)))
 
756
        return r
 
757
    
 
758
    def start_checker(self, *args, **kwargs):
 
759
        old_checker = self.checker
 
760
        if self.checker is not None:
 
761
            old_checker_pid = self.checker.pid
 
762
        else:
 
763
            old_checker_pid = None
 
764
        r = Client.start_checker(self, *args, **kwargs)
 
765
        # Only if new checker process was started
 
766
        if (self.checker is not None
 
767
            and old_checker_pid != self.checker.pid):
 
768
            # Emit D-Bus signal
 
769
            self.CheckerStarted(self.current_checker_command)
 
770
            self.PropertyChanged(
 
771
                dbus.String(u"checker_running"),
 
772
                dbus.Boolean(True, variant_level=1))
 
773
        return r
 
774
    
 
775
    def stop_checker(self, *args, **kwargs):
 
776
        old_checker = getattr(self, u"checker", None)
 
777
        r = Client.stop_checker(self, *args, **kwargs)
 
778
        if (old_checker is not None
 
779
            and getattr(self, u"checker", None) is None):
460
780
            self.PropertyChanged(dbus.String(u"checker_running"),
461
781
                                 dbus.Boolean(False, variant_level=1))
462
 
    
463
 
    def still_valid(self):
464
 
        """Has the timeout not yet passed for this client?"""
465
 
        if not getattr(self, "enabled", False):
466
 
            return False
467
 
        now = datetime.datetime.utcnow()
468
 
        if self.last_checked_ok is None:
469
 
            return now < (self.created + self.timeout)
470
 
        else:
471
 
            return now < (self.last_checked_ok + self.timeout)
472
 
    
473
 
    ## D-Bus methods & signals
 
782
        return r
 
783
    
 
784
    ## D-Bus methods, signals & properties
474
785
    _interface = u"se.bsnet.fukt.Mandos.Client"
475
786
    
476
 
    # CheckedOK - method
477
 
    CheckedOK = dbus.service.method(_interface)(checked_ok)
478
 
    CheckedOK.__name__ = "CheckedOK"
 
787
    ## Signals
479
788
    
480
789
    # CheckerCompleted - signal
481
 
    @dbus.service.signal(_interface, signature="nxs")
 
790
    @dbus.service.signal(_interface, signature=u"nxs")
482
791
    def CheckerCompleted(self, exitcode, waitstatus, command):
483
792
        "D-Bus signal"
484
793
        pass
485
794
    
486
795
    # CheckerStarted - signal
487
 
    @dbus.service.signal(_interface, signature="s")
 
796
    @dbus.service.signal(_interface, signature=u"s")
488
797
    def CheckerStarted(self, command):
489
798
        "D-Bus signal"
490
799
        pass
491
800
    
492
 
    # GetAllProperties - method
493
 
    @dbus.service.method(_interface, out_signature="a{sv}")
494
 
    def GetAllProperties(self):
495
 
        "D-Bus method"
496
 
        return dbus.Dictionary({
497
 
                dbus.String("name"):
498
 
                    dbus.String(self.name, variant_level=1),
499
 
                dbus.String("fingerprint"):
500
 
                    dbus.String(self.fingerprint, variant_level=1),
501
 
                dbus.String("host"):
502
 
                    dbus.String(self.host, variant_level=1),
503
 
                dbus.String("created"):
504
 
                    _datetime_to_dbus(self.created, variant_level=1),
505
 
                dbus.String("last_enabled"):
506
 
                    (_datetime_to_dbus(self.last_enabled,
507
 
                                       variant_level=1)
508
 
                     if self.last_enabled is not None
509
 
                     else dbus.Boolean(False, variant_level=1)),
510
 
                dbus.String("enabled"):
511
 
                    dbus.Boolean(self.enabled, variant_level=1),
512
 
                dbus.String("last_checked_ok"):
513
 
                    (_datetime_to_dbus(self.last_checked_ok,
514
 
                                       variant_level=1)
515
 
                     if self.last_checked_ok is not None
516
 
                     else dbus.Boolean (False, variant_level=1)),
517
 
                dbus.String("timeout"):
518
 
                    dbus.UInt64(self.timeout_milliseconds(),
519
 
                                variant_level=1),
520
 
                dbus.String("interval"):
521
 
                    dbus.UInt64(self.interval_milliseconds(),
522
 
                                variant_level=1),
523
 
                dbus.String("checker"):
524
 
                    dbus.String(self.checker_command,
525
 
                                variant_level=1),
526
 
                dbus.String("checker_running"):
527
 
                    dbus.Boolean(self.checker is not None,
528
 
                                 variant_level=1),
529
 
                dbus.String("object_path"):
530
 
                    dbus.ObjectPath(self.dbus_object_path,
531
 
                                    variant_level=1)
532
 
                }, signature="sv")
533
 
    
534
 
    # IsStillValid - method
535
 
    IsStillValid = (dbus.service.method(_interface, out_signature="b")
536
 
                    (still_valid))
537
 
    IsStillValid.__name__ = "IsStillValid"
538
 
    
539
801
    # PropertyChanged - signal
540
 
    @dbus.service.signal(_interface, signature="sv")
 
802
    @dbus.service.signal(_interface, signature=u"sv")
541
803
    def PropertyChanged(self, property, value):
542
804
        "D-Bus signal"
543
805
        pass
544
806
    
545
 
    # SetChecker - method
546
 
    @dbus.service.method(_interface, in_signature="s")
547
 
    def SetChecker(self, checker):
548
 
        "D-Bus setter method"
549
 
        self.checker_command = checker
550
 
        # Emit D-Bus signal
551
 
        self.PropertyChanged(dbus.String(u"checker"),
552
 
                             dbus.String(self.checker_command,
553
 
                                         variant_level=1))
554
 
    
555
 
    # SetHost - method
556
 
    @dbus.service.method(_interface, in_signature="s")
557
 
    def SetHost(self, host):
558
 
        "D-Bus setter method"
559
 
        self.host = host
560
 
        # Emit D-Bus signal
561
 
        self.PropertyChanged(dbus.String(u"host"),
562
 
                             dbus.String(self.host, variant_level=1))
563
 
    
564
 
    # SetInterval - method
565
 
    @dbus.service.method(_interface, in_signature="t")
566
 
    def SetInterval(self, milliseconds):
567
 
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
568
 
        # Emit D-Bus signal
569
 
        self.PropertyChanged(dbus.String(u"interval"),
570
 
                             (dbus.UInt64(self.interval_milliseconds(),
571
 
                                          variant_level=1)))
572
 
    
573
 
    # SetSecret - method
574
 
    @dbus.service.method(_interface, in_signature="ay",
575
 
                         byte_arrays=True)
576
 
    def SetSecret(self, secret):
577
 
        "D-Bus setter method"
578
 
        self.secret = str(secret)
579
 
    
580
 
    # SetTimeout - method
581
 
    @dbus.service.method(_interface, in_signature="t")
582
 
    def SetTimeout(self, milliseconds):
583
 
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
584
 
        # Emit D-Bus signal
585
 
        self.PropertyChanged(dbus.String(u"timeout"),
586
 
                             (dbus.UInt64(self.timeout_milliseconds(),
587
 
                                          variant_level=1)))
 
807
    # GotSecret - signal
 
808
    @dbus.service.signal(_interface)
 
809
    def GotSecret(self):
 
810
        "D-Bus signal"
 
811
        pass
 
812
    
 
813
    # Rejected - signal
 
814
    @dbus.service.signal(_interface)
 
815
    def Rejected(self):
 
816
        "D-Bus signal"
 
817
        pass
 
818
    
 
819
    ## Methods
 
820
    
 
821
    # CheckedOK - method
 
822
    @dbus.service.method(_interface)
 
823
    def CheckedOK(self):
 
824
        return self.checked_ok()
588
825
    
589
826
    # Enable - method
590
 
    Enable = dbus.service.method(_interface)(enable)
591
 
    Enable.__name__ = "Enable"
 
