/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: teddy at bsnet
  • Date: 2010-09-09 18:16:14 UTC
  • mfrom: (237.2.35 mandos-empty-device)
  • Revision ID: teddy@fukt.bsnet.se-20100909181614-oanlmvkzsiodbo3c
Merge in branch to interpret an empty device name to mean
"autodetect".

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# methods "add" and "remove" in the "AvahiService" class, the
10
 
# "server_state_changed" and "entry_group_state_changed" functions,
11
 
# and some lines in "main".
 
9
# methods "add", "remove", "server_state_changed",
 
10
# "entry_group_state_changed", "cleanup", and "activate" in the
 
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
 
34
34
from __future__ import division, with_statement, absolute_import
35
35
 
36
 
import SocketServer
 
36
import SocketServer as socketserver
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
 
import ConfigParser
 
47
import ConfigParser as configparser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
 
from sets import Set
53
52
import subprocess
54
53
import atexit
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
 
from contextlib import closing
 
58
import contextlib
 
59
import struct
 
60
import fcntl
 
61
import functools
 
62
import cPickle as pickle
 
63
import select
60
64
 
61
65
import dbus
62
66
import dbus.service
65
69
from dbus.mainloop.glib import DBusGMainLoop
66
70
import ctypes
67
71
import ctypes.util
68
 
 
69
 
version = "1.0.10"
70
 
 
71
 
logger = logging.Logger('mandos')
 
72
import xml.dom.minidom
 
73
import inspect
 
74
 
 
75
try:
 
76
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
 
77
except AttributeError:
 
78
    try:
 
79
        from IN import SO_BINDTODEVICE
 
80
    except ImportError:
 
81
        SO_BINDTODEVICE = None
 
82
 
 
83
 
 
84
version = "1.0.14"
 
85
 
 
86
logger = logging.Logger(u'mandos')
72
87
syslogger = (logging.handlers.SysLogHandler
73
88
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
89
              address = "/dev/log"))
75
90
syslogger.setFormatter(logging.Formatter
76
 
                       ('Mandos [%(process)d]: %(levelname)s:'
77
 
                        ' %(message)s'))
 
91
                       (u'Mandos [%(process)d]: %(levelname)s:'
 
92
                        u' %(message)s'))
78
93
logger.addHandler(syslogger)
79
94
 
80
95
console = logging.StreamHandler()
81
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
 
                                       ' %(levelname)s: %(message)s'))
 
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
 
97
                                       u' %(levelname)s:'
 
98
                                       u' %(message)s'))
83
99
logger.addHandler(console)
84
100
 
85
101
class AvahiError(Exception):
98
114
 
99
115
class AvahiService(object):
100
116
    """An Avahi (Zeroconf) service.
 
117
    
101
118
    Attributes:
102
119
    interface: integer; avahi.IF_UNSPEC or an interface index.
103
120
               Used to optionally bind to the specified interface.
104
 
    name: string; Example: 'Mandos'
105
 
    type: string; Example: '_mandos._tcp'.
 
121
    name: string; Example: u'Mandos'
 
122
    type: string; Example: u'_mandos._tcp'.
106
123
                  See <http://www.dns-sd.org/ServiceTypes.html>
107
124
    port: integer; what port to announce
108
125
    TXT: list of strings; TXT record for the service
111
128
    max_renames: integer; maximum number of renames
112
129
    rename_count: integer; counter so we only rename after collisions
113
130
                  a sensible number of times
 
131
    group: D-Bus Entry Group
 
132
    server: D-Bus Server
 
133
    bus: dbus.SystemBus()
114
134
    """
115
135
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
136
                 servicetype = None, port = None, TXT = None,
117
 
                 domain = "", host = "", max_renames = 32768,
118
 
                 protocol = avahi.PROTO_UNSPEC):
 
137
                 domain = u"", host = u"", max_renames = 32768,
 
138
                 protocol = avahi.PROTO_UNSPEC, bus = None):
119
139
        self.interface = interface
120
140
        self.name = name
121
141
        self.type = servicetype
126
146
        self.rename_count = 0
127
147
        self.max_renames = max_renames
128
148
        self.protocol = protocol
 
149
        self.group = None       # our entry group
 
150
        self.server = None
 
151
        self.bus = bus
129
152
    def rename(self):
130
153
        """Derived from the Avahi example code"""
131
154
        if self.rename_count >= self.max_renames:
133
156
                            u" after %i retries, exiting.",
134
157
                            self.rename_count)
135
158
            raise AvahiServiceError(u"Too many renames")
136
 
        self.name = server.GetAlternativeServiceName(self.name)
 
159
        self.name = self.server.GetAlternativeServiceName(self.name)
137
160
        logger.info(u"Changing Zeroconf service name to %r ...",
138
 
                    str(self.name))
 
161
                    unicode(self.name))
139
162
        syslogger.setFormatter(logging.Formatter
140
 
                               ('Mandos (%s): %%(levelname)s:'
141
 
                                ' %%(message)s' % self.name))
 
163
                               (u'Mandos (%s) [%%(process)d]:'
 
164
                                u' %%(levelname)s: %%(message)s'
 
165
                                % self.name))
142
166
        self.remove()
143
167
        self.add()
144
168
        self.rename_count += 1
145
169
    def remove(self):
146
170
        """Derived from the Avahi example code"""
147
 
        if group is not None:
148
 
            group.Reset()
 
171
        if self.group is not None:
 
172
            self.group.Reset()
149
173
    def add(self):
150
174
        """Derived from the Avahi example code"""
151
 
        global group
152
 
        if group is None:
153
 
            group = dbus.Interface(bus.get_object
154
 
                                   (avahi.DBUS_NAME,
155
 
                                    server.EntryGroupNew()),
156
 
                                   avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
 
            group.connect_to_signal('StateChanged',
158
 
                                    entry_group_state_changed)
 
175
        if self.group is None:
 
176
            self.group = dbus.Interface(
 
177
                self.bus.get_object(avahi.DBUS_NAME,
 
178
                                    self.server.EntryGroupNew()),
 
179
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
180
            self.group.connect_to_signal('StateChanged',
 
181
                                         self
 
182
                                         .entry_group_state_changed)
159
183
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
160
 
                     service.name, service.type)
161
 
        group.AddService(
162
 
                self.interface,         # interface
163
 
                self.protocol,          # protocol
164
 
                dbus.UInt32(0),         # flags
165
 
                self.name, self.type,
166
 
                self.domain, self.host,
167
 
                dbus.UInt16(self.port),
168
 
                avahi.string_array_to_txt_array(self.TXT))
169
 
        group.Commit()
170
 
 
171
 
# From the Avahi example code:
172
 
group = None                            # our entry group
173
 
# End of Avahi example code
174
 
 
175
 
 
176
 
def _datetime_to_dbus(dt, variant_level=0):
177
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
178
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
179
 
 
180
 
 
181
 
class Client(dbus.service.Object):
 
184
                     self.name, self.type)
 
185
        self.group.AddService(
 
186
            self.interface,
 
187
            self.protocol,
 
188
            dbus.UInt32(0),     # flags
 
189
            self.name, self.type,
 
190
            self.domain, self.host,
 
191
            dbus.UInt16(self.port),
 
192
            avahi.string_array_to_txt_array(self.TXT))
 
193
        self.group.Commit()
 
194
    def entry_group_state_changed(self, state, error):
 
195
        """Derived from the Avahi example code"""
 
196
        logger.debug(u"Avahi entry group state change: %i", state)
 
197
        
 
198
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
199
            logger.debug(u"Zeroconf service established.")
 
200
        elif state == avahi.ENTRY_GROUP_COLLISION:
 
201
            logger.warning(u"Zeroconf service name collision.")
 
202
            self.rename()
 
203
        elif state == avahi.ENTRY_GROUP_FAILURE:
 
204
            logger.critical(u"Avahi: Error in group state changed %s",
 
205
                            unicode(error))
 
206
            raise AvahiGroupError(u"State changed: %s"
 
207
                                  % unicode(error))
 
208
    def cleanup(self):
 
209
        """Derived from the Avahi example code"""
 
210
        if self.group is not None:
 
211
            self.group.Free()
 
212
            self.group = None
 
213
    def server_state_changed(self, state):
 
214
        """Derived from the Avahi example code"""
 
215
        logger.debug(u"Avahi server state change: %i", state)
 
216
        if state == avahi.SERVER_COLLISION:
 
217
            logger.error(u"Zeroconf server name collision")
 
218
            self.remove()
 
219
        elif state == avahi.SERVER_RUNNING:
 
220
            self.add()
 
221
    def activate(self):
 
222
        """Derived from the Avahi example code"""
 
223
        if self.server is None:
 
224
            self.server = dbus.Interface(
 
225
                self.bus.get_object(avahi.DBUS_NAME,
 
226
                                    avahi.DBUS_PATH_SERVER),
 
227
                avahi.DBUS_INTERFACE_SERVER)
 
228
        self.server.connect_to_signal(u"StateChanged",
 
229
                                 self.server_state_changed)
 
230
        self.server_state_changed(self.server.GetState())
 
231
 
 
232
 
 
233
class Client(object):
182
234
    """A representation of a client host served by this server.
 
235
    
183
236
    Attributes:
184
237
    name:       string; from the config file, used in log messages and
185
238
                        D-Bus identifiers
192
245
    enabled:    bool()
193
246
    last_checked_ok: datetime.datetime(); (UTC) or None
194
247
    timeout:    datetime.timedelta(); How long from last_checked_ok
195
 
                                      until this client is invalid
 
248
                                      until this client is disabled
196
249
    interval:   datetime.timedelta(); How often to start a new checker
197
250
    disable_hook:  If set, called by disable() as disable_hook(self)
198
251
    checker:    subprocess.Popen(); a running checker process used
199
252
                                    to see if the client lives.
200
253
                                    'None' if no process is running.
201
254
    checker_initiator_tag: a gobject event source tag, or None
202
 
    disable_initiator_tag:    - '' -
 
255
    disable_initiator_tag: - '' -
203
256
    checker_callback_tag:  - '' -
204
257
    checker_command: string; External command which is run to check if
205
258
                     client lives.  %() expansions are done at
206
259
                     runtime with vars(self) as dict, so that for
207
260
                     instance %(name)s can be used in the command.
208
261
    current_checker_command: string; current running checker_command
209
 
    use_dbus: bool(); Whether to provide D-Bus interface and signals
210
 
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
211
262
    """
 
263
    
 
264
    @staticmethod
 
265
    def _timedelta_to_milliseconds(td):
 
266
        "Convert a datetime.timedelta() to milliseconds"
 
267
        return ((td.days * 24 * 60 * 60 * 1000)
 
268
                + (td.seconds * 1000)
 
269
                + (td.microseconds // 1000))
 
270
    
212
271
    def timeout_milliseconds(self):
213
272
        "Return the 'timeout' attribute in milliseconds"
214
 
        return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
 
                + (self.timeout.seconds * 1000)
216
 
                + (self.timeout.microseconds // 1000))
 
273
        return self._timedelta_to_milliseconds(self.timeout)
217
274
    
218
275
    def interval_milliseconds(self):
219
276
        "Return the 'interval' attribute in milliseconds"
220
 
        return ((self.interval.days * 24 * 60 * 60 * 1000)
221
 
                + (self.interval.seconds * 1000)
222
 
                + (self.interval.microseconds // 1000))
 
277
        return self._timedelta_to_milliseconds(self.interval)
223
278
    
224
 
    def __init__(self, name = None, disable_hook=None, config=None,
225
 
                 use_dbus=True):
 
279
    def __init__(self, name = None, disable_hook=None, config=None):
226
280
        """Note: the 'checker' key in 'config' sets the
227
281
        'checker_command' attribute and *not* the 'checker'
228
282
        attribute."""
230
284
        if config is None:
231
285
            config = {}
232
286
        logger.debug(u"Creating client %r", self.name)
233
 
        self.use_dbus = False   # During __init__
234
287
        # Uppercase and remove spaces from fingerprint for later
235
288
        # comparison purposes with return value from the fingerprint()
236
289
        # function
237
 
        self.fingerprint = (config["fingerprint"].upper()
 
