/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2010-09-25 23:52:17 UTC
  • Revision ID: teddy@fukt.bsnet.se-20100925235217-4hhqfryz1ste6uw3
* mandos (ClientDBus.__init__): Bug fix: Translate "-" in client names
                                to "_" in D-Bus object paths.
  (MandosServer.handle_ipc): Bug fix: Send only address string to
                             D-Bus signal, not whole tuple.

* mandos-ctl: New options "--approve-by-default", "--deny-by-default",
              "--approval-delay", and "--approval-duration".
* mandos-ctl.xml (SYNOPSIS, OPTIONS): Document new options.

* mandos-monitor (MandosClientWidget.update): Fix spelling.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
60
60
import fcntl
61
61
import functools
62
62
import cPickle as pickle
 
63
import multiprocessing
63
64
 
64
65
import dbus
65
66
import dbus.service
82
83
 
83
84
version = "1.0.14"
84
85
 
 
86
#logger = logging.getLogger(u'mandos')
85
87
logger = logging.Logger