827
    @dbus.service.method(_interface)
 
828
    def Enable(self):
 
829
        "D-Bus method"
 
830
        self.enable()
592
831
    
593
832
    # StartChecker - method
594
833
    @dbus.service.method(_interface)
603
842
        self.disable()
604
843
    
605
844
    # StopChecker - method
606
 
    StopChecker = dbus.service.method(_interface)(stop_checker)
607
 
    StopChecker.__name__ = "StopChecker"
 
845
    @dbus.service.method(_interface)
 
846
    def StopChecker(self):
 
847
        self.stop_checker()
 
848
    
 
849
    ## Properties
 
850
    
 
851
    # name - property
 
852
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
853
    def name_dbus_property(self):
 
854
        return dbus.String(self.name)
 
855
    
 
856
    # fingerprint - property
 
857
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
858
    def fingerprint_dbus_property(self):
 
859
        return dbus.String(self.fingerprint)
 
860
    
 
861
    # host - property
 
862
    @dbus_service_property(_interface, signature=u"s",
 
863
                           access=u"readwrite")
 
864
    def host_dbus_property(self, value=None):
 
865
        if value is None:       # get
 
866
            return dbus.String(self.host)
 
867
        self.host = value
 
868
        # Emit D-Bus signal
 
869
        self.PropertyChanged(dbus.String(u"host"),
 
870
                             dbus.String(value, variant_level=1))
 
871
    
 
872
    # created - property
 
873
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
874
    def created_dbus_property(self):
 
875
        return dbus.String(self._datetime_to_dbus(self.created))
 
876
    
 
877
    # last_enabled - property
 
878
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
879
    def last_enabled_dbus_property(self):
 
880
        if self.last_enabled is None:
 
881
            return dbus.String(u"")
 
882
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
883
    
 
884
    # enabled - property
 
885
    @dbus_service_property(_interface, signature=u"b",
 
886
                           access=u"readwrite")
 
887
    def enabled_dbus_property(self, value=None):
 
888
        if value is None:       # get
 
889
            return dbus.Boolean(self.enabled)
 
890
        if value:
 
891
            self.enable()
 
892
        else:
 
893
            self.disable()
 
894
    
 
895
    # last_checked_ok - property
 
896
    @dbus_service_property(_interface, signature=u"s",
 
897
                           access=u"readwrite")
 
898
    def last_checked_ok_dbus_property(self, value=None):
 
899
        if value is not None:
 
900
            self.checked_ok()
 
901
            return
 
902
        if self.last_checked_ok is None:
 
903
            return dbus.String(u"")
 
904
        return dbus.String(self._datetime_to_dbus(self
 
905
                                                  .last_checked_ok))
 
906
    
 
907
    # timeout - property
 
908
    @dbus_service_property(_interface, signature=u"t",
 
909
                           access=u"readwrite")
 
910
    def timeout_dbus_property(self, value=None):
 
911
        if value is None:       # get
 
912
            return dbus.UInt64(self.timeout_milliseconds())
 
913
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
914
        # Emit D-Bus signal
 
915
        self.PropertyChanged(dbus.String(u"timeout"),
 
916
                             dbus.UInt64(value, variant_level=1))
 
917
        if getattr(self, u"disable_initiator_tag", None) is None:
 
918
            return
 
919
        # Reschedule timeout
 
920
        gobject.source_remove(self.disable_initiator_tag)
 
921
        self.disable_initiator_tag = None
 
922
        time_to_die = (self.
 
923
                       _timedelta_to_milliseconds((self
 
924
                                                   .last_checked_ok
 
925
                                                   + self.timeout)
 
926
                                                  - datetime.datetime
 
927
                                                  .utcnow()))
 
928
        if time_to_die <= 0:
 
929
            # The timeout has passed
 
930
            self.disable()
 
931
        else:
 
932
            self.disable_initiator_tag = (gobject.timeout_add
 
933
                                          (time_to_die, self.disable))
 
934
    
 
935
    # interval - property
 
936
    @dbus_service_property(_interface, signature=u"t",
 
937
                           access=u"readwrite")
 
938
    def interval_dbus_property(self, value=None):
 
939
        if value is None:       # get
 
940
            return dbus.UInt64(self.interval_milliseconds())
 
941
        self.interval = datetime.timedelta(0, 0, 0, value)
 
942
        # Emit D-Bus signal
 
943
        self.PropertyChanged(dbus.String(u"interval"),
 
944
                             dbus.UInt64(value, variant_level=1))
 
945
        if getattr(self, u"checker_initiator_tag", None) is None:
 
946
            return
 
947
        # Reschedule checker run
 
948
        gobject.source_remove(self.checker_initiator_tag)
 
949
        self.checker_initiator_tag = (gobject.timeout_add
 
950
                                      (value, self.start_checker))
 
951
        self.start_checker()    # Start one now, too
 
952
 
 
953
    # checker - property
 
954
    @dbus_service_property(_interface, signature=u"s",
 
955
                           access=u"readwrite")
 
956
    def checker_dbus_property(self, value=None):
 
957
        if value is None:       # get
 
958
            return dbus.String(self.checker_command)
 
959
        self.checker_command = value
 
960
        # Emit D-Bus signal
 
961
        self.PropertyChanged(dbus.String(u"checker"),
 
962
                             dbus.String(self.checker_command,
 
963
                                         variant_level=1))
 
964
    
 
965
    # checker_running - property
 
966
    @dbus_service_property(_interface, signature=u"b",
 
967
                           access=u"readwrite")
 
968
    def checker_running_dbus_property(self, value=None):
 
969
        if value is None:       # get
 
970
            return dbus.Boolean(self.checker is not None)
 
971
        if value:
 
972
            self.start_checker()
 
973
        else:
 
974
            self.stop_checker()
 
975
    
 
976
    # object_path - property
 
977
    @dbus_service_property(_interface, signature=u"o", access=u"read")
 
978
    def object_path_dbus_property(self):
 
979
        return self.dbus_object_path # is already a dbus.ObjectPath
 
980
    
 
981
    # secret = property
 
982
    @dbus_service_property(_interface, signature=u"ay",
 
983
                           access=u"write", byte_arrays=True)
 
984
    def secret_dbus_property(self, value):
 
985
        self.secret = str(value)
608
986
    
609
987
    del _interface
610
988
 
611
989
 
612
 
def peer_certificate(session):
613
 
    "Return the peer's OpenPGP certificate as a bytestring"
614
 
    # If not an OpenPGP certificate...
615
 
    if (gnutls.library.functions
616
 
        .gnutls_certificate_type_get(session._c_object)
617
 
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
618
 
        # ...do the normal thing
619
 
        return session.peer_certificate
620
 
    list_size = ctypes.c_uint(1)
621
 
    cert_list = (gnutls.library.functions
622
 
                 .gnutls_certificate_get_peers
623
 
                 (session._c_object, ctypes.byref(list_size)))
624
 
    if not bool(cert_list) and list_size.value != 0:
625
 
        raise gnutls.errors.GNUTLSError("error getting peer"
626
 
                                        " certificate")
627
 
    if list_size.value == 0:
628
 
        return None
629
 
    cert = cert_list[0]
630
 
    return ctypes.string_at(cert.data, cert.size)
631
 
 
632
 
 
633
 
def fingerprint(openpgp):
634
 
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
635
 
    # New GnuTLS "datum" with the OpenPGP public key
636
 
    datum = (gnutls.library.types
637
 
             .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
638
 
                                         ctypes.POINTER
639
 
                                         (ctypes.c_ubyte)),
640
 
                             ctypes.c_uint(len(openpgp))))
641
 
    # New empty GnuTLS certificate
642
 
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
643
 
    (gnutls.library.functions
644
 
     .gnutls_openpgp_crt_init(ctypes.byref(crt)))
645
 
    # Import the OpenPGP public key into the certificate
646
 
    (gnutls.library.functions
647
 
     .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
 
                                gnutls.library.constants
649
 
                                .GNUTLS_OPENPGP_FMT_RAW))
650
 
    # Verify the self signature in the key
651
 
    crtverify = ctypes.c_uint()
652
 
    (gnutls.library.functions
653
 
     .gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
654
 
    if crtverify.value != 0:
655
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
656
 
        raise gnutls.errors.CertificateSecurityError("Verify failed")
657
 
    # New buffer for the fingerprint
658
 
    buf = ctypes.create_string_buffer(20)
659
 
    buf_len = ctypes.c_size_t()
660
 
    # Get the fingerprint from the certificate into the buffer
661
 
    (gnutls.library.functions
662
 
     .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
 
                                         ctypes.byref(buf_len)))
664
 
    # Deinit the certificate
665
 
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
666
 
    # Convert the buffer to a Python bytestring
667
 
    fpr = ctypes.string_at(buf, buf_len.value)
668
 
    # Convert the bytestring to hexadecimal notation
669
 
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
670
 
    return hex_fpr
671
 
 
672
 
 
673
 
class TCP_handler(SocketServer.BaseRequestHandler, object):
674
 
    """A TCP request handler class.
675
 
    Instantiated by IPv6_TCPServer for each request to handle it.
 