290
        self.fingerprint = (config[u"fingerprint"].upper()
238
291
                            .replace(u" ", u""))
239
292
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
240
 
        if "secret" in config:
241
 
            self.secret = config["secret"].decode(u"base64")
242
 
        elif "secfile" in config:
243
 
            with closing(open(os.path.expanduser
244
 
                              (os.path.expandvars
245
 
                               (config["secfile"])))) as secfile:
 
293
        if u"secret" in config:
 
294
            self.secret = config[u"secret"].decode(u"base64")
 
295
        elif u"secfile" in config:
 
296
            with open(os.path.expanduser(os.path.expandvars
 
297
                                         (config[u"secfile"])),
 
298
                      "rb") as secfile:
246
299
                self.secret = secfile.read()
247
300
        else:
248
301
            raise TypeError(u"No secret or secfile for client %s"
249
302
                            % self.name)
250
 
        self.host = config.get("host", "")
 
303
        self.host = config.get(u"host", u"")
251
304
        self.created = datetime.datetime.utcnow()
252
305
        self.enabled = False
253
306
        self.last_enabled = None
254
307
        self.last_checked_ok = None
255
 
        self.timeout = string_to_delta(config["timeout"])
256
 
        self.interval = string_to_delta(config["interval"])
 
308
        self.timeout = string_to_delta(config[u"timeout"])
 
309
        self.interval = string_to_delta(config[u"interval"])
257
310
        self.disable_hook = disable_hook
258
311
        self.checker = None
259
312
        self.checker_initiator_tag = None
260
313
        self.disable_initiator_tag = None
261
314
        self.checker_callback_tag = None
262
 
        self.checker_command = config["checker"]
 
315
        self.checker_command = config[u"checker"]
263
316
        self.current_checker_command = None
264
317
        self.last_connect = None
265
 
        # Only now, when this client is initialized, can it show up on
266
 
        # the D-Bus
267
 
        self.use_dbus = use_dbus
268
 
        if self.use_dbus:
269
 
            self.dbus_object_path = (dbus.ObjectPath
270
 
                                     ("/clients/"
271
 
                                      + self.name.replace(".", "_")))
272
 
            dbus.service.Object.__init__(self, bus,
273
 
                                         self.dbus_object_path)
274
318
    
275
319
    def enable(self):
276
320
        """Start this client's checker and timeout hooks"""
 
321
        if getattr(self, u"enabled", False):
 
322
            # Already enabled
 
323
            return
277
324
        self.last_enabled = datetime.datetime.utcnow()
278
325
        # Schedule a new checker to be started an 'interval' from now,
279
326
        # and every interval from then on.
280
327
        self.checker_initiator_tag = (gobject.timeout_add
281
328
                                      (self.interval_milliseconds(),
282
329
                                       self.start_checker))
283
 
        # Also start a new checker *right now*.
284
 
        self.start_checker()
285
330
        # Schedule a disable() when 'timeout' has passed
286
331
        self.disable_initiator_tag = (gobject.timeout_add
287
332
                                   (self.timeout_milliseconds(),
288
333
                                    self.disable))
289
334
        self.enabled = True
290
 
        if self.use_dbus:
291
 
            # Emit D-Bus signals
292
 
            self.PropertyChanged(dbus.String(u"enabled"),
293
 
                                 dbus.Boolean(True, variant_level=1))
294
 
            self.PropertyChanged(dbus.String(u"last_enabled"),
295
 
                                 (_datetime_to_dbus(self.last_enabled,
296
 
                                                    variant_level=1)))
 
335
        # Also start a new checker *right now*.
 
336
        self.start_checker()
297
337
    
298
 
    def disable(self):
 
338
    def disable(self, quiet=True):
299
339
        """Disable this client."""
300
340
        if not getattr(self, "enabled", False):
301
341
            return False
302
 
        logger.info(u"Disabling client %s", self.name)
303
 
        if getattr(self, "disable_initiator_tag", False):
 
342
        if not quiet:
 
343
            logger.info(u"Disabling client %s", self.name)
 
344
        if getattr(self, u"disable_initiator_tag", False):
304
345
            gobject.source_remove(self.disable_initiator_tag)
305
346
            self.disable_initiator_tag = None
306
 
        if getattr(self, "checker_initiator_tag", False):
 
347
        if getattr(self, u"checker_initiator_tag", False):
307
348
            gobject.source_remove(self.checker_initiator_tag)
308
349
            self.checker_initiator_tag = None
309
350
        self.stop_checker()
310
351
        if self.disable_hook:
311
352
            self.disable_hook(self)
312
353
        self.enabled = False
313
 
        if self.use_dbus:
314
 
            # Emit D-Bus signal
315
 
            self.PropertyChanged(dbus.String(u"enabled"),
316
 
                                 dbus.Boolean(False, variant_level=1))
317
354
        # Do not run this again if called by a gobject.timeout_add
318
355
        return False
319
356
    
325
362
        """The checker has completed, so take appropriate actions."""
326
363
        self.checker_callback_tag = None
327
364
        self.checker = None
328
 
        if self.use_dbus:
329
 
            # Emit D-Bus signal
330
 
            self.PropertyChanged(dbus.String(u"checker_running"),
331
 
                                 dbus.Boolean(False, variant_level=1))
332
365
        if os.WIFEXITED(condition):
333
366
            exitstatus = os.WEXITSTATUS(condition)
334
367
            if exitstatus == 0:
338
371
            else:
339
372
                logger.info(u"Checker for %(name)s failed",
340
373
                            vars(self))
341
 
            if self.use_dbus:
342
 
                # Emit D-Bus signal
343
 
                self.CheckerCompleted(dbus.Int16(exitstatus),
344
 
                                      dbus.Int64(condition),
345
 
                                      dbus.String(command))
346
374
        else:
347
375
            logger.warning(u"Checker for %(name)s crashed?",
348
376
                           vars(self))
349
 
            if self.use_dbus:
350
 
                # Emit D-Bus signal
351
 
                self.CheckerCompleted(dbus.Int16(-1),
352
 
                                      dbus.Int64(condition),
353
 
                                      dbus.String(command))
354
377
    
355
378
    def checked_ok(self):
356
379
        """Bump up the timeout for this client.
 
380
        
357
381
        This should only be called when the client has been seen,
358
382
        alive and well.
359
383
        """
362
386
        self.disable_initiator_tag = (gobject.timeout_add
363
387
                                      (self.timeout_milliseconds(),
364
388
                                       self.disable))
365
 
        if self.use_dbus:
366
 
            # Emit D-Bus signal
367
 
            self.PropertyChanged(
368
 
                dbus.String(u"last_checked_ok"),
369
 
                (_datetime_to_dbus(self.last_checked_ok,
370
 
                                   variant_level=1)))
371
389
    
372
390
    def start_checker(self):
373
391
        """Start a new checker subprocess if one is not running.
 
392
        
374
393
        If a checker already exists, leave it running and do
375
394
        nothing."""
376
395
        # The reason for not killing a running checker is that if we
379
398
        # client would inevitably timeout, since no checker would get
380
399
        # a chance to run to completion.  If we instead leave running
381
400
        # checkers alone, the checker would have to take more time
382
 
        # than 'timeout' for the client to be declared invalid, which
383
 
        # is as it should be.
 
401
        # than 'timeout' for the client to be disabled, which is as it
 
402
        # should be.
384
403
        
385
404
        # If a checker exists, make sure it is not a zombie
386
 
        if self.checker is not None:
 
405
        try:
387
406
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
407
        except (AttributeError, OSError), error:
 
408
            if (isinstance(error, OSError)
 
409
                and error.errno != errno.ECHILD):
 
410
                raise error
 
411
        else:
388
412
            if pid:
389
 
                logger.warning("Checker was a zombie")
 
413
                logger.warning(u"Checker was a zombie")
390
414
                gobject.source_remove(self.checker_callback_tag)
391
415
                self.checker_callback(pid, status,
392
416
                                      self.current_checker_command)
397
421
                command = self.checker_command % self.host
398
422
            except TypeError:
399
423
                # Escape attributes for the shell
400
 
                escaped_attrs = dict((key, re.escape(str(val)))
 
424
                escaped_attrs = dict((key,
 
425
                                      re.escape(unicode(str(val),
 
426
                                                        errors=
 
427
                                                        u'replace')))
401
428
                                     for key, val in
402
429
                                     vars(self).iteritems())
403
430
                try:
406
433
                    logger.error(u'Could not format string "%s":'
407
434
                                 u' %s', self.checker_command, error)
408
435
                    return True # Try again later
409
 
                self.current_checker_command = command
 
436
            self.current_checker_command = command
410
437
            try:
411
438
                logger.info(u"Starting checker %r for %s",
412
439
                            command, self.name)
416
443
                # always replaced by /dev/null.)
417
444
                self.checker = subprocess.Popen(command,
418
445
                                                close_fds=True,
419
 
                                                shell=True, cwd="/")
420
 
                if self.use_dbus:
421
 
                    # Emit D-Bus signal
422
 
                    self.CheckerStarted(command)
423
 
                    self.PropertyChanged(
424
 
                        dbus.String("checker_running"),
425
 
                        dbus.Boolean(True, variant_level=1))
 
446
                                                shell=True, cwd=u"/")
426
447
                self.checker_callback_tag = (gobject.child_watch_add
427
448
                                             (self.checker.pid,
428
449
                                              self.checker_callback,
444
465
        if self.checker_callback_tag:
445
466
            gobject.source_remove(self.checker_callback_tag)
446
467
            self.checker_callback_tag = None
447
 
        if getattr(self, "checker", None) is None:
 
468
        if getattr(self, u"checker", None) is None:
448
469
            return
449
470
        logger.debug(u"Stopping checker for %(name)s", vars(self))
450
471
        try:
451
472
            os.kill(self.checker.pid, signal.SIGTERM)
452
 
            #os.sleep(0.5)
 
473
            #time.sleep(0.5)
453
474
            #if self.checker.poll() is None:
454
475
            #    os.kill(self.checker.pid, signal.SIGKILL)
455
476
        except OSError, error:
456
477
            if error.errno != errno.ESRCH: # No such process
457
478
                raise
458
479
        self.checker = None
459
 
        if self.use_dbus:
 
480
 
 
481
 
 
482
def dbus_service_property(dbus_interface, signature=u"v",
 
483
                          access=u"readwrite", byte_arrays=False):
 
484
    """Decorators for marking methods of a DBusObjectWithProperties to
 
485
    become properties on the D-Bus.
 
486
    
 
487
    The decorated method will be called with no arguments by "Get"
 
488
    and with one argument by "Set".
 
489
    
 
490
    The parameters, where they are supported, are the same as
 
491
    dbus.service.method, except there is only "signature", since the
 
492
    type from Get() and the type sent to Set() is the same.
 
493
    """
 
494
    # Encoding deeply encoded byte arrays is not supported yet by the
 
495
    # "Set" method, so we fail early here:
 
496
    if byte_arrays and signature != u"ay":
 
497
        raise ValueError(u"Byte arrays not supported for non-'ay'"
 
498
                         u" signature %r" % signature)
 
499
    def decorator(func):
 
500
        func._dbus_is_property = True
 
501
        func._dbus_interface = dbus_interface
 
502
        func._dbus_signature = signature
 
503
        func._dbus_access = access
 
504
        func._dbus_name = func.__name__
 
505
        if func._dbus_name.endswith(u"_dbus_property"):
 
506
            func._dbus_name = func._dbus_name[:-14]
 
507
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
 
508
        return func
 
509
    return decorator
 
510
 
 
511
 
 
512
class DBusPropertyException(dbus.exceptions.DBusException):
 
513
    """A base class for D-Bus property-related exceptions
 
514
    """
 
515
    def __unicode__(self):
 
516
        return unicode(str(self))
 
517
 
 
518
 
 
519
class DBusPropertyAccessException(DBusPropertyException):
 
520
    """A property's access permissions disallows an operation.
 
521
    """
 
522
    pass
 
523
 
 
524
 
 
525
class DBusPropertyNotFound(DBusPropertyException):
 
526
    """An attempt was made to access a non-existing property.
 