990
class ClientHandler(socketserver.BaseRequestHandler, object):
 
991
    """A class to handle client connections.
 
992
    
 
993
    Instantiated once for each connection to handle it.
676
994
    Note: This will run in its own forked process."""
677
995
    
678
996
    def handle(self):
679
997
        logger.info(u"TCP connection from: %s",
680
998
                    unicode(self.client_address))
681
 
        session = (gnutls.connection
682
 
                   .ClientSession(self.request,
683
 
                                  gnutls.connection
684
 
                                  .X509Credentials()))
685
 
        
686
 
        line = self.request.makefile().readline()
687
 
        logger.debug(u"Protocol version: %r", line)
688
 
        try:
689
 
            if int(line.strip().split()[0]) > 1:
690
 
                raise RuntimeError
691
 
        except (ValueError, IndexError, RuntimeError), error:
692
 
            logger.error(u"Unknown protocol version: %s", error)
693
 
            return
694
 
        
695
 
        # Note: gnutls.connection.X509Credentials is really a generic
696
 
        # GnuTLS certificate credentials object so long as no X.509
697
 
        # keys are added to it.  Therefore, we can use it here despite
698
 
        # using OpenPGP certificates.
699
 
        
700
 
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
701
 
        #                     "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
702
 
        #                     "+DHE-DSS"))
703
 
        # Use a fallback default, since this MUST be set.
704
 
        priority = self.server.settings.get("priority", "NORMAL")
705
 
        (gnutls.library.functions
706
 
         .gnutls_priority_set_direct(session._c_object,
707
 
                                     priority, None))
708
 
        
709
 
        try:
710
 
            session.handshake()
711
 
        except gnutls.errors.GNUTLSError, error:
712
 
            logger.warning(u"Handshake failed: %s", error)
713
 
            # Do not run session.bye() here: the session is not
714
 
            # established.  Just abandon the request.
715
 
            return
716
 
        logger.debug(u"Handshake succeeded")
717
 
        try:
718
 
            fpr = fingerprint(peer_certificate(session))
719
 
        except (TypeError, gnutls.errors.GNUTLSError), error:
720
 
            logger.warning(u"Bad certificate: %s", error)
721
 
            session.bye()
722
 
            return
723
 
        logger.debug(u"Fingerprint: %s", fpr)
724
 
        
725
 
        for c in self.server.clients:
726
 
            if c.fingerprint == fpr:
727
 
                client = c
728
 
                break
729
 
        else:
730
 
            logger.warning(u"Client not found for fingerprint: %s",
731
 
                           fpr)
732
 
            session.bye()
733
 
            return
734
 
        # Have to check if client.still_valid(), since it is possible
735
 
        # that the client timed out while establishing the GnuTLS
736
 
        # session.
737
 
        if not client.still_valid():
738
 
            logger.warning(u"Client %(name)s is invalid",
739
 
                           vars(client))
740
 
            session.bye()
741
 
            return
742
 
        ## This won't work here, since we're in a fork.
743
 
        # client.checked_ok()
744
 
        sent_size = 0
745
 
        while sent_size < len(client.secret):
746
 
            sent = session.send(client.secret[sent_size:])
747
 
            logger.debug(u"Sent: %d, remaining: %d",
748
 
                         sent, len(client.secret)
749
 
                         - (sent_size + sent))
750
 
            sent_size += sent
751
 
        session.bye()
752
 
 
753
 
 
754
 
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
 
                     SocketServer.TCPServer, object):
 
999
        logger.debug(u"IPC Pipe FD: %d",
 
1000
                     self.server.child_pipe[1].fileno())
 
1001
        # Open IPC pipe to parent process
 
1002
        with contextlib.nested(self.server.child_pipe[1],
 
1003
                               self.server.parent_pipe[0]
 
1004
                               ) as (ipc, ipc_return):
 
1005
            session = (gnutls.connection
 
1006
                       .ClientSession(self.request,
 
1007
                                      gnutls.connection
 
1008
                                      .X509Credentials()))
 
1009
            
 
1010
            # Note: gnutls.connection.X509Credentials is really a
 
1011
            # generic GnuTLS certificate credentials object so long as
 
1012
            # no X.509 keys are added to it.  Therefore, we can use it
 
1013
            # here despite using OpenPGP certificates.
 
1014
            
 
1015
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
 
1016
            #                      u"+AES-256-CBC", u"+SHA1",
 
1017
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
 
1018
            #                      u"+DHE-DSS"))
 
1019
            # Use a fallback default, since this MUST be set.
 
1020
            priority = self.server.gnutls_priority
 
1021
            if priority is None:
 
1022
                priority = u"NORMAL"
 
1023
            (gnutls.library.functions
 
1024
             .gnutls_priority_set_direct(session._c_object,
 
1025
                                         priority, None))
 
1026
            
 
1027
            # Start communication using the Mandos protocol
 
1028
            # Get protocol number
 
1029
            line = self.request.makefile().readline()
 
1030
            logger.debug(u"Protocol version: %r", line)
 
1031
            try:
 
1032
                if int(line.strip().split()[0]) > 1:
 
1033
                    raise RuntimeError
 
1034
            except (ValueError, IndexError, RuntimeError), error:
 
1035
                logger.error(u"Unknown protocol version: %s", error)
 
1036
                return
 
1037
            
 
1038
            # Start GnuTLS connection
 
1039
            try:
 
1040
                session.handshake()
 
1041
            except gnutls.errors.GNUTLSError, error:
 
1042
                logger.warning(u"Handshake failed: %s", error)
 
1043
                # Do not run session.bye() here: the session is not
 
1044
                # established.  Just abandon the request.
 
1045
                return
 
1046
            logger.debug(u"Handshake succeeded")
 
1047
            try:
 
1048
                try:
 
1049
                    fpr = self.fingerprint(self.peer_certificate
 
1050
                                           (session))
 
1051
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1052
                    logger.warning(u"Bad certificate: %s", error)
 
1053
                    return
 
1054
                logger.debug(u"Fingerprint: %s", fpr)
 
1055
 
 
1056
                for c in self.server.clients:
 
1057
                    if c.fingerprint == fpr:
 
1058
                        client = c
 
1059
                        break
 
1060
                else:
 
1061
                    ipc.write(u"NOTFOUND %s %s\n"
 
1062
                              % (fpr, unicode(self.client_address)))
 
1063
                    return
 
1064
                
 
1065
                class ClientProxy(object):
 
1066
                    """Client proxy object.  Not for calling methods."""
 
1067
                    def __init__(self, client):
 
1068
                        self.client = client
 
1069
                    def __getattr__(self, name):
 
1070
                        if name.startswith("ipc_"):
 
1071
                            def tempfunc():
 
1072
                                ipc.write("%s %s\n" % (name[4:].upper(),
 
1073
                                                       self.client.name))
 
1074
                            return tempfunc
 
1075
                        if not hasattr(self.client, name):
 
1076
                            raise AttributeError
 
1077
                        ipc.write(u"GETATTR %s %s\n"
 
1078
                                  % (name, self.client.fingerprint))
 
1079
                        return pickle.load(ipc_return)
 
1080
                clientproxy = ClientProxy(client)
 
1081
                # Have to check if client.enabled, since it is
 
1082
                # possible that the client was disabled since the
 
1083
                # GnuTLS session was established.
 
1084
                if not clientproxy.enabled:
 
1085
                    clientproxy.ipc_disabled()
 
1086
                    return
 
1087
                
 
1088
                clientproxy.ipc_sending()
 
1089
                sent_size = 0
 
1090
                while sent_size < len(client.secret):
 
1091
                    sent = session.send(client.secret[sent_size:])
 
1092
                    logger.debug(u"Sent: %d, remaining: %d",
 
1093
                                 sent, len(client.secret)
 
1094
                                 - (sent_size + sent))
 
1095
                    sent_size += sent
 
1096
            finally:
 
1097
                session.bye()
 
1098
    
 
1099
    @staticmethod
 
1100
    def peer_certificate(session):
 
1101
        "Return the peer's OpenPGP certificate as a bytestring"
 
1102
        # If not an OpenPGP certificate...
 
1103
        if (gnutls.library.functions
 
1104
            .gnutls_certificate_type_get(session._c_object)
 
1105
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1106
            # ...do the normal thing
 
1107
            return session.peer_certificate
 
1108
        list_size = ctypes.c_uint(1)
 
1109
        cert_list = (gnutls.library.functions
 
1110
                     .gnutls_certificate_get_peers
 
1111
                     (session._c_object, ctypes.byref(list_size)))
 
1112
        if not bool(cert_list) and list_size.value != 0:
 
1113
            raise gnutls.errors.GNUTLSError(u"error getting peer"
 
1114
                                            u" certificate")
 
1115
        if list_size.value == 0:
 
1116
            return None
 
1117
        cert = cert_list[0]
 
1118
        return ctypes.string_at(cert.data, cert.size)
 
1119
    
 
1120
    @staticmethod
 
1121
    def fingerprint(openpgp):
 
1122
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
 
1123
        # New GnuTLS "datum" with the OpenPGP public key
 
1124
        datum = (gnutls.library.types
 
1125
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1126
                                             ctypes.POINTER
 
1127
                                             (ctypes.c_ubyte)),
 
1128
                                 ctypes.c_uint(len(openpgp))))
 
1129
        # New empty GnuTLS certificate
 
1130
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1131
        (gnutls.library.functions
 
1132
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1133
        # Import the OpenPGP public key into the certificate
 
1134
        (gnutls.library.functions
 
1135
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1136
                                    gnutls.library.constants
 
1137
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1138
        # Verify the self signature in the key
 
1139
        crtverify = ctypes.c_uint()
 
1140
        (gnutls.library.functions
 
1141
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1142
                                         ctypes.byref(crtverify)))
 
1143
        if crtverify.value != 0:
 
1144
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1145
            raise (gnutls.errors.CertificateSecurityError
 
1146
                   (u"Verify failed"))
 
1147
        # New buffer for the fingerprint
 
1148
        buf = ctypes.create_string_buffer(20)
 
1149
        buf_len = ctypes.c_size_t()
 
1150
        # Get the fingerprint from the certificate into the buffer
 
1151
        (gnutls.library.functions
 
1152
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1153
                                             ctypes.byref(buf_len)))
 
1154
        # Deinit the certificate
 
1155
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1156
        # Convert the buffer to a Python bytestring
 
1157
        fpr = ctypes.string_at(buf, buf_len.value)
 
1158
        # Convert the bytestring to hexadecimal notation
 
1159
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1160
        return hex_fpr
 
1161
 
 
1162
 
 
1163
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
 
1164
    """Like socketserver.ForkingMixIn, but also pass a pipe pair."""
 
1165
    def process_request(self, request, client_address):
 
1166
        """Overrides and wraps the original process_request().
 
1167
        
 
1168
        This function creates a new pipe in self.pipe
 
1169
        """
 
1170
        # Child writes to child_pipe
 
1171
        self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
 
1172
        # Parent writes to parent_pipe
 
1173
        self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
 
1174
        super(ForkingMixInWithPipes,
 
1175
              self).process_request(request, client_address)
 
1176
        # Close unused ends for parent
 
1177
        self.parent_pipe[0].close() # close read end
 
1178
        self.child_pipe[1].close()  # close write end
 
1179
        self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
 
1180
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
 
1181
        """Dummy function; override as necessary"""
 
1182
        child_pipe_fd.close()
 
1183
        parent_pipe_fd.close()
 
1184
 
 
1185
 
 
1186
class IPv6_TCPServer(ForkingMixInWithPipes,
 
1187
                     socketserver.TCPServer, object):
756
1188
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
1189
    
757
1190
    Attributes:
758
 
        settings:       Server settings
759
 
        clients:        Set() of Client objects
760
1191
        enabled:        Boolean; whether this server is activated yet
 
1192
        interface:      None or a network interface name (string)
 
1193
        use_ipv6:       Boolean; to use IPv6 or not
761
1194
    """
762
 
    address_family = socket.AF_INET6
763
 
    def __init__(self, *args, **kwargs):
764
 
        if "settings" in kwargs:
765
 
            self.settings = kwargs["settings"]
766
 
            del kwargs["settings"]
767
 
        if "clients" in kwargs:
768
 
            self.clients = kwargs["clients"]
769
 
            del kwargs["clients"]
770
 
        if "use_ipv6" in kwargs:
771
 
            if not kwargs["use_ipv6"]:
772
 
                self.address_family = socket.AF_INET
773
 
            del kwargs["use_ipv6"]
774
 
        self.enabled = False
775
 
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
 
1195
    def __init__(self, server_address, RequestHandlerClass,
 
1196
                 interface=None, use_ipv6=True):
 
1197
        self.interface = interface
 
1198
        if use_ipv6:
 
1199
            self.address_family = socket.AF_INET6
 
1200
        socketserver.TCPServer.__init__(self, server_address,
 
1201
                                        RequestHandlerClass)
776
1202
    def server_bind(self):
777
1203
        """This overrides the normal server_bind() function
778
1204
        to bind to an interface if one was specified, and also NOT to
779
1205
        bind to an address or port if they were not specified."""
780
 
        if self.settings["interface"]:
781
 
            # 25 is from /usr/include/asm-i486/socket.h
782
 
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
783
 
            try:
784
 
                self.socket.setsockopt(socket.SOL_SOCKET,
785
 
                                       SO_BINDTODEVICE,
786
 
                                       self.settings["interface"])
787
 
            except socket.error, error:
788
 
                if error[0] == errno.EPERM:
789
 
                    logger.error(u"No permission to"
790
 
                                 u" bind to interface %s",
791
 
                                 self.settings["interface"])
792
 
                else:
793
 
                    raise
 
1206
        if self.interface is not None:
 
1207
            if SO_BINDTODEVICE is None:
 
1208
                logger.error(u"SO_BINDTODEVICE does not exist;"
 
1209
                             u" cannot bind to interface %s",
 
1210
                             self.interface)
 
1211
            else:
 
1212
                try:
 
1213
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1214
                                           SO_BINDTODEVICE,
 
1215
                                           str(self.interface
 
1216
                                               + u'\0'))
 
1217
                except socket.error, error:
 
1218
                    if error[0] == errno.EPERM:
 
1219
                        logger.error(u"No permission to"
 
1220
                                     u" bind to interface %s",
 
1221
                                     self.interface)
 
1222
                    elif error[0] == errno.ENOPROTOOPT:
 
1223
                        logger.error(u"SO_BINDTODEVICE not available;"
 
1224
                                     u" cannot bind to interface %s",
 
1225
                                     self.interface)
 
1226
                    else:
 