527
    """
 
528
    pass
 
529
 
 
530
 
 
531
class DBusObjectWithProperties(dbus.service.Object):
 
532
    """A D-Bus object with properties.
 
533
 
 
534
    Classes inheriting from this can use the dbus_service_property
 
535
    decorator to expose methods as D-Bus properties.  It exposes the
 
536
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
537
    """
 
538
    
 
539
    @staticmethod
 
540
    def _is_dbus_property(obj):
 
541
        return getattr(obj, u"_dbus_is_property", False)
 
542
    
 
543
    def _get_all_dbus_properties(self):
 
544
        """Returns a generator of (name, attribute) pairs
 
545
        """
 
546
        return ((prop._dbus_name, prop)
 
547
                for name, prop in
 
548
                inspect.getmembers(self, self._is_dbus_property))
 
549
    
 
550
    def _get_dbus_property(self, interface_name, property_name):
 
551
        """Returns a bound method if one exists which is a D-Bus
 
552
        property with the specified name and interface.
 
553
        """
 
554
        for name in (property_name,
 
555
                     property_name + u"_dbus_property"):
 
556
            prop = getattr(self, name, None)
 
557
            if (prop is None
 
558
                or not self._is_dbus_property(prop)
 
559
                or prop._dbus_name != property_name
 
560
                or (interface_name and prop._dbus_interface
 
561
                    and interface_name != prop._dbus_interface)):
 
562
                continue
 
563
            return prop
 
564
        # No such property
 
565
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
 
566
                                   + interface_name + u"."
 
567
                                   + property_name)
 
568
    
 
569
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
 
570
                         out_signature=u"v")
 
571
    def Get(self, interface_name, property_name):
 
572
        """Standard D-Bus property Get() method, see D-Bus standard.
 
573
        """
 
574
        prop = self._get_dbus_property(interface_name, property_name)
 
575
        if prop._dbus_access == u"write":
 
576
            raise DBusPropertyAccessException(property_name)
 
577
        value = prop()
 
578
        if not hasattr(value, u"variant_level"):
 
579
            return value
 
580
        return type(value)(value, variant_level=value.variant_level+1)
 
581
    
 
582
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
 
583
    def Set(self, interface_name, property_name, value):
 
584
        """Standard D-Bus property Set() method, see D-Bus standard.
 
585
        """
 
586
        prop = self._get_dbus_property(interface_name, property_name)
 
587
        if prop._dbus_access == u"read":
 
588
            raise DBusPropertyAccessException(property_name)
 
589
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
590
            # The byte_arrays option is not supported yet on
 
591
            # signatures other than "ay".
 
592
            if prop._dbus_signature != u"ay":
 
593
                raise ValueError
 
594
            value = dbus.ByteArray(''.join(unichr(byte)
 
595
                                           for byte in value))
 
596
        prop(value)
 
597
    
 
598
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
 
599
                         out_signature=u"a{sv}")
 
600
    def GetAll(self, interface_name):
 
601
        """Standard D-Bus property GetAll() method, see D-Bus
 
602
        standard.
 
603
 
 
604
        Note: Will not include properties with access="write".
 
605
        """
 
606
        all = {}
 
607
        for name, prop in self._get_all_dbus_properties():
 
608
            if (interface_name
 
609
                and interface_name != prop._dbus_interface):
 
610
                # Interface non-empty but did not match
 
611
                continue
 
612
            # Ignore write-only properties
 
613
            if prop._dbus_access == u"write":
 
614
                continue
 
615
            value = prop()
 
616
            if not hasattr(value, u"variant_level"):
 
617
                all[name] = value
 
618
                continue
 
619
            all[name] = type(value)(value, variant_level=
 
620
                                    value.variant_level+1)
 
621
        return dbus.Dictionary(all, signature=u"sv")
 
622
    
 
623
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
624
                         out_signature=u"s",
 
625
                         path_keyword='object_path',
 
626
                         connection_keyword='connection')
 
627
    def Introspect(self, object_path, connection):
 
628
        """Standard D-Bus method, overloaded to insert property tags.
 
629
        """
 
630
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
631
                                                   connection)
 
632
        try:
 
633
            document = xml.dom.minidom.parseString(xmlstring)
 
634
            def make_tag(document, name, prop):
 
635
                e = document.createElement(u"property")
 
636
                e.setAttribute(u"name", name)
 
637
                e.setAttribute(u"type", prop._dbus_signature)
 
638
                e.setAttribute(u"access", prop._dbus_access)
 
639
                return e
 
640
            for if_tag in document.getElementsByTagName(u"interface"):
 
641
                for tag in (make_tag(document, name, prop)
 
642
                            for name, prop
 
643
                            in self._get_all_dbus_properties()
 
644
                            if prop._dbus_interface
 
645
                            == if_tag.getAttribute(u"name")):
 
646
                    if_tag.appendChild(tag)
 
647
                # Add the names to the return values for the
 
648
                # "org.freedesktop.DBus.Properties" methods
 
649
                if (if_tag.getAttribute(u"name")
 
650
                    == u"org.freedesktop.DBus.Properties"):
 
651
                    for cn in if_tag.getElementsByTagName(u"method"):
 
652
                        if cn.getAttribute(u"name") == u"Get":
 
653
                            for arg in cn.getElementsByTagName(u"arg"):
 
654
                                if (arg.getAttribute(u"direction")
 
655
                                    == u"out"):
 
656
                                    arg.setAttribute(u"name", u"value")
 
657
                        elif cn.getAttribute(u"name") == u"GetAll":
 
658
                            for arg in cn.getElementsByTagName(u"arg"):
 
659
                                if (arg.getAttribute(u"direction")
 
660
                                    == u"out"):
 
661
                                    arg.setAttribute(u"name", u"props")
 
662
            xmlstring = document.toxml(u"utf-8")
 
663
            document.unlink()
 
664
        except (AttributeError, xml.dom.DOMException,
 
665
                xml.parsers.expat.ExpatError), error:
 
666
            logger.error(u"Failed to override Introspection method",
 
667
                         error)
 
668
        return xmlstring
 
669
 
 
670
 
 
671
class ClientDBus(Client, DBusObjectWithProperties):
 
672
    """A Client class using D-Bus
 
673
    
 
674
    Attributes:
 
675
    dbus_object_path: dbus.ObjectPath
 
676
    bus: dbus.SystemBus()
 
677
    """
 
678
    # dbus.service.Object doesn't use super(), so we can't either.
 
679
    
 
680
    def __init__(self, bus = None, *args, **kwargs):
 
681
        self.bus = bus
 
682
        Client.__init__(self, *args, **kwargs)
 
683
        # Only now, when this client is initialized, can it show up on
 
684
        # the D-Bus
 
685
        self.dbus_object_path = (dbus.ObjectPath
 
686
                                 (u"/clients/"
 
687
                                  + self.name.replace(u".", u"_")))
 
688
        DBusObjectWithProperties.__init__(self, self.bus,
 
689
                                          self.dbus_object_path)
 
690
    
 
691
    @staticmethod
 
692
    def _datetime_to_dbus(dt, variant_level=0):
 
693
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
694
        return dbus.String(dt.isoformat(),
 
695
                           variant_level=variant_level)
 
696
    
 
697
    def enable(self):
 
698
        oldstate = getattr(self, u"enabled", False)
 
699
        r = Client.enable(self)
 
700
        if oldstate != self.enabled:
 
701
            # Emit D-Bus signals
 
702
            self.PropertyChanged(dbus.String(u"enabled"),
 
703
                                 dbus.Boolean(True, variant_level=1))
 
704
            self.PropertyChanged(
 
705
                dbus.String(u"last_enabled"),
 
706
                self._datetime_to_dbus(self.last_enabled,
 
707
                                       variant_level=1))
 
708
        return r
 
709
    
 
710
    def disable(self, quiet = False):
 
711
        oldstate = getattr(self, u"enabled", False)
 
712
        r = Client.disable(self, quiet=quiet)
 
713
        if not quiet and oldstate != self.enabled:
 
714
            # Emit D-Bus signal
 
715
            self.PropertyChanged(dbus.String(u"enabled"),
 
716
                                 dbus.Boolean(False, variant_level=1))
 
717
        return r
 
718
    
 
719
    def __del__(self, *args, **kwargs):
 
720
        try:
 
721
            self.remove_from_connection()
 
722
        except LookupError:
 
723
            pass
 
724
        if hasattr(DBusObjectWithProperties, u"__del__"):
 
725
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
 
726
        Client.__del__(self, *args, **kwargs)
 
727
    
 
728
    def checker_callback(self, pid, condition, command,
 
729
                         *args, **kwargs):
 
730
        self.checker_callback_tag = None
 
731
        self.checker = None
 
732
        # Emit D-Bus signal
 
733
        self.PropertyChanged(dbus.String(u"checker_running"),
 
734
                             dbus.Boolean(False, variant_level=1))
 
735
        if os.WIFEXITED(condition):
 
736
            exitstatus = os.WEXITSTATUS(condition)
 
737
            # Emit D-Bus signal
 
738
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
739
                                  dbus.Int64(condition),
 
740
                                  dbus.String(command))
 
741
        else:
 
742
            # Emit D-Bus signal
 
743
            self.CheckerCompleted(dbus.Int16(-1),
 
744
                                  dbus.Int64(condition),
 
745
                                  dbus.String(command))
 
746
        
 
747
        return Client.checker_callback(self, pid, condition, command,
 
748
                                       *args, **kwargs)
 
749
    
 
750
    def checked_ok(self, *args, **kwargs):
 
751
        r = Client.checked_ok(self, *args, **kwargs)
 
752
        # Emit D-Bus signal
 
753
        self.PropertyChanged(
 
754
            dbus.String(u"last_checked_ok"),
 
755
            (self._datetime_to_dbus(self.last_checked_ok,
 
756
                                    variant_level=1)))
 
757
        return r
 
758
    
 
759
    def start_checker(self, *args, **kwargs):
 
760
        old_checker = self.checker
 
761
        if self.checker is not None:
 
762
            old_checker_pid = self.checker.pid
 
763
        else:
 
764
            old_checker_pid = None
 
765
        r = Client.start_checker(self, *args, **kwargs)
 
766
        # Only if new checker process was started
 
767
        if (self.checker is not None
 
768
            and old_checker_pid != self.checker.pid):
 
769
            # Emit D-Bus signal
 
770
            self.CheckerStarted(self.current_checker_command)
 
771
            self.PropertyChanged(
 
772
                dbus.String(u"checker_running"),
 
773
                dbus.Boolean(True, variant_level=1))
 
774
        return r
 
775
    
 
776
    def stop_checker(self, *args, **kwargs):
 
777
        old_checker = getattr(self, u"checker", None)
 
778
        r = Client.stop_checker(self, *args, **kwargs)
 
779
        if (old_checker is not None
 
780
            and getattr(self, u"checker", None) is None):
460
781
            self.PropertyChanged(dbus.String(u"checker_running"),
461
782
                                 dbus.Boolean(False, variant_level=1))
462
 
    
463
 
    def still_valid(self):
464
 
        """Has the timeout not yet passed for this client?"""
465
 
        if not getattr(self, "enabled", False):
466
 
            return False
467
 
        now = datetime.datetime.utcnow()
468
 
        if self.last_checked_ok is None:
469
 
            return now < (self.created + self.timeout)
470
 
        else:
471
 
            return now < (self.last_checked_ok + self.timeout)
472
 
    
473
 
    ## D-Bus methods & signals
 
783
        return r
 
784
    
 
785
    ## D-Bus methods, signals & properties
474
786
    _interface = u"se.bsnet.fukt.Mandos.Client"
475
787
    
476
 
    # CheckedOK - method
477
 
    CheckedOK = dbus.service.method(_interface)(checked_ok)
478
 
    CheckedOK.__name__ = "CheckedOK"
 
788
    ## Signals
479
789
    
480
790
    # CheckerCompleted - signal
481
 
    @dbus.service.signal(_interface, signature="nxs")
 
791
    @dbus.service.signal(_interface, signature=u"nxs")
482
792
    def CheckerCompleted(self, exitcode, waitstatus, command):
483
793
        "D-Bus signal"
484
794
        pass
485
795
    
486
796
    # CheckerStarted - signal
487
 
    @dbus.service.signal(_interface, signature="s")
 
797
    @dbus.service.signal(_interface, signature=u"s")
488
798
    def CheckerStarted(self, command):
489
799
        "D-Bus signal"
490
800
        pass
491
801
    
492
 
    # GetAllProperties - method
493
 
    @dbus.service.method(_interface, out_signature="a{sv}")
494
 
    def GetAllProperties(self):
495
 
        "D-Bus method"
496
 
        return dbus.Dictionary({
497
 
                dbus.String("name"):
498
 
                    dbus.String(self.name, variant_level=1),
499
 
                dbus.String("fingerprint"):
500
 
                    dbus.String(self.fingerprint, variant_level=1),
501
 
                dbus.String("host"):
502
 
                    dbus.String(self.host, variant_level=1),
503
 
                dbus.String("created"):
504
 
                    _datetime_to_dbus(self.created, variant_level=1),
505
 
                dbus.String("last_enabled"):
506
 
                    (_datetime_to_dbus(self.last_enabled,
507
 
                                       variant_level=1)
508
 
                     if self.last_enabled is not None
509
 
                     else dbus.Boolean(False, variant_level=1)),
510
 
                dbus.String("enabled"):
511
 
                    dbus.Boolean(self.enabled, variant_level=1),
512
 
                dbus.String("last_checked_ok"):
513
 
                    (_datetime_to_dbus(self.last_checked_ok,
514
 
                                       variant_level=1)
515
 
                     if self.last_checked_ok is not None
516
 
                     else dbus.Boolean (False, variant_level=1)),
517
 
                dbus.String("timeout"):
518
 
                    dbus.UInt64(self.timeout_milliseconds(),
519
 
                                variant_level=1),
520
 
                dbus.String("interval"):
521
 
                    dbus.UInt64(self.interval_milliseconds(),
522
 
                                variant_level=1),
523
 
                dbus.String("checker"):
524
 
                    dbus.String(self.checker_command,
525
 
                                variant_level=1),
526
 
                dbus.String("checker_running"):
527
 
                    dbus.Boolean(self.checker is not None,
528
 
                                 variant_level=1),
529
 
                dbus.String("object_path"):
530
 
                    dbus.ObjectPath(self.dbus_object_path,
531
 
                                    variant_level=1)
532
 
                }, signature="sv")
533
 
    
534
 
    # IsStillValid - method
535
 
    IsStillValid = (dbus.service.method(_interface, out_signature="b")
536
 
                    (still_valid))
537
 
    IsStillValid.__name__ = "IsStillValid"
538
 
    
539
802
    # PropertyChanged - signal
540
 
    @dbus.service.signal(_interface, signature="sv")
 
803
    @dbus.service.signal(_interface, signature=u"sv")
541
804
    def PropertyChanged(self, property, value):
542
805
        "D-Bus signal"
543
806
        pass
544
807
    
545
 
    # SetChecker - method
546
 
    @dbus.service.method(_interface, in_signature="s")
547
 
    def SetChecker(self, checker):
548
 
        "D-Bus setter method"
549
 
        self.checker_command = checker
550
 
        # Emit D-Bus signal
551
 
        self.PropertyChanged(dbus.String(u"checker"),
552
 
                             dbus.String(self.checker_command,
553
 
                                         variant_level=1))
554
 
    
555
 
    # SetHost - method
556
 
    @dbus.service.method(_interface, in_signature="s")
557
 
    def SetHost(self, host):
558
 
        "D-Bus setter method"
559
 
        self.host = host
560
 
        # Emit D-Bus signal
561
 
        self.PropertyChanged(dbus.String(u"host"),
562
 
                             dbus.String(self.host, variant_level=1))
563
 
    
564
 
    # SetInterval - method
565
 
    @dbus.service.method(_interface, in_signature="t")
566
 
    def SetInterval(self, milliseconds):
567
 
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
568
 
        # Emit D-Bus signal
569
 
        self.PropertyChanged(dbus.String(u"interval"),
570
 
                             (dbus.UInt64(self.interval_milliseconds(),
571
 
                                          variant_level=1)))
572
 
    
573
 
    # SetSecret - method
574
 
    @dbus.service.method(_interface, in_signature="ay",
575
 
                         byte_arrays=True)
576
 
    def SetSecret(self, secret):
577
 
        "D-Bus setter method"
578
 
        self.secret = str(secret)
579
 
    
580
 
    # SetTimeout - method
581
 
    @dbus.service.method(_interface, in_signature="t")
582
 
    def SetTimeout(self, milliseconds):
583
 
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
584
 
        # Emit D-Bus signal
585
 
        self.PropertyChanged(dbus.String(u"timeout"),
586
 
                             (dbus.UInt64(self.timeout_milliseconds(),
587
 
                                          variant_level=1)))
 
808
    # GotSecret - signal
 
809
    @dbus.service.signal(_interface)
 
810
    def GotSecret(self):
 
811
        "D-Bus signal"
 
812
        pass
 
813
    
 
814
    # Rejected - signal
 
815
    @dbus.service.signal(_interface)
 
816
    def Rejected(self):
 
817
        "D-Bus signal"
 
818
        pass
 
819
    
 
820
    ## Methods
 
821
    
 
822
    # CheckedOK - method
 
823
    @dbus.service.method(_interface)
 
824
    def CheckedOK(self):
 
825
        return self.checked_ok()
588
826
    
589
827
    # Enable - method
590
 
    Enable = dbus.service.method(_interface)(enable)
591
 
    Enable.__name__ = "Enable"
 
828
    @dbus.service.method(_interface)
 
829
    def Enable(self):
 
830
        "D-Bus method"
 
831
        self.enable()
592
832
    
593
833
    # StartChecker - method
594
834
    @dbus.service.method(_interface)
603
843
        self.disable()
604
844
    
605
845
    # StopChecker - method
606
 
    StopChecker = dbus.service.method(_interface)(stop_checker)
607
 
    StopChecker.__name__ = "StopChecker"
 
846
    @dbus.service.method(_interface)
 
847
    def StopChecker(self):
 
848
        self.stop_checker()
 
849
    
 
850
    ## Properties
 
851
    
 
852
    # name - property
 
853
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
854
    def name_dbus_property(self):
 
855
        return dbus.String(self.name)
 
856
    
 
857
    # fingerprint - property
 
858
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
859
    def fingerprint_dbus_property(self):
 
860
        return dbus.String(self.fingerprint)
 
861
    
 
862
    # host - property
 
863
    @dbus_service_property(_interface, signature=u"s",
 
864
                           access=u"readwrite")
 
865
    def host_dbus_property(self, value=None):
 
866
        if value is None:       # get
 
867
            return dbus.String(self.host)
 
868
        self.host = value
 
869
        # Emit D-Bus signal
 
870
        self.PropertyChanged(dbus.String(u"host"),
 
871
                             dbus.String(value, variant_level=1))
 
872
    
 
873
    # created - property
 
874
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
875
    def created_dbus_property(self):
 
876
        return dbus.String(self._datetime_to_dbus(self.created))
 
877
    
 
878
    # last_enabled - property
 
879
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
880
    def last_enabled_dbus_property(self):
 
881
        if self.last_enabled is None:
 
882
            return dbus.String(u"")
 
883
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
884
    
 
885
    # enabled - property
 
886
    @dbus_service_property(_interface, signature=u"b",
 
887
                           access=u"readwrite")
 
888
    def enabled_dbus_property(self, value=None):
 
889
        if value is None:       # get
 
890
            return dbus.Boolean(self.enabled)
 
891
        if value:
 
892
            self.enable()
 
893
        else:
 
894
            self.disable()
 
895
    
 
896
    # last_checked_ok - property
 
897
    @dbus_service_property(_interface, signature=u"s",
 
898
                           access=u"readwrite")
 
899
    def last_checked_ok_dbus_property(self, value=None):
 
900
        if value is not None:
 
901
            self.checked_ok()
 
902
            return
 
903
        if self.last_checked_ok is None:
 
904
            return dbus.String(u"")
 
905
        return dbus.String(self._datetime_to_dbus(self
 
906
                                                  .last_checked_ok))
 
907
    
 
908
    # timeout - property
 
909
    @dbus_service_property(_interface, signature=u"t",
 
910
                           access=u"readwrite")
 
911
    def timeout_dbus_property(self, value=None):
 
912
        if value is None:       # get
 
913
            return dbus.UInt64(self.timeout_milliseconds())
 
914
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
915
        # Emit D-Bus signal
 
916
        self.PropertyChanged(dbus.String(u"timeout"),
 
917
                             dbus.UInt64(value, variant_level=1))
 
918
        if getattr(self, u"disable_initiator_tag", None) is None:
 
919
            return
 
920
        # Reschedule timeout
 
921
        gobject.source_remove(self.disable_initiator_tag)
 
922
        self.disable_initiator_tag = None
 
923
        time_to_die = (self.
 
924
                       _timedelta_to_milliseconds((self
 
925
                                                   .last_checked_ok
 
926
                                                   + self.timeout)
 
927
                                                  - datetime.datetime
 
928
                                                  .utcnow()))
 
929
        if time_to_die <= 0:
 
930
            # The timeout has passed
 
931
            self.disable()
 
932
        else:
 
933
            self.disable_initiator_tag = (gobject.timeout_add
 
934
                                          (time_to_die, self.disable))
 
935
    
 
936
    # interval - property
 
937
    @dbus_service_property(_interface, signature=u"t",
 
938
                           access=u"readwrite")
 
939
    def interval_dbus_property(self, value=None):
 
940
        if value is None:       # get
 
941
            return dbus.UInt64(self.interval_milliseconds())
 
942
        self.interval = datetime.timedelta(0, 0, 0, value)
 
943
        # Emit D-Bus signal
 
944
        self.PropertyChanged(dbus.String(u"interval"),
 
945
                             dbus.UInt64(value, variant_level=1))
 
946
        if getattr(self, u"checker_initiator_tag", None) is None:
 
947
            return
 
948
        # Reschedule checker run
 
949
        gobject.source_remove(self.checker_initiator_tag)
 
950
        self.checker_initiator_tag = (gobject.timeout_add
 
951
                                      (value, self.start_checker))
 
952
        self.start_checker()    # Start one now, too
 
953
 
 
954
    # checker - property
 
955
    @dbus_service_property(_interface, signature=u"s",
 
956
                           access=u"readwrite")
 
957
    def checker_dbus_property(self, value=None):
 
958
        if value is None:       # get
 
959
            return dbus.String(self.checker_command)
 
960
        self.checker_command = value
 
961
        # Emit D-Bus signal
 
962
        self.PropertyChanged(dbus.String(u"checker"),
 
963
                             dbus.String(self.checker_command,
 
964
                                         variant_level=1))
 
965
    
 
966
    # checker_running - property
 
967
    @dbus_service_property(_interface, signature=u"b",
 
968
                           access=u"readwrite")
 
969
    def checker_running_dbus_property(self, value=None):
 
970
        if value is None:       # get
 
971
            return dbus.Boolean(self.checker is not None)
 
972
        if value:
 
973
            self.start_checker()
 
974
        else:
 
975
            self.stop_checker()
 
976
    
 
977
    # object_path - property
 
978
    @dbus_service_property(_interface, signature=u"o", access=u"read")
 
979
    def object_path_dbus_property(self):
 
980
        return self.dbus_object_path # is already a dbus.ObjectPath
 
981
    
 
982
    # secret = property
 
983
    @dbus_service_property(_interface, signature=u"ay",
 
984
                           access=u"write", byte_arrays=True)
 
985
    def secret_dbus_property(self, value):
 