1227
                        raise
794
1228
        # Only bind(2) the socket if we really need to.
795
1229
        if self.server_address[0] or self.server_address[1]:
796
1230
            if not self.server_address[0]:
797
1231
                if self.address_family == socket.AF_INET6:
798
 
                    any_address = "::" # in6addr_any
 
1232
                    any_address = u"::" # in6addr_any
799
1233
                else:
800
1234
                    any_address = socket.INADDR_ANY
801
1235
                self.server_address = (any_address,
803
1237
            elif not self.server_address[1]:
804
1238
                self.server_address = (self.server_address[0],
805
1239
                                       0)
806
 
#                 if self.settings["interface"]:
 
1240
#                 if self.interface:
807
1241
#                     self.server_address = (self.server_address[0],
808
1242
#                                            0, # port
809
1243
#                                            0, # flowinfo
810
1244
#                                            if_nametoindex
811
 
#                                            (self.settings
812
 
#                                             ["interface"]))
813
 
            return super(IPv6_TCPServer, self).server_bind()
 
1245
#                                            (self.interface))
 
1246
            return socketserver.TCPServer.server_bind(self)
 
1247
 
 
1248
 
 
1249
class MandosServer(IPv6_TCPServer):
 
1250
    """Mandos server.
 
1251
    
 
1252
    Attributes:
 
1253
        clients:        set of Client objects
 
1254
        gnutls_priority GnuTLS priority string
 
1255
        use_dbus:       Boolean; to emit D-Bus signals or not
 
1256
    
 
1257
    Assumes a gobject.MainLoop event loop.
 
1258
    """
 
1259
    def __init__(self, server_address, RequestHandlerClass,
 
1260
                 interface=None, use_ipv6=True, clients=None,
 
1261
                 gnutls_priority=None, use_dbus=True):
 
1262
        self.enabled = False
 
1263
        self.clients = clients
 
1264
        if self.clients is None:
 
1265
            self.clients = set()
 
1266
        self.use_dbus = use_dbus
 
1267
        self.gnutls_priority = gnutls_priority
 
1268
        IPv6_TCPServer.__init__(self, server_address,
 
1269
                                RequestHandlerClass,
 
1270
                                interface = interface,
 
1271
                                use_ipv6 = use_ipv6)
814
1272
    def server_activate(self):
815
1273
        if self.enabled:
816
 
            return super(IPv6_TCPServer, self).server_activate()
 
1274
            return socketserver.TCPServer.server_activate(self)
817
1275
    def enable(self):
818
1276
        self.enabled = True
 
1277
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
 
1278
        # Call "handle_ipc" for both data and EOF events
 
1279
        gobject.io_add_watch(child_pipe_fd.fileno(),
 
1280
                             gobject.IO_IN | gobject.IO_HUP,
 
1281
                             functools.partial(self.handle_ipc,
 
1282
                                               reply = parent_pipe_fd,
 
1283
                                               sender= child_pipe_fd))
 
1284
    def handle_ipc(self, source, condition, reply=None, sender=None):
 
1285
        condition_names = {
 
1286
            gobject.IO_IN: u"IN",   # There is data to read.
 
1287
            gobject.IO_OUT: u"OUT", # Data can be written (without
 
1288
                                    # blocking).
 
1289
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
 
1290
            gobject.IO_ERR: u"ERR", # Error condition.
 
1291
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
 
1292
                                    # broken, usually for pipes and
 
1293
                                    # sockets).
 
1294
            }
 
1295
        conditions_string = ' | '.join(name
 
1296
                                       for cond, name in
 
1297
                                       condition_names.iteritems()
 
1298
                                       if cond & condition)
 
1299
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
 
1300
                     conditions_string)
 
1301
        
 
1302
        # Read a line from the file object
 
1303
        cmdline = sender.readline()
 
1304
        if not cmdline:             # Empty line means end of file
 
1305
            # close the IPC pipes
 
1306
            sender.close()
 
1307
            reply.close()
 
1308
            
 
1309
            # Stop calling this function
 
1310
            return False
 
1311
        
 
1312
        logger.debug(u"IPC command: %r", cmdline)
 
1313
        
 
1314
        # Parse and act on command
 
1315
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
 
1316
        
 
1317
        if cmd == u"NOTFOUND":
 
1318
            fpr, address = args.split(None, 1)
 
1319
            logger.warning(u"Client not found for fingerprint: %s, ad"
 
1320
                           u"dress: %s", fpr, address)
 
1321
            if self.use_dbus:
 
1322
                # Emit D-Bus signal
 
1323
                mandos_dbus_service.ClientNotFound(fpr, address)
 
1324
        elif cmd == u"DISABLED":
 
1325
            for client in self.clients:
 
1326
                if client.name == args:
 
1327
                    logger.warning(u"Client %s is disabled", args)
 
1328
                    if self.use_dbus:
 
1329
                        # Emit D-Bus signal
 
1330
                        client.Rejected()
 
1331
                    break
 
1332
            else:
 
1333
                logger.error(u"Unknown client %s is disabled", args)
 
1334
        elif cmd == u"SENDING":
 
1335
            for client in self.clients:
 
1336
                if client.name == args:
 
1337
                    logger.info(u"Sending secret to %s", client.name)
 
1338
                    client.checked_ok()
 
1339
                    if self.use_dbus:
 
1340
                        # Emit D-Bus signal
 
1341
                        client.GotSecret()
 
1342
                    break
 
1343
            else:
 
1344
                logger.error(u"Sending secret to unknown client %s",
 
1345
                             args)
 
1346
        elif cmd == u"GETATTR":
 
1347
            attr_name, fpr = args.split(None, 1)
 
1348
            for client in self.clients:
 
1349
                if client.fingerprint == fpr:
 
1350
                    attr_value = getattr(client, attr_name, None)
 
1351
                    logger.debug("IPC reply: %r", attr_value)
 
1352
                    pickle.dump(attr_value, reply)
 
1353
                    break
 
1354
            else:
 
1355
                logger.error(u"Client %s on address %s requesting "
 
1356
                             u"attribute %s not found", fpr, address,
 
1357
                             attr_name)
 
1358
                pickle.dump(None, reply)
 
1359
        else:
 
1360
            logger.error(u"Unknown IPC command: %r", cmdline)
 
1361
        
 
1362
        # Keep calling this function
 
1363
        return True
819
1364
 
820
1365
 
821
1366
def string_to_delta(interval):
822
1367
    """Parse a string and return a datetime.timedelta
823
1368
    
824
 
    >>> string_to_delta('7d')
 
1369
    >>> string_to_delta(u'7d')
825
1370
    datetime.timedelta(7)
826
 
    >>> string_to_delta('60s')
 
1371
    >>> string_to_delta(u'60s')
827
1372
    datetime.timedelta(0, 60)
828
 
    >>> string_to_delta('60m')
 
1373
    >>> string_to_delta(u'60m')
829
1374
    datetime.timedelta(0, 3600)
830
 
    >>> string_to_delta('24h')
 
1375
    >>> string_to_delta(u'24h')
831
1376
    datetime.timedelta(1)
832
1377
    >>> string_to_delta(u'1w')
833
1378
    datetime.timedelta(7)
834
 
    >>> string_to_delta('5m 30s')
 
1379
    >>> string_to_delta(u'5m 30s')
835
1380
    datetime.timedelta(0, 330)
836
1381
    """
837
1382
    timevalue = datetime.timedelta(0)
850
1395
            elif suffix == u"w":
851
1396
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
852
1397
            else:
853
 
                raise ValueError
854
 
        except (ValueError, IndexError):
855
 
            raise ValueError
 
1398
                raise ValueError(u"Unknown suffix %r" % suffix)
 
1399
        except (ValueError, IndexError), e:
 
1400
            raise ValueError(e.message)
856
1401
        timevalue += delta
857
1402
    return timevalue
858
1403
 