986
        self.secret = str(value)
608
987
    
609
988
    del _interface
610
989
 
611
990
 
612
 
def peer_certificate(session):
613
 
    "Return the peer's OpenPGP certificate as a bytestring"
614
 
    # If not an OpenPGP certificate...
615
 
    if (gnutls.library.functions
616
 
        .gnutls_certificate_type_get(session._c_object)
617
 
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
618
 
        # ...do the normal thing
619
 
        return session.peer_certificate
620
 
    list_size = ctypes.c_uint(1)
621
 
    cert_list = (gnutls.library.functions
622
 
                 .gnutls_certificate_get_peers
623
 
                 (session._c_object, ctypes.byref(list_size)))
624
 
    if not bool(cert_list) and list_size.value != 0:
625
 
        raise gnutls.errors.GNUTLSError("error getting peer"
626
 
                                        " certificate")
627
 
    if list_size.value == 0:
628
 
        return None
629
 
    cert = cert_list[0]
630
 
    return ctypes.string_at(cert.data, cert.size)
631
 
 
632
 
 
633
 
def fingerprint(openpgp):
634
 
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
635
 
    # New GnuTLS "datum" with the OpenPGP public key
636
 
    datum = (gnutls.library.types
637
 
             .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
638
 
                                         ctypes.POINTER
639
 
                                         (ctypes.c_ubyte)),
640
 
                             ctypes.c_uint(len(openpgp))))
641
 
    # New empty GnuTLS certificate
642
 
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
643
 
    (gnutls.library.functions
644
 
     .gnutls_openpgp_crt_init(ctypes.byref(crt)))
645
 
    # Import the OpenPGP public key into the certificate
646
 
    (gnutls.library.functions
647
 
     .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
 
                                gnutls.library.constants
649
 
                                .GNUTLS_OPENPGP_FMT_RAW))
650
 
    # Verify the self signature in the key
651
 
    crtverify = ctypes.c_uint()
652
 
    (gnutls.library.functions
653
 
     .gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
654
 
    if crtverify.value != 0:
655
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
656
 
        raise gnutls.errors.CertificateSecurityError("Verify failed")
657
 
    # New buffer for the fingerprint
658
 
    buf = ctypes.create_string_buffer(20)
659
 
    buf_len = ctypes.c_size_t()
660
 
    # Get the fingerprint from the certificate into the buffer
661
 
    (gnutls.library.functions
662
 
     .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
 
                                         ctypes.byref(buf_len)))
664
 
    # Deinit the certificate
665
 
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
666
 
    # Convert the buffer to a Python bytestring
667
 
    fpr = ctypes.string_at(buf, buf_len.value)
668
 
    # Convert the bytestring to hexadecimal notation
669
 
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
670
 
    return hex_fpr
671
 
 
672
 
 
673
 
class TCP_handler(SocketServer.BaseRequestHandler, object):
674
 
    """A TCP request handler class.
675
 
    Instantiated by IPv6_TCPServer for each request to handle it.
 
991
class ClientHandler(socketserver.BaseRequestHandler, object):
 
992
    """A class to handle client connections.
 
993
    
 
994
    Instantiated once for each connection to handle it.
676
995
    Note: This will run in its own forked process."""
677
996
    
678
997
    def handle(self):
679
998
        logger.info(u"TCP connection from: %s",
680
999
                    unicode(self.client_address))
681
 
        session = (gnutls.connection
682
 
                   .ClientSession(self.request,
683
 
                                  gnutls.connection
684
 
                                  .X509Credentials()))
685
 
        
686
 
        line = self.request.makefile().readline()
687
 
        logger.debug(u"Protocol version: %r", line)
688
 
        try:
689
 
            if int(line.strip().split()[0]) > 1:
690
 
                raise RuntimeError
691
 
        except (ValueError, IndexError, RuntimeError), error:
692
 
            logger.error(u"Unknown protocol version: %s", error)
693
 
            return
694
 
        
695
 
        # Note: gnutls.connection.X509Credentials is really a generic
696
 
        # GnuTLS certificate credentials object so long as no X.509
697
 
        # keys are added to it.  Therefore, we can use it here despite
698
 
        # using OpenPGP certificates.
699
 
        
700
 
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
701
 
        #                     "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
702
 
        #                     "+DHE-DSS"))
703
 
        # Use a fallback default, since this MUST be set.
704
 
        priority = self.server.settings.get("priority", "NORMAL")
705
 
        (gnutls.library.functions
706
 
         .gnutls_priority_set_direct(session._c_object,
707
 
                                     priority, None))
708
 
        
709
 
        try:
710
 
            session.handshake()
711
 
        except gnutls.errors.GNUTLSError, error:
712
 
            logger.warning(u"Handshake failed: %s", error)
713
 
            # Do not run session.bye() here: the session is not
714
 
            # established.  Just abandon the request.
715
 
            return
716
 
        logger.debug(u"Handshake succeeded")
717
 
        try:
718
 
            fpr = fingerprint(peer_certificate(session))
719
 
        except (TypeError, gnutls.errors.GNUTLSError), error:
720
 
            logger.warning(u"Bad certificate: %s", error)
721
 
            session.bye()
722
 
            return
723
 
        logger.debug(u"Fingerprint: %s", fpr)
724
 
        
725
 
        for c in self.server.clients:
726
 
            if c.fingerprint == fpr:
727
 
                client = c
728
 
                break
729
 
        else:
730
 
            logger.warning(u"Client not found for fingerprint: %s",
731
 
                           fpr)
732
 
            session.bye()
733
 
            return
734
 
        # Have to check if client.still_valid(), since it is possible
735
 
        # that the client timed out while establishing the GnuTLS
736
 
        # session.
737
 
        if not client.still_valid():
738
 
            logger.warning(u"Client %(name)s is invalid",
739
 
                           vars(client))
740
 
            session.bye()
741
 
            return
742
 
        ## This won't work here, since we're in a fork.
743
 
        # client.checked_ok()
744
 
        sent_size = 0
745
 
        while sent_size < len(client.secret):
746
 
            sent = session.send(client.secret[sent_size:])
747
 
            logger.debug(u"Sent: %d, remaining: %d",
748
 
                         sent, len(client.secret)
749
 
                         - (sent_size + sent))
750
 
            sent_size += sent
751
 
        session.bye()
752
 
 
753
 
 
754
 
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
 
                     SocketServer.TCPServer, object):
 
1000
        logger.debug(u"IPC Pipe FD: %d",
 
1001
                     self.server.child_pipe[1].fileno())
 
1002
        # Open IPC pipe to parent process
 
1003
        with contextlib.nested(self.server.child_pipe[1],
 
1004
                               self.server.parent_pipe[0]
 
1005
                               ) as (ipc, ipc_return):
 
1006
            session = (gnutls.connection
 
1007
                       .ClientSession(self.request,
 
1008
                                      gnutls.connection
 
1009
                                      .X509Credentials()))
 
1010
            
 
1011
            # Note: gnutls.connection.X509Credentials is really a
 
1012
            # generic GnuTLS certificate credentials object so long as
 
1013
            # no X.509 keys are added to it.  Therefore, we can use it
 
1014
            # here despite using OpenPGP certificates.
 
1015
            
 
1016
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
 
1017
            #                      u"+AES-256-CBC", u"+SHA1",
 
1018
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
 
1019
            #                      u"+DHE-DSS"))
 
1020
            # Use a fallback default, since this MUST be set.
 
1021
            priority = self.server.gnutls_priority
 
1022
            if priority is None:
 
1023
                priority = u"NORMAL"
 
1024
            (gnutls.library.functions
 
1025
             .gnutls_priority_set_direct(session._c_object,
 
1026
                                         priority, None))
 
1027
            
 
1028
            # Start communication using the Mandos protocol
 
1029
            # Get protocol number
 
1030
            line = self.request.makefile().readline()
 
1031
            logger.debug(u"Protocol version: %r", line)
 
1032
            try:
 
1033
                if int(line.strip().split()[0]) > 1:
 
1034
                    raise RuntimeError
 
1035
            except (ValueError, IndexError, RuntimeError), error:
 
1036
                logger.error(u"Unknown protocol version: %s", error)
 
1037
                return
 
1038
            
 
1039
            # Start GnuTLS connection
 
1040
            try:
 
1041
                session.handshake()
 
1042
            except gnutls.errors.GNUTLSError, error:
 
1043
                logger.warning(u"Handshake failed: %s", error)
 
1044
                # Do not run session.bye() here: the session is not
 
1045
                # established.  Just abandon the request.
 
1046
                return
 
1047
            logger.debug(u"Handshake succeeded")
 
1048
            try:
 
1049
                try:
 
1050
                    fpr = self.fingerprint(self.peer_certificate
 
1051
                                           (session))
 
1052
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1053
                    logger.warning(u"Bad certificate: %s", error)
 
1054
                    return
 
1055
                logger.debug(u"Fingerprint: %s", fpr)
 
1056
 
 
1057
                for c in self.server.clients:
 
1058
                    if c.fingerprint == fpr:
 
1059
                        client = c
 
1060
                        break
 
1061
                else:
 
1062
                    ipc.write(u"NOTFOUND %s %s\n"
 
1063
                              % (fpr, unicode(self.client_address)))
 
1064
                    return
 
1065
                
 
1066
                class ClientProxy(object):
 
1067
                    """Client proxy object.  Not for calling methods."""
 
1068
                    def __init__(self, client):
 
1069
                        self.client = client
 
1070
                    def __getattr__(self, name):
 
1071
                        if name.startswith("ipc_"):
 
1072
                            def tempfunc():
 
1073
                                ipc.write("%s %s\n" % (name[4:].upper(),
 
1074
                                                       self.client.name))
 
1075
                            return tempfunc
 
1076
                        if not hasattr(self.client, name):
 
1077
                            raise AttributeError
 
1078
                        ipc.write(u"GETATTR %s %s\n"
 
1079
                                  % (name, self.client.fingerprint))
 
1080
                        return pickle.load(ipc_return)
 
1081
                clientproxy = ClientProxy(client)
 
1082
                # Have to check if client.enabled, since it is
 
1083
                # possible that the client was disabled since the
 
1084
                # GnuTLS session was established.
 
1085
                if not clientproxy.enabled:
 
1086
                    clientproxy.ipc_disabled()
 
1087
                    return
 
1088
                
 
1089
                clientproxy.ipc_sending()
 
1090
                sent_size = 0
 
1091
                while sent_size < len(client.secret):
 
1092
                    sent = session.send(client.secret[sent_size:])
 
1093
                    logger.debug(u"Sent: %d, remaining: %d",
 
1094
                                 sent, len(client.secret)
 
1095
                                 - (sent_size + sent))
 
1096
                    sent_size += sent
 
1097
            finally:
 
1098
                session.bye()
 
1099
    
 
1100
    @staticmethod
 
1101
    def peer_certificate(session):
 
1102
        "Return the peer's OpenPGP certificate as a bytestring"
 
1103
        # If not an OpenPGP certificate...
 
1104
        if (gnutls.library.functions
 
1105
            .gnutls_certificate_type_get(session._c_object)
 
1106
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1107
            # ...do the normal thing
 
1108
            return session.peer_certificate
 
1109
        list_size = ctypes.c_uint(1)
 
1110
        cert_list = (gnutls.library.functions
 
1111
                     .gnutls_certificate_get_peers
 
1112
                     (session._c_object, ctypes.byref(list_size)))
 
1113
        if not bool(cert_list) and list_size.value != 0:
 
1114
            raise gnutls.errors.GNUTLSError(u"error getting peer"
 
1115
                                            u" certificate")
 
1116
        if list_size.value == 0:
 
1117
            return None
 
1118
        cert = cert_list[0]
 
1119
        return ctypes.string_at(cert.data, cert.size)
 
1120
    
 
1121
    @staticmethod
 
1122
    def fingerprint(openpgp):
 
1123
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
 
1124
        # New GnuTLS "datum" with the OpenPGP public key
 
1125
        datum = (gnutls.library.types
 
1126
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1127
                                             ctypes.POINTER
 
1128
                                             (ctypes.c_ubyte)),
 
1129
                                 ctypes.c_uint(len(openpgp))))
 
1130
        # New empty GnuTLS certificate
 
1131
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1132
        (gnutls.library.functions
 
1133
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1134
        # Import the OpenPGP public key into the certificate
 
1135
        (gnutls.library.functions
 
1136
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1137
                                    gnutls.library.constants
 
1138
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1139
        # Verify the self signature in the key
 
1140
        crtverify = ctypes.c_uint()
 
1141
        (gnutls.library.functions
 
1142
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1143
                                         ctypes.byref(crtverify)))
 
1144
        if crtverify.value != 0:
 
1145
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1146
            raise (gnutls.errors.CertificateSecurityError
 
1147
                   (u"Verify failed"))
 
1148
        # New buffer for the fingerprint
 
1149
        buf = ctypes.create_string_buffer(20)
 
1150
        buf_len = ctypes.c_size_t()
 
1151
        # Get the fingerprint from the certificate into the buffer
 
1152
        (gnutls.library.functions
 
1153
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1154
                                             ctypes.byref(buf_len)))
 
1155
        # Deinit the certificate
 
1156
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1157
        # Convert the buffer to a Python bytestring
 
1158
        fpr = ctypes.string_at(buf, buf_len.value)
 
1159
        # Convert the bytestring to hexadecimal notation
 
1160
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1161
        return hex_fpr
 
1162
 
 
1163
 
 
1164
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
 
1165
    """Like socketserver.ForkingMixIn, but also pass a pipe pair."""
 