859
1404
 
860
 
def server_state_changed(state):
861
 
    """Derived from the Avahi example code"""
862
 
    if state == avahi.SERVER_COLLISION:
863
 
        logger.error(u"Zeroconf server name collision")
864
 
        service.remove()
865
 
    elif state == avahi.SERVER_RUNNING:
866
 
        service.add()
867
 
 
868
 
 
869
 
def entry_group_state_changed(state, error):
870
 
    """Derived from the Avahi example code"""
871
 
    logger.debug(u"Avahi state change: %i", state)
872
 
    
873
 
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
874
 
        logger.debug(u"Zeroconf service established.")
875
 
    elif state == avahi.ENTRY_GROUP_COLLISION:
876
 
        logger.warning(u"Zeroconf service name collision.")
877
 
        service.rename()
878
 
    elif state == avahi.ENTRY_GROUP_FAILURE:
879
 
        logger.critical(u"Avahi: Error in group state changed %s",
880
 
                        unicode(error))
881
 
        raise AvahiGroupError(u"State changed: %s" % unicode(error))
882
 
 
883
1405
def if_nametoindex(interface):
884
 
    """Call the C function if_nametoindex(), or equivalent"""
 
1406
    """Call the C function if_nametoindex(), or equivalent
 
1407
    
 
1408
    Note: This function cannot accept a unicode string."""
885
1409
    global if_nametoindex
886
1410
    try:
887
1411
        if_nametoindex = (ctypes.cdll.LoadLibrary
888
 
                          (ctypes.util.find_library("c"))
 
1412
                          (ctypes.util.find_library(u"c"))
889
1413
                          .if_nametoindex)
890
1414
    except (OSError, AttributeError):
891
 
        if "struct" not in sys.modules:
892
 
            import struct
893
 
        if "fcntl" not in sys.modules:
894
 
            import fcntl
 
1415
        logger.warning(u"Doing if_nametoindex the hard way")
895
1416
        def if_nametoindex(interface):
896
1417
            "Get an interface index the hard way, i.e. using fcntl()"
897
1418
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
898
 
            with closing(socket.socket()) as s:
 
1419
            with contextlib.closing(socket.socket()) as s:
899
1420
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
900
 
                                    struct.pack("16s16x", interface))
901
 
            interface_index = struct.unpack("I", ifreq[16:20])[0]
 
1421
                                    struct.pack(str(u"16s16x"),
 
1422
                                                interface))
 
1423
            interface_index = struct.unpack(str(u"I"),
 
1424
                                            ifreq[16:20])[0]
902
1425
            return interface_index
903
1426
    return if_nametoindex(interface)
904
1427
 
905
1428
 
906
1429
def daemon(nochdir = False, noclose = False):
907
1430
    """See daemon(3).  Standard BSD Unix function.
 
1431
    
908
1432
    This should really exist as os.daemon, but it doesn't (yet)."""
909
1433
    if os.fork():
910
1434
        sys.exit()
911
1435
    os.setsid()
912
1436
    if not nochdir:
913
 
        os.chdir("/")
 
1437
        os.chdir(u"/")
914
1438
    if os.fork():
915
1439
        sys.exit()
916
1440
    if not noclose:
918
1442
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
919
1443
        if not stat.S_ISCHR(os.fstat(null).st_mode):
920
1444
            raise OSError(errno.ENODEV,
921
 
                          "/dev/null not a character device")
 
1445
                          u"%s not a character device"
 
1446
                          % os.path.devnull)
922
1447
        os.dup2(null, sys.stdin.fileno())
923
1448
        os.dup2(null, sys.stdout.fileno())
924
1449
        os.dup2(null, sys.stderr.fileno())
927
1452
 
928
1453
 
929
1454
def main():
 
1455
    
 
1456
    ##################################################################
 
1457
    # Parsing of options, both command line and config file
 
1458
    
930
1459
    parser = optparse.OptionParser(version = "%%prog %s" % version)
931
 
    parser.add_option("-i", "--interface", type="string",
932
 
                      metavar="IF", help="Bind to interface IF")
933
 
    parser.add_option("-a", "--address", type="string",
934
 
                      help="Address to listen for requests on")
935
 
    parser.add_option("-p", "--port", type="int",
936
 
                      help="Port number to receive requests on")
937
 
    parser.add_option("--check", action="store_true",
938
 
                      help="Run self-test")
939
 
    parser.add_option("--debug", action="store_true",
940
 
                      help="Debug mode; run in foreground and log to"
941
 
                      " terminal")
942
 
    parser.add_option("--priority", type="string", help="GnuTLS"
943
 
                      " priority string (see GnuTLS documentation)")
944
 
    parser.add_option("--servicename", type="string", metavar="NAME",
945
 
                      help="Zeroconf service name")
946
 
    parser.add_option("--configdir", type="string",
947
 
                      default="/etc/mandos", metavar="DIR",
948
 
                      help="Directory to search for configuration"
949
 
                      " files")
950
 
    parser.add_option("--no-dbus", action="store_false",
951
 
                      dest="use_dbus",
952
 
                      help="Do not provide D-Bus system bus"
953
 
                      " interface")
954
 
    parser.add_option("--no-ipv6", action="store_false",
955
 
                      dest="use_ipv6", help="Do not use IPv6")
 
1460
    parser.add_option("-i", u"--interface", type=u"string",
 
1461
                      metavar="IF", help=u"Bind to interface IF")
 
1462
    parser.add_option("-a", u"--address", type=u"string",
 
1463
                      help=u"Address to listen for requests on")
 
1464
    parser.add_option("-p", u"--port", type=u"int",
 
1465
                      help=u"Port number to receive requests on")
 
1466
    parser.add_option("--check", action=u"store_true",
 
1467
                      help=u"Run self-test")
 
1468
    parser.add_option("--debug", action=u"store_true",
 
1469
                      help=u"Debug mode; run in foreground and log to"
 
1470
                      u" terminal")
 
1471
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
 
1472
                      u" priority string (see GnuTLS documentation)")
 
1473
    parser.add_option("--servicename", type=u"string",
 
1474
                      metavar=u"NAME", help=u"Zeroconf service name")
 
1475
    parser.add_option("--configdir", type=u"string",
 
1476
                      default=u"/etc/mandos", metavar=u"DIR",
 
1477
                      help=u"Directory to search for configuration"
 
1478
                      u" files")
 
1479
    parser.add_option("--no-dbus", action=u"store_false",
 
1480
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
 
1481
                      u" system bus interface")
 
1482
    parser.add_option("--no-ipv6", action=u"store_false",
 
1483
                      dest=u"use_ipv6", help=u"Do not use IPv6")
956
1484
    options = parser.parse_args()[0]
957
1485
    
958
1486
    if options.check:
961
1489
        sys.exit()
962
1490
    
963
1491
    # Default values for config file for server-global settings
964
 
    server_defaults = { "interface": "",
965
 
                        "address": "",
966
 
                        "port": "",
967
 
                        "debug": "False",
968
 
                        "priority":
969
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
970
 
                        "servicename": "Mandos",
971
 
                        "use_dbus": "True",
972
 
                        "use_ipv6": "True",
 
1492
    server_defaults = { u"interface": u"",
 
1493
                        u"address": u"",
 
1494
                        u"port": u"",
 
1495
                        u"debug": u"False",
 
1496
                        u"priority":
 
1497
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1498
                        u"servicename": u"Mandos",
 
1499
                        u"use_dbus": u"True",
 
1500
                        u"use_ipv6": u"True",
973
1501
                        }
974
1502
    
975
1503
    # Parse config file for server-global settings
976
 
    server_config = ConfigParser.SafeConfigParser(server_defaults)
 
1504
    server_config = configparser.SafeConfigParser(server_defaults)
977
1505
    del server_defaults
978
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
1506
    server_config.read(os.path.join(options.configdir,
 
1507
                                    u"mandos.conf"))
979
1508
    # Convert the SafeConfigParser object to a dict
980
1509
    server_settings = server_config.defaults()
981
1510
    # Use the appropriate methods on the non-string config options
982
 
    server_settings["debug"] = server_config.getboolean("DEFAULT",
983
 
                                                        "debug")
984
 
    server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
985
 
                                                           "use_dbus")
986
 
    server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
987
 
                                                           "use_ipv6")
 
1511
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
 
1512
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
1513
                                                           option)
988
1514
    if server_settings["port"]:
989
 
        server_settings["port"] = server_config.getint("DEFAULT",
990
 
                                                       "port")
 
1515
        server_settings["port"] = server_config.getint(u"DEFAULT",
 
1516
                                                       u"port")
991
1517
    del server_config
992
1518
    
993
1519
    # Override the settings from the config file with command line
994
1520
    # options, if set.
995
 
    for option in ("interface", "address", "port", "debug",
996
 
                   "priority", "servicename", "configdir",
997
 
                   "use_dbus", "use_ipv6"):
 
1521
    for option in (u"interface", u"address", u"port", u"debug",
 
1522
                   u"priority", u"servicename", u"configdir",
 
1523
                   u"use_dbus", u"use_ipv6"):
998
1524
        value = getattr(options, option)
999
1525
        if value is not None:
1000
1526
            server_settings[option] = value
1001
1527
    del options
 
1528
    # Force all strings to be unicode
 
1529
    for option in server_settings.keys():
 
1530
        if type(server_settings[option]) is str:
 
1531
            server_settings[option] = unicode(server_settings[option])
1002
1532
    # Now we have our good server settings in "server_settings"
1003
1533
    
 
1534
    ##################################################################
 
1535
    
1004
1536
    # For convenience
1005
 
    debug = server_settings["debug"]
1006
 
    use_dbus = server_settings["use_dbus"]
1007
 
    use_ipv6 = server_settings["use_ipv6"]
 
1537
    debug = server_settings[u"debug"]
 
1538
    use_dbus = server_settings[u"use_dbus"]
 
1539
    use_ipv6 = server_settings[u"use_ipv6"]
1008
1540
    
1009
1541
    if not debug:
1010
1542
        syslogger.setLevel(logging.WARNING)
1011
1543
        console.setLevel(logging.WARNING)
1012
1544
    
1013
 
    if server_settings["servicename"] != "Mandos":
 
1545
    if server_settings[u"servicename"] != u"Mandos":
1014
1546
        syslogger.setFormatter(logging.Formatter
1015
 
                               ('Mandos (%s): %%(levelname)s:'
1016
 
                                ' %%(message)s'
1017
 
                                % server_settings["servicename"]))
 
1547
                               (u'Mandos (%s) [%%(process)d]:'
 
1548
                                u' %%(levelname)s: %%(message)s'
 
1549
                                % server_settings[u"servicename"]))
1018
1550
    
1019
1551
    # Parse config file with clients
1020
 
    client_defaults = { "timeout": "1h",
1021
 
                        "interval": "5m",
1022
 
                        "checker": "fping -q -- %%(host)s",
1023
 
                        "host": "",
 
1552
    client_defaults = { u"timeout": u"1h",
 
1553
                        u"interval": u"5m",
 
1554
                        u"checker": u"fping -q -- %%(host)s",
 
1555
                        u"host": u"",
1024
1556
                        }
1025
 
    client_config = ConfigParser.SafeConfigParser(client_defaults)
1026
 
    client_config.read(os.path.join(server_settings["configdir"],
1027
 
                                    "clients.conf"))
1028
 
    
1029
 
    clients = Set()
1030
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
1031
 
                                 server_settings["port"]),
1032
 
                                TCP_handler,
1033
 
                                settings=server_settings,
1034
 
                                clients=clients, use_ipv6=use_ipv6)
1035
 
    pidfilename = "/var/run/mandos.pid"
 
1557
    client_config = configparser.SafeConfigParser(client_defaults)
 
1558
    client_config.read(os.path.join(server_settings[u"configdir"],
 
1559
                                    u"clients.conf"))
 
1560
    
 
1561
    global mandos_dbus_service
 
1562
    mandos_dbus_service = None
 
1563
    
 
1564
    tcp_server = MandosServer((server_settings[u"address"],
 
1565
                               server_settings[u"port"]),
 
1566
                              ClientHandler,
 
1567
                              interface=server_settings[u"interface"],
 
1568
                              use_ipv6=use_ipv6,
 
1569
                              gnutls_priority=
 
1570
                              server_settings[u"priority"],
 
1571
                              use_dbus=use_dbus)
 
1572
    pidfilename = u"/var/run/mandos.pid"
1036
1573
    try:
1037
 
        pidfile = open(pidfilename, "w")
 
1574
        pidfile = open(pidfilename, u"w")
1038
1575
    except IOError:
1039
 
        logger.error("Could not open file %r", pidfilename)
 
1576
        logger.error(u"Could not open file %r", pidfilename)
1040
1577
    
1041
1578
    try:
1042
 
        uid = pwd.getpwnam("_mandos").pw_uid
1043
 
        gid = pwd.getpwnam("_mandos").pw_gid
 
1579
        uid = pwd.getpwnam(u"_mandos").pw_uid
 
1580
        gid = pwd.getpwnam(u"_mandos").pw_gid
1044
1581
    except KeyError:
1045
1582
        try:
1046
 
            uid = pwd.getpwnam("mandos").pw_uid
1047
 
            gid = pwd.getpwnam("mandos").pw_gid
 
1583
            uid = pwd.getpwnam(u"mandos").pw_uid
 
1584
            gid = pwd.getpwnam(u"mandos").pw_gid
1048
1585
        except KeyError:
1049
1586
            try:
1050
 
                uid = pwd.getpwnam("nobody").pw_uid
1051
 
                gid = pwd.getpwnam("nogroup").pw_gid
 
1587
                uid = pwd.getpwnam(u"nobody").pw_uid
 
1588
                gid = pwd.getpwnam(u"nobody").pw_gid
1052
1589
            except KeyError:
1053
1590
                uid = 65534
1054
1591
                gid = 65534
1067
1604
        
1068
1605
        @gnutls.library.types.gnutls_log_func
1069
1606
        def debug_gnutls(level, string):
1070
 
            logger.debug("GnuTLS: %s", string[:-1])
 
1607
            logger.debug(u"GnuTLS: %s", string[:-1])
1071
1608
        
1072
1609
        (gnutls.library.functions
1073
1610
         .gnutls_global_set_log_function(debug_gnutls))
1074
1611
    
1075
 
    global service
1076
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1077
 
    service = AvahiService(name = server_settings["servicename"],
1078
 
                           servicetype = "_mandos._tcp",
1079
 
                           protocol = protocol)
1080
 
    if server_settings["interface"]:
1081
 
        service.interface = (if_nametoindex
1082
 
                             (server_settings["interface"]))
1083
 
    
1084
1612
    global main_loop
1085
 
    global bus
1086
 
    global server
1087
1613
    # From the Avahi example code
1088
1614
    DBusGMainLoop(set_as_default=True )
1089
1615
    main_loop = gobject.MainLoop()
1090
1616
    bus = dbus.SystemBus()
1091
 
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1092
 
                                           avahi.DBUS_PATH_SERVER),
1093
 
                            avahi.DBUS_INTERFACE_SERVER)
1094
1617
    # End of Avahi example code
1095
1618
    if use_dbus:
1096
 
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
 
1619
        try:
 
1620
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
1621
                                            bus, do_not_queue=True)
 
1622
        except dbus.exceptions.NameExistsException, e:
 
1623
            logger.error(unicode(e) + u", disabling D-Bus")
 
1624
            use_dbus = False
 
1625
            server_settings[u"use_dbus"] = False
 
1626
            tcp_server.use_dbus = False
 
1627
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
1628
    service = AvahiService(name = server_settings[u"servicename"],
 
1629
                           servicetype = u"_mandos._tcp",
 
1630
                           protocol = protocol, bus = bus)
 
1631
    if server_settings["interface"]:
 