1166
    def process_request(self, request, client_address):
 
1167
        """Overrides and wraps the original process_request().
 
1168
        
 
1169
        This function creates a new pipe in self.pipe
 
1170
        """
 
1171
        # Child writes to child_pipe
 
1172
        self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
 
1173
        # Parent writes to parent_pipe
 
1174
        self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
 
1175
        super(ForkingMixInWithPipes,
 
1176
              self).process_request(request, client_address)
 
1177
        # Close unused ends for parent
 
1178
        self.parent_pipe[0].close() # close read end
 
1179
        self.child_pipe[1].close()  # close write end
 
1180
        self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
 
1181
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
 
1182
        """Dummy function; override as necessary"""
 
1183
        child_pipe_fd.close()
 
1184
        parent_pipe_fd.close()
 
1185
 
 
1186
 
 
1187
class IPv6_TCPServer(ForkingMixInWithPipes,
 
1188
                     socketserver.TCPServer, object):
756
1189
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
1190
    
757
1191
    Attributes:
758
 
        settings:       Server settings
759
 
        clients:        Set() of Client objects
760
1192
        enabled:        Boolean; whether this server is activated yet
 
1193
        interface:      None or a network interface name (string)
 
1194
        use_ipv6:       Boolean; to use IPv6 or not
761
1195
    """
762
 
    address_family = socket.AF_INET6
763
 
    def __init__(self, *args, **kwargs):
764
 
        if "settings" in kwargs:
765
 
            self.settings = kwargs["settings"]
766
 
            del kwargs["settings"]
767
 
        if "clients" in kwargs:
768
 
            self.clients = kwargs["clients"]
769
 
            del kwargs["clients"]
770
 
        if "use_ipv6" in kwargs:
771
 
            if not kwargs["use_ipv6"]:
772
 
                self.address_family = socket.AF_INET
773
 
            del kwargs["use_ipv6"]
774
 
        self.enabled = False
775
 
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
 
1196
    def __init__(self, server_address, RequestHandlerClass,
 
1197
                 interface=None, use_ipv6=True):
 
1198
        self.interface = interface
 
1199
        if use_ipv6:
 
1200
            self.address_family = socket.AF_INET6
 
1201
        socketserver.TCPServer.__init__(self, server_address,
 
1202
                                        RequestHandlerClass)
776
1203
    def server_bind(self):
777
1204
        """This overrides the normal server_bind() function
778
1205
        to bind to an interface if one was specified, and also NOT to
779
1206
        bind to an address or port if they were not specified."""
780
 
        if self.settings["interface"]:
781
 
            # 25 is from /usr/include/asm-i486/socket.h
782
 
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
783
 
            try:
784
 
                self.socket.setsockopt(socket.SOL_SOCKET,
785
 
                                       SO_BINDTODEVICE,
786
 
                                       self.settings["interface"])
787
 
            except socket.error, error:
788
 
                if error[0] == errno.EPERM:
789
 
                    logger.error(u"No permission to"
790
 
                                 u" bind to interface %s",
791
 
                                 self.settings["interface"])
792
 
                else:
793
 
                    raise
 
1207
        if self.interface is not None:
 
1208
            if SO_BINDTODEVICE is None:
 
1209
                logger.error(u"SO_BINDTODEVICE does not exist;"
 
1210
                             u" cannot bind to interface %s",
 
1211
                             self.interface)
 
1212
            else:
 
1213
                try:
 
1214
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1215
                                           SO_BINDTODEVICE,
 
1216
                                           str(self.interface
 
1217
                                               + u'\0'))
 
1218
                except socket.error, error:
 
1219
                    if error[0] == errno.EPERM:
 
1220
                        logger.error(u"No permission to"
 
1221
                                     u" bind to interface %s",
 
1222
                                     self.interface)
 
1223
                    elif error[0] == errno.ENOPROTOOPT:
 
1224
                        logger.error(u"SO_BINDTODEVICE not available;"
 
1225
                                     u" cannot bind to interface %s",
 
1226
                                     self.interface)
 
1227
                    else:
 
1228
                        raise
794
1229
        # Only bind(2) the socket if we really need to.
795
1230
        if self.server_address[0] or self.server_address[1]:
796
1231
            if not self.server_address[0]:
797
1232
                if self.address_family == socket.AF_INET6:
798
 
                    any_address = "::" # in6addr_any
 
1233
                    any_address = u"::" # in6addr_any
799
1234
                else:
800
1235
                    any_address = socket.INADDR_ANY
801
1236
                self.server_address = (any_address,
803
1238
            elif not self.server_address[1]:
804
1239
                self.server_address = (self.server_address[0],
805
1240
                                       0)
806
 
#                 if self.settings["interface"]:
 
1241
#                 if self.interface:
807
1242
#                     self.server_address = (self.server_address[0],
808
1243
#                                            0, # port
809
1244
#                                            0, # flowinfo
810
1245
#                                            if_nametoindex
811
 
#                                            (self.settings
812
 
#                                             ["interface"]))
813
 
            return super(IPv6_TCPServer, self).server_bind()
 
1246
#                                            (self.interface))
 
1247
            return socketserver.TCPServer.server_bind(self)
 
1248
 
 
1249
 
 
1250
class MandosServer(IPv6_TCPServer):
 
1251
    """Mandos server.
 
1252
    
 
1253
    Attributes:
 
1254
        clients:        set of Client objects
 
1255
        gnutls_priority GnuTLS priority string
 
1256
        use_dbus:       Boolean; to emit D-Bus signals or not
 
1257
    
 
1258
    Assumes a gobject.MainLoop event loop.
 
1259
    """
 
1260
    def __init__(self, server_address, RequestHandlerClass,
 
1261
                 interface=None, use_ipv6=True, clients=None,
 
1262
                 gnutls_priority=None, use_dbus=True):
 
1263
        self.enabled = False
 
1264
        self.clients = clients
 
1265
        if self.clients is None:
 
1266
            self.clients = set()
 
1267
        self.use_dbus = use_dbus
 
1268
        self.gnutls_priority = gnutls_priority
 
1269
        IPv6_TCPServer.__init__(self, server_address,
 
1270
                                RequestHandlerClass,
 
1271
                                interface = interface,
 
1272
                                use_ipv6 = use_ipv6)
814
1273
    def server_activate(self):
815
1274
        if self.enabled:
816
 
            return super(IPv6_TCPServer, self).server_activate()
 
1275
            return socketserver.TCPServer.server_activate(self)
817
1276
    def enable(self):
818
1277
        self.enabled = True
 
1278
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
 
1279
        # Call "handle_ipc" for both data and EOF events
 
1280
        gobject.io_add_watch(child_pipe_fd.fileno(),
 
1281
                             gobject.IO_IN | gobject.IO_HUP,
 
1282
                             functools.partial(self.handle_ipc,
 
1283
                                               reply = parent_pipe_fd,
 
1284
                                               sender= child_pipe_fd))
 
1285
    def handle_ipc(self, source, condition, reply=None, sender=None):
 
1286
        condition_names = {
 
1287
            gobject.IO_IN: u"IN",   # There is data to read.
 
1288
            gobject.IO_OUT: u"OUT", # Data can be written (without
 
1289
                                    # blocking).
 
1290
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
 
1291
            gobject.IO_ERR: u"ERR", # Error condition.
 
1292
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
 
1293
                                    # broken, usually for pipes and
 
1294
                                    # sockets).
 
1295
            }
 
1296
        conditions_string = ' | '.join(name
 
1297
                                       for cond, name in
 
1298
                                       condition_names.iteritems()
 
1299
                                       if cond & condition)
 
1300
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
 
1301
                     conditions_string)
 
1302
        
 
1303
        # Read a line from the file object
 
1304
        cmdline = sender.readline()
 
1305
        if not cmdline:             # Empty line means end of file
 
1306
            # close the IPC pipes
 
1307
            sender.close()
 
1308
            reply.close()
 
1309
            
 
1310
            # Stop calling this function
 
1311
            return False
 
1312
        
 
1313
        logger.debug(u"IPC command: %r", cmdline)
 
1314
        
 
1315
        # Parse and act on command
 
1316
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
 
1317
        
 
1318
        if cmd == u"NOTFOUND":
 
1319
            fpr, address = args.split(None, 1)
 
1320
            logger.warning(u"Client not found for fingerprint: %s, ad"
 
1321
                           u"dress: %s", fpr, address)
 
1322
            if self.use_dbus:
 
1323
                # Emit D-Bus signal
 
1324
                mandos_dbus_service.ClientNotFound(fpr, address)
 
1325
        elif cmd == u"DISABLED":
 
1326
            for client in self.clients:
 
1327
                if client.name == args:
 
1328
                    logger.warning(u"Client %s is disabled", args)
 
1329
                    if self.use_dbus:
 
1330
                        # Emit D-Bus signal
 
1331
                        client.Rejected()
 
1332
                    break
 
1333
            else:
 
1334
                logger.error(u"Unknown client %s is disabled", args)
 
1335
        elif cmd == u"SENDING":
 
1336
            for client in self.clients:
 
1337
                if client.name == args:
 
1338
                    logger.info(u"Sending secret to %s", client.name)
 
1339
                    client.checked_ok()
 
1340
                    if self.use_dbus:
 
1341
                        # Emit D-Bus signal
 
1342
                        client.GotSecret()
 
1343
                    break
 
1344
            else:
 
1345
                logger.error(u"Sending secret to unknown client %s",
 
1346
                             args)
 
1347
        elif cmd == u"GETATTR":
 
1348
            attr_name, fpr = args.split(None, 1)
 
1349
            for client in self.clients:
 
1350
                if client.fingerprint == fpr:
 
1351
                    attr_value = getattr(client, attr_name, None)
 
1352
                    logger.debug("IPC reply: %r", attr_value)
 
1353
                    pickle.dump(attr_value, reply)
 
1354
                    break
 
1355
            else:
 
1356
                logger.error(u"Client %s on address %s requesting "
 
1357
                             u"attribute %s not found", fpr, address,
 
1358
                             attr_name)
 
1359
                pickle.dump(None, reply)
 
1360
        else:
 
1361
            logger.error(u"Unknown IPC command: %r", cmdline)
 
1362
        
 
1363
        # Keep calling this function
 
1364
        return True
819
1365
 
820
1366
 
821
1367
def string_to_delta(interval):
822
1368
    """Parse a string and return a datetime.timedelta
823
1369
    
824
 
    >>> string_to_delta('7d')
 
1370
    >>> string_to_delta(u'7d')
825
1371
    datetime.timedelta(7)
826
 
    >>> string_to_delta('60s')
 
1372
    >>> string_to_delta(u'60s')
827
1373
    datetime.timedelta(0, 60)
828
 
    >>> string_to_delta('60m')
 
1374
    >>> string_to_delta(u'60m')
829
1375
    datetime.timedelta(0, 3600)
830
 
    >>> string_to_delta('24h')
 
1376
    >>> string_to_delta(u'24h')
831
1377
    datetime.timedelta(1)
832
1378
    >>> string_to_delta(u'1w')
833
1379
    datetime.timedelta(7)
834
 
    >>> string_to_delta('5m 30s')
 
1380
    >>> string_to_delta(u'5m 30s')
835
1381
    datetime.timedelta(0, 330)
836
1382
    """
837
1383
    timevalue = datetime.timedelta(0)
850
1396
            elif suffix == u"w":
851
1397
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
852
1398
            else:
853
 
                raise ValueError
854
 
        except (ValueError, IndexError):
855
 
            raise ValueError
 
1399
                raise ValueError(u"Unknown suffix %r" % suffix)
 
1400
        except (ValueError, IndexError), e:
 
1401
            raise ValueError(e.message)
856
1402
        timevalue += delta
857
1403
    return timevalue
858
1404
 
859
1405
 
860
 
def server_state_changed(state):
861
 
    """Derived from the Avahi example code"""
862
 
    if state == avahi.SERVER_COLLISION:
863
 
        logger.error(u"Zeroconf server name collision")
864
 
        service.remove()
865
 
    elif state == avahi.SERVER_RUNNING:
866
 
        service.add()
867
 
 
868
 
 
869
 
def entry_group_state_changed(state, error):
870
 
    """Derived from the Avahi example code"""
871
 
    logger.debug(u"Avahi state change: %i", state)
872
 
    
873
 
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
874
 
        logger.debug(u"Zeroconf service established.")
875
 
    elif state == avahi.ENTRY_GROUP_COLLISION:
876
 
        logger.warning(u"Zeroconf service name collision.")
877
 
        service.rename()
878
 
    elif state == avahi.ENTRY_GROUP_FAILURE:
879
 
        logger.critical(u"Avahi: Error in group state changed %s",
880
 
                        unicode(error))
881
 
        raise AvahiGroupError(u"State changed: %s" % unicode(error))
882
 
 
883
1406
def if_nametoindex(interface):
884
 
    """Call the C function if_nametoindex(), or equivalent"""
 
1407
    """Call the C function if_nametoindex(), or equivalent
 
1408
    
 
1409
    Note: This function cannot accept a unicode string."""
885
1410
    global if_nametoindex
886
1411
    try:
887
1412
        if_nametoindex = (ctypes.cdll.LoadLibrary
888
 
                          (ctypes.util.find_library("c"))
 
1413
                          (ctypes.util.find_library(u"c"))
889
1414
                          .if_nametoindex)
890
1415
    except (OSError, AttributeError):
891
 
        if "struct" not in sys.modules:
892
 
            import struct
893
 
        if "fcntl" not in sys.modules:
894
 
            import fcntl
 
1416
        logger.warning(u"Doing if_nametoindex the hard way")
895
1417
        def if_nametoindex(interface):
896
1418
            "Get an interface index the hard way, i.e. using fcntl()"
897
1419
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
898
 
            with closing(socket.socket()) as s:
 
1420
            with contextlib.closing(socket.socket()) as s:
899
1421
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
900
 
                                    struct.pack("16s16x", interface))
901
 
            interface_index = struct.unpack("I", ifreq[16:20])[0]
 
1422
                                    struct.pack(str(u"16s16x"),
 
1423
                                                interface))
 
1424
            interface_index = struct.unpack(str(u"I"),
 
1425
                                            ifreq[16:20])[0]
902
1426
            return interface_index
903
1427
    return if_nametoindex(interface)
904
1428
 
905
1429
 
906
1430
def daemon(nochdir = False, noclose = False):
907
1431
    """See daemon(3).  Standard BSD Unix function.
 
1432
    
908
1433
    This should really exist as os.daemon, but it doesn't (yet)."""
909
1434
    if os.fork():
910
1435
        sys.exit()
911
1436
    os.setsid()
912
1437
    if not nochdir:
913
 
        os.chdir("/")
 
1438
        os.chdir(u"/")
914
1439
    if os.fork():
915
1440
        sys.exit()
916
1441
    if not noclose:
918
1443
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
919
1444
        if not stat.S_ISCHR(os.fstat(null).st_mode):
920
1445
            raise OSError(errno.ENODEV,
921
 
                          "/dev/null not a character device")
 
1446
                          u"%s not a character device"
 
1447
                          % os.path.devnull)
922
1448
        os.dup2(null, sys.stdin.fileno())
923
1449
        os.dup2(null, sys.stdout.fileno())
924
1450
        os.dup2(null, sys.stderr.fileno())
927
1453
 
928
1454
 
929
1455
def main():
 
1456
    
 
1457
    ##################################################################
 
1458
    # Parsing of options, both command line and config file
 
1459
    
930
1460
    parser = optparse.OptionParser(version = "%%prog %s" % version)
931
 
    parser.add_option("-i", "--interface", type="string",
932
 
                      metavar="IF", help="Bind to interface IF")
933
 
    parser.add_option("-a", "--address", type="string",
934
 
                      help="Address to listen for requests on")
935
 
    parser.add_option("-p", "--port", type="int",
936
 
                      help="Port number to receive requests on")
937
 
    parser.add_option("--check", action="store_true",
938
 
                      help="Run self-test")
939
 
    parser.add_option("--debug", action="store_true",
940
 
                      help="Debug mode; run in foreground and log to"
941
 
                      " terminal")
942
 
    parser.add_option("--priority", type="string", help="GnuTLS"
943
 
                      " priority string (see GnuTLS documentation)")
944
 
    parser.add_option("--servicename", type="string", metavar="NAME",
945
 
                      help="Zeroconf service name")
946
 
    parser.add_option("--configdir", type="string",
947
 
                      default="/etc/mandos", metavar="DIR",
948
 
                      help="Directory to search for configuration"
949
 
                      " files")
950
 
    parser.add_option("--no-dbus", action="store_false",
951
 
                      dest="use_dbus",
952
 
                      help=optparse.SUPPRESS_HELP) # XXX: Not done yet
953
 
    parser.add_option("--no-ipv6", action="store_false",
954
 
                      dest="use_ipv6", help="Do not use IPv6")
 
1461
    parser.add_option("-i", u"--interface", type=u"string",
 
1462
                      metavar="IF", help=u"Bind to interface IF")
 
1463
    parser.add_option("-a", u"--address", type=u"string",
 
1464
                      help=u"Address to listen for requests on")
 
1465
    parser.add_option("-p", u"--port", type=u"int",
 
1466
                      help=u"Port number to receive requests on")
 
1467
    parser.add_option("--check", action=u"store_true",
 
1468
                      help=u"Run self-test")
 
1469
    parser.add_option("--debug", action=u"store_true",
 
1470
                      help=u"Debug mode; run in foreground and log to"
 
1471
                      u" terminal")
 
1472
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
 
1473
                      u" priority string (see GnuTLS documentation)")
 
1474
    parser.add_option("--servicename", type=u"string",
 
1475
                      metavar=u"NAME", help=u"Zeroconf service name")
 
1476
    parser.add_option("--configdir", type=u"string",
 
1477
                      default=u"/etc/mandos", metavar=u"DIR",
 
1478
                      help=u"Directory to search for configuration"
 
1479
                      u" files")
 
1480
    parser.add_option("--no-dbus", action=u"store_false",
 
1481
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
 
1482
                      u" system bus interface")
 
1483
    parser.add_option("--no-ipv6", action=u"store_false",
 
1484
                      dest=u"use_ipv6", help=u"Do not use IPv6")
955
1485
    options = parser.parse_args()[0]
956
1486
    
957
1487
    if options.check:
960
1490
        sys.exit()
961
1491
    
962
1492
    # Default values for config file for server-global settings
963
 
    server_defaults = { "interface": "",
964
 
                        "address": "",
965
 
                        "port": "",
966
 
                        "debug": "False",
967
 
                        "priority":
968
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
969
 
                        "servicename": "Mandos",
970
 
                        "use_dbus": "True",
971
 
                        "use_ipv6": "True",
 
1493
    server_defaults = { u"interface": u"",
 
1494
                        u"address": u"",
 
1495
                        u"port": u"",
 
1496
                        u"debug": u"False",
 
1497
                        u"priority":
 
1498
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1499
                        u"servicename": u"Mandos",
 
1500
                        u"use_dbus": u"True",
 
1501
                        u"use_ipv6": u"True",
972
1502
                        }
973
1503
    
974
1504
    # Parse config file for server-global settings
975
 
    server_config = ConfigParser.SafeConfigParser(server_defaults)
 
1505
    server_config = configparser.SafeConfigParser(server_defaults)
976
1506
    del server_defaults
977
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
1507
    server_config.read(os.path.join(options.configdir,
 
1508
                                    u"mandos.conf"))
978
1509
    # Convert the SafeConfigParser object to a dict
979
1510
    server_settings = server_config.defaults()
980
1511
    # Use the appropriate methods on the non-string config options
981
 
    server_settings["debug"] = server_config.getboolean("DEFAULT",
982
 
                                                        "debug")
983
 
    server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
984
 
                                                           "use_dbus")
985
 
    server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
986
 
                                                           "use_ipv6")
 
1512
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
 
1513
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
1514
                                                           option)
987
1515
    if server_settings["port"]:
988
 
        server_settings["port"] = server_config.getint("DEFAULT",
989
 
                                                       "port")
 
1516
        server_settings["port"] = server_config.getint(u"DEFAULT",
 
1517
                                                       u"port")
990
1518
    del server_config
991
1519
    
992
1520
    # Override the settings from the config file with command line
993
1521
    # options, if set.
994
 
    for option in ("interface", "address", "port", "debug",
995
 
                   "priority", "servicename", "configdir",
996
 
                   "use_dbus", "use_ipv6"):
 
1522
    for option in (u"interface", u"address", u"port", u"debug",
 
1523
                   u"priority", u"servicename", u"configdir",
 
1524
                   u"use_dbus", u"use_ipv6"):
997
1525
        value = getattr(options, option)
998
1526
        if value is not None:
999
1527
            server_settings[option] = value
1000
1528
    del options
 
1529
    # Force all strings to be unicode
 
1530
    for option in server_settings.keys():
 
1531
        if type(server_settings[option]) is str:
 
1532
            server_settings[option] = unicode(server_settings[option])
1001
1533
    # Now we have our good server settings in "server_settings"
1002
1534
    
 
1535
    ##################################################################
 
1536
    
1003
1537
    # For convenience
1004
 
    debug = server_settings["debug"]
1005
 
    use_dbus = server_settings["use_dbus"]
1006
 
    use_dbus = False            # XXX: Not done yet
1007
 
    use_ipv6 = server_settings["use_ipv6"]
 
1538
    debug = server_settings[u"debug"]
 
1539
    use_dbus = server_settings[u"use_dbus"]
 
1540
    use_ipv6 = server_settings[u"use_ipv6"]
1008
1541
    
1009
1542
    if not debug:
1010
1543
        syslogger.setLevel(logging.WARNING)
1011
1544
        console.setLevel(logging.WARNING)
1012
1545
    
1013
 
    if server_settings["servicename"] != "Mandos":
 
1546
    if server_settings[u"servicename"] != u"Mandos":
1014
1547
        syslogger.setFormatter(logging.Formatter
1015
 
                               ('Mandos (%s): %%(levelname)s:'
1016
 
                                ' %%(message)s'
1017
 
                                % server_settings["servicename"]))
 
1548
                               (u'Mandos (%s) [%%(process)d]:'
 
1549
                                u' %%(levelname)s: %%(message)s'
 
1550
                                % server_settings[u"servicename"]))
1018
1551
    
1019
1552
    # Parse config file with clients
1020
 
    client_defaults = { "timeout": "1h",
1021
 
                        "interval": "5m",
1022
 
                        "checker": "fping -q -- %%(host)s",
1023
 
                        "host": "",
 
1553
    client_defaults = { u"timeout": u"1h",
 
1554
                        u"interval": u"5m",
 
1555
                        u"checker": u"fping -q -- %%(host)s",
 
1556
                        u"host": u"",
1024
1557
                        }
1025
 
    client_config = ConfigParser.SafeConfigParser(client_defaults)
1026
 
    client_config.read(os.path.join(server_settings["configdir"],
1027
 
                                    "clients.conf"))
1028
 
    
1029
 
    clients = Set()
1030
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
1031
 
                                 server_settings["port"]),
1032
 
                                TCP_handler,
1033
 
                                settings=server_settings,
1034
 
                                clients=clients, use_ipv6=use_ipv6)
1035
 
    pidfilename = "/var/run/mandos.pid"
 