1632
        service.interface = (if_nametoindex
 
1633
                             (str(server_settings[u"interface"])))
1097
1634
    
1098
 
    clients.update(Set(Client(name = section,
1099
 
                              config
1100
 
                              = dict(client_config.items(section)),
1101
 
                              use_dbus = use_dbus)
1102
 
                       for section in client_config.sections()))
1103
 
    if not clients:
 
1635
    client_class = Client
 
1636
    if use_dbus:
 
1637
        client_class = functools.partial(ClientDBus, bus = bus)
 
1638
    tcp_server.clients.update(set(
 
1639
            client_class(name = section,
 
1640
                         config= dict(client_config.items(section)))
 
1641
            for section in client_config.sections()))
 
1642
    if not tcp_server.clients:
1104
1643
        logger.warning(u"No clients defined")
1105
1644
    
1106
1645
    if debug:
1116
1655
        daemon()
1117
1656
    
1118
1657
    try:
1119
 
        pid = os.getpid()
1120
 
        pidfile.write(str(pid) + "\n")
1121
 
        pidfile.close()
 
1658
        with pidfile:
 
1659
            pid = os.getpid()
 
1660
            pidfile.write(str(pid) + "\n")
1122
1661
        del pidfile
1123
1662
    except IOError:
1124
1663
        logger.error(u"Could not write to file %r with PID %d",
1128
1667
        pass
1129
1668
    del pidfilename
1130
1669
    
1131
 
    def cleanup():
1132
 
        "Cleanup function; run on exit"
1133
 
        global group
1134
 
        # From the Avahi example code
1135
 
        if not group is None:
1136
 
            group.Free()
1137
 
            group = None
1138
 
        # End of Avahi example code
1139
 
        
1140
 
        while clients:
1141
 
            client = clients.pop()
1142
 
            client.disable_hook = None
1143
 
            client.disable()
1144
 
    
1145
 
    atexit.register(cleanup)
1146
 
    
1147
1670
    if not debug:
1148
1671
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1149
1672
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1150
1673
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1151
1674
    
1152
1675
    if use_dbus:
1153
 
        class MandosServer(dbus.service.Object):
 
1676
        class MandosDBusService(dbus.service.Object):
1154
1677
            """A D-Bus proxy object"""
1155
1678
            def __init__(self):
1156
 
                dbus.service.Object.__init__(self, bus, "/")
 
1679
                dbus.service.Object.__init__(self, bus, u"/")
1157
1680
            _interface = u"se.bsnet.fukt.Mandos"
1158
1681
            
1159
 
            @dbus.service.signal(_interface, signature="oa{sv}")
1160
 
            def ClientAdded(self, objpath, properties):
1161
 
                "D-Bus signal"
1162
 
                pass
1163
 
            
1164
 
            @dbus.service.signal(_interface, signature="os")
 
1682
            @dbus.service.signal(_interface, signature=u"o")
 
1683
            def ClientAdded(self, objpath):
 
1684
                "D-Bus signal"
 
1685
                pass
 
1686
            
 
1687
            @dbus.service.signal(_interface, signature=u"ss")
 
1688
            def ClientNotFound(self, fingerprint, address):
 
1689
                "D-Bus signal"
 
1690
                pass
 
1691
            
 
1692
            @dbus.service.signal(_interface, signature=u"os")
1165
1693
            def ClientRemoved(self, objpath, name):
1166
1694
                "D-Bus signal"
1167
1695
                pass
1168
1696
            
1169
 
            @dbus.service.method(_interface, out_signature="ao")
 
1697
            @dbus.service.method(_interface, out_signature=u"ao")
1170
1698
            def GetAllClients(self):
1171
1699
                "D-Bus method"
1172
 
                return dbus.Array(c.dbus_object_path for c in clients)
 
1700
                return dbus.Array(c.dbus_object_path
 
1701
                                  for c in tcp_server.clients)
1173
1702
            
1174
 
            @dbus.service.method(_interface, out_signature="a{oa{sv}}")
 
1703
            @dbus.service.method(_interface,
 
1704
                                 out_signature=u"a{oa{sv}}")
1175
1705
            def GetAllClientsWithProperties(self):
1176
1706
                "D-Bus method"
1177
1707
                return dbus.Dictionary(
1178
 
                    ((c.dbus_object_path, c.GetAllProperties())
1179
 
                     for c in clients),
1180
 
                    signature="oa{sv}")
 
1708
                    ((c.dbus_object_path, c.GetAll(u""))
 
1709
                     for c in tcp_server.clients),
 
1710
                    signature=u"oa{sv}")
1181
1711
            
1182
 
            @dbus.service.method(_interface, in_signature="o")
 
1712
            @dbus.service.method(_interface, in_signature=u"o")
1183
1713
            def RemoveClient(self, object_path):
1184
1714
                "D-Bus method"
1185
 
                for c in clients:
 
1715
                for c in tcp_server.clients:
1186
1716
                    if c.dbus_object_path == object_path:
1187
 
                        clients.remove(c)
 
1717
                        tcp_server.clients.remove(c)
 
1718
                        c.remove_from_connection()
1188
1719
                        # Don't signal anything except ClientRemoved
1189
 
                        c.use_dbus = False
1190
 
                        c.disable()
 
1720
                        c.disable(quiet=True)
1191
1721
                        # Emit D-Bus signal
1192
1722
                        self.ClientRemoved(object_path, c.name)
1193
1723
                        return
1194
 
                raise KeyError
 
1724
                raise KeyError(object_path)
1195
1725
            
1196
1726
            del _interface
1197
1727
        
1198
 
        mandos_server = MandosServer()
1199
 
    
1200
 
    for client in clients:
 
1728
        mandos_dbus_service = MandosDBusService()
 
1729
    
 
1730
    def cleanup():
 
1731
        "Cleanup function; run on exit"
 
1732
        service.cleanup()
 
1733
        
 
1734
        while tcp_server.clients:
 
1735
            client = tcp_server.clients.pop()
 
1736
            if use_dbus:
 
1737
                client.remove_from_connection()
 
1738
            client.disable_hook = None
 
1739
            # Don't signal anything except ClientRemoved
 
1740
            client.disable(quiet=True)
 
1741
            if use_dbus:
 
1742
                # Emit D-Bus signal
 
1743
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
1744
                                                  client.name)
 
1745
    
 
1746
    atexit.register(cleanup)
 
1747
    
 
1748
    for client in tcp_server.clients:
1201
1749
        if use_dbus:
1202
1750
            # Emit D-Bus signal
1203
 
            mandos_server.ClientAdded(client.dbus_object_path,
1204
 
                                      client.GetAllProperties())
 
1751
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
1205
1752
        client.enable()
1206
1753
    
1207
1754
    tcp_server.enable()
1221
1768
    
1222
1769
    try:
1223
1770
        # From the Avahi example code
1224
 
        server.connect_to_signal("StateChanged", server_state_changed)
1225
1771
        try:
1226
 
            server_state_changed(server.GetState())
 
1772
            service.activate()
1227
1773
        except dbus.exceptions.DBusException, error:
1228
1774
            logger.critical(u"DBusException: %s", error)
 
1775
            cleanup()
1229
1776
            sys.exit(1)
1230
1777
        # End of Avahi example code
1231
1778
        
1238
1785
        main_loop.run()
1239
1786
    except AvahiError, error:
1240
1787
        logger.critical(u"AvahiError: %s", error)
 
1788
        cleanup()
1241
1789
        sys.exit(1)
1242
1790
    except KeyboardInterrupt:
1243
1791
        if debug:
1244
1792
            print >> sys.stderr
1245
 
        logger.debug("Server received KeyboardInterrupt")
1246
 
    logger.debug("Server exiting")
 
1793
        logger.debug(u"Server received KeyboardInterrupt")
 
1794
    logger.debug(u"Server exiting")
 
1795
    # Must run before the D-Bus bus name gets deregistered
 
1796
    cleanup()
1247
1797
 
1248
1798
if __name__ == '__main__':
1249
1799
    main()