1558
    client_config = configparser.SafeConfigParser(client_defaults)
 
1559
    client_config.read(os.path.join(server_settings[u"configdir"],
 
1560
                                    u"clients.conf"))
 
1561
    
 
1562
    global mandos_dbus_service
 
1563
    mandos_dbus_service = None
 
1564
    
 
1565
    tcp_server = MandosServer((server_settings[u"address"],
 
1566
                               server_settings[u"port"]),
 
1567
                              ClientHandler,
 
1568
                              interface=(server_settings[u"interface"]
 
1569
                                         or None),
 
1570
                              use_ipv6=use_ipv6,
 
1571
                              gnutls_priority=
 
1572
                              server_settings[u"priority"],
 
1573
                              use_dbus=use_dbus)
 
1574
    pidfilename = u"/var/run/mandos.pid"
1036
1575
    try:
1037
 
        pidfile = open(pidfilename, "w")
 
1576
        pidfile = open(pidfilename, u"w")
1038
1577
    except IOError:
1039
 
        logger.error("Could not open file %r", pidfilename)
 
1578
        logger.error(u"Could not open file %r", pidfilename)
1040
1579
    
1041
1580
    try:
1042
 
        uid = pwd.getpwnam("_mandos").pw_uid
1043
 
        gid = pwd.getpwnam("_mandos").pw_gid
 
1581
        uid = pwd.getpwnam(u"_mandos").pw_uid
 
1582
        gid = pwd.getpwnam(u"_mandos").pw_gid
1044
1583
    except KeyError:
1045
1584
        try:
1046
 
            uid = pwd.getpwnam("mandos").pw_uid
1047
 
            gid = pwd.getpwnam("mandos").pw_gid
 
1585
            uid = pwd.getpwnam(u"mandos").pw_uid
 
1586
            gid = pwd.getpwnam(u"mandos").pw_gid
1048
1587
        except KeyError:
1049
1588
            try:
1050
 
                uid = pwd.getpwnam("nobody").pw_uid
1051
 
                gid = pwd.getpwnam("nogroup").pw_gid
 
1589
                uid = pwd.getpwnam(u"nobody").pw_uid
 
1590
                gid = pwd.getpwnam(u"nobody").pw_gid
1052
1591
            except KeyError:
1053
1592
                uid = 65534
1054
1593
                gid = 65534
1067
1606
        
1068
1607
        @gnutls.library.types.gnutls_log_func
1069
1608
        def debug_gnutls(level, string):
1070
 
            logger.debug("GnuTLS: %s", string[:-1])
 
1609
            logger.debug(u"GnuTLS: %s", string[:-1])
1071
1610
        
1072
1611
        (gnutls.library.functions
1073
1612
         .gnutls_global_set_log_function(debug_gnutls))
1074
1613
    
1075
 
    global service
1076
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1077
 
    service = AvahiService(name = server_settings["servicename"],
1078
 
                           servicetype = "_mandos._tcp",
1079
 
                           protocol = protocol)
1080
 
    if server_settings["interface"]:
1081
 
        service.interface = (if_nametoindex
1082
 
                             (server_settings["interface"]))
1083
 
    
1084
1614
    global main_loop
1085
 
    global bus
1086
 
    global server
1087
1615
    # From the Avahi example code
1088
1616
    DBusGMainLoop(set_as_default=True )
1089
1617
    main_loop = gobject.MainLoop()
1090
1618
    bus = dbus.SystemBus()
1091
 
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1092
 
                                           avahi.DBUS_PATH_SERVER),
1093
 
                            avahi.DBUS_INTERFACE_SERVER)
1094
1619
    # End of Avahi example code
1095
1620
    if use_dbus:
1096
 
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
 
1621
        try:
 
1622
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
1623
                                            bus, do_not_queue=True)
 
1624
        except dbus.exceptions.NameExistsException, e:
 
1625
            logger.error(unicode(e) + u", disabling D-Bus")
 
1626
            use_dbus = False
 
1627
            server_settings[u"use_dbus"] = False
 
1628
            tcp_server.use_dbus = False
 
1629
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
1630
    service = AvahiService(name = server_settings[u"servicename"],
 
1631
                           servicetype = u"_mandos._tcp",
 
1632
                           protocol = protocol, bus = bus)
 
1633
    if server_settings["interface"]:
 
1634
        service.interface = (if_nametoindex
 
1635
                             (str(server_settings[u"interface"])))
1097
1636
    
1098
 
    clients.update(Set(Client(name = section,
1099
 
                              config
1100
 
                              = dict(client_config.items(section)),
1101
 
                              use_dbus = use_dbus)
1102
 
                       for section in client_config.sections()))
1103
 
    if not clients:
 
1637
    client_class = Client
 
1638
    if use_dbus:
 
1639
        client_class = functools.partial(ClientDBus, bus = bus)
 
1640
    tcp_server.clients.update(set(
 
1641
            client_class(name = section,
 
1642
                         config= dict(client_config.items(section)))
 
1643
            for section in client_config.sections()))
 
1644
    if not tcp_server.clients:
1104
1645
        logger.warning(u"No clients defined")
1105
1646
    
1106
1647
    if debug:
1116
1657
        daemon()
1117
1658
    
1118
1659
    try:
1119
 
        pid = os.getpid()
1120
 
        pidfile.write(str(pid) + "\n")
1121
 
        pidfile.close()
 
1660
        with pidfile:
 
1661
            pid = os.getpid()
 
1662
            pidfile.write(str(pid) + "\n")
1122
1663
        del pidfile
1123
1664
    except IOError:
1124
1665
        logger.error(u"Could not write to file %r with PID %d",
1128
1669
        pass
1129
1670
    del pidfilename
1130
1671
    
1131
 
    def cleanup():
1132
 
        "Cleanup function; run on exit"
1133
 
        global group
1134
 
        # From the Avahi example code
1135
 
        if not group is None:
1136
 
            group.Free()
1137
 
            group = None
1138
 
        # End of Avahi example code
1139
 
        
1140
 
        while clients:
1141
 
            client = clients.pop()
1142
 
            client.disable_hook = None
1143
 
            client.disable()
1144
 
    
1145
 
    atexit.register(cleanup)
1146
 
    
1147
1672
    if not debug:
1148
1673
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1149
1674
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1150
1675
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1151
1676
    
1152
1677
    if use_dbus:
1153
 
        class MandosServer(dbus.service.Object):
 
1678
        class MandosDBusService(dbus.service.Object):
1154
1679
            """A D-Bus proxy object"""
1155
1680
            def __init__(self):
1156
 
                dbus.service.Object.__init__(self, bus, "/")
 
1681
                dbus.service.Object.__init__(self, bus, u"/")
1157
1682
            _interface = u"se.bsnet.fukt.Mandos"
1158
1683
            
1159
 
            @dbus.service.signal(_interface, signature="oa{sv}")
1160
 
            def ClientAdded(self, objpath, properties):
1161
 
                "D-Bus signal"
1162
 
                pass
1163
 
            
1164
 
            @dbus.service.signal(_interface, signature="os")
 
1684
            @dbus.service.signal(_interface, signature=u"o")
 
1685
            def ClientAdded(self, objpath):
 
1686
                "D-Bus signal"
 
1687
                pass
 
1688
            
 
1689
            @dbus.service.signal(_interface, signature=u"ss")
 
1690
            def ClientNotFound(self, fingerprint, address):
 
1691
                "D-Bus signal"
 
1692
                pass
 
1693
            
 
1694
            @dbus.service.signal(_interface, signature=u"os")
1165
1695
            def ClientRemoved(self, objpath, name):
1166
1696
                "D-Bus signal"
1167
1697
                pass
1168
1698
            
1169
 
            @dbus.service.method(_interface, out_signature="ao")
 
1699
            @dbus.service.method(_interface, out_signature=u"ao")
1170
1700
            def GetAllClients(self):
1171
1701
                "D-Bus method"
1172
 
                return dbus.Array(c.dbus_object_path for c in clients)
 
1702
                return dbus.Array(c.dbus_object_path
 
1703
                                  for c in tcp_server.clients)
1173
1704
            
1174
 
            @dbus.service.method(_interface, out_signature="a{oa{sv}}")
 
1705
            @dbus.service.method(_interface,
 
1706
                                 out_signature=u"a{oa{sv}}")
1175
1707
            def GetAllClientsWithProperties(self):
1176
1708
                "D-Bus method"
1177
1709
                return dbus.Dictionary(
1178
 
                    ((c.dbus_object_path, c.GetAllProperties())
1179
 
                     for c in clients),
1180
 
                    signature="oa{sv}")
 
1710
                    ((c.dbus_object_path, c.GetAll(u""))
 
1711
                     for c in tcp_server.clients),
 
1712
                    signature=u"oa{sv}")
1181
1713
            
1182
 
            @dbus.service.method(_interface, in_signature="o")
 
1714
            @dbus.service.method(_interface, in_signature=u"o")
1183
1715
            def RemoveClient(self, object_path):
1184
1716
                "D-Bus method"
1185
 
                for c in clients:
 
1717
                for c in tcp_server.clients:
1186
1718
                    if c.dbus_object_path == object_path:
1187
 
                        clients.remove(c)
 
1719
                        tcp_server.clients.remove(c)
 
1720
                        c.remove_from_connection()
1188
1721
                        # Don't signal anything except ClientRemoved
1189
 
                        c.use_dbus = False
1190
 
                        c.disable()
 
1722
                        c.disable(quiet=True)
1191
1723
                        # Emit D-Bus signal
1192
1724
                        self.ClientRemoved(object_path, c.name)
1193
1725
                        return
1194
 
                raise KeyError
 
1726
                raise KeyError(object_path)
1195
1727
            
1196
1728
            del _interface
1197
1729
        
1198
 
        mandos_server = MandosServer()
1199
 
    
1200
 
    for client in clients:
 
1730
        mandos_dbus_service = MandosDBusService()
 
1731
    
 
1732
    def cleanup():
 
1733
        "Cleanup function; run on exit"
 
1734
        service.cleanup()
 
1735
        
 
1736
        while tcp_server.clients:
 
1737
            client = tcp_server.clients.pop()
 
1738
            if use_dbus:
 
1739
                client.remove_from_connection()
 
1740
            client.disable_hook = None
 
1741
            # Don't signal anything except ClientRemoved
 
1742
            client.disable(quiet=True)
 
1743
            if use_dbus:
 
1744
                # Emit D-Bus signal
 
1745
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
1746
                                                  client.name)
 
1747
    
 
1748
    atexit.register(cleanup)
 
1749
    
 
1750
    for client in tcp_server.clients:
1201
1751
        if use_dbus:
1202
1752
            # Emit D-Bus signal
1203
 
            mandos_server.ClientAdded(client.dbus_object_path,
1204
 
                                      client.GetAllProperties())
 
1753
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
1205
1754
        client.enable()
1206
1755
    
1207
1756
    tcp_server.enable()
1221
1770
    
1222
1771
    try:
1223
1772
        # From the Avahi example code
1224
 
        server.connect_to_signal("StateChanged", server_state_changed)
1225
1773
        try:
1226
 
            server_state_changed(server.GetState())
 
1774
            service.activate()
1227
1775
        except dbus.exceptions.DBusException, error:
1228
1776
            logger.critical(u"DBusException: %s", error)
 
1777
            cleanup()
1229
1778
            sys.exit(1)
1230
1779
        # End of Avahi example code
1231
1780
        
1238
1787
        main_loop.run()
1239
1788
    except AvahiError, error:
1240
1789
        logger.critical(u"AvahiError: %s", error)
 
1790
        cleanup()
1241
1791
        sys.exit(1)
1242
1792
    except KeyboardInterrupt:
1243
1793
        if debug:
1244
1794
            print >> sys.stderr
1245
 
        logger.debug("Server received KeyboardInterrupt")
1246
 
    logger.debug("Server exiting")
 
1795
        logger.debug(u"Server received KeyboardInterrupt")
 
1796
    logger.debug(u"Server exiting")
 
1797
    # Must run before the D-Bus bus name gets deregistered
 
1798
    cleanup()
1247
1799
 
1248
1800
if __name__ == '__main__':
1249
1801
    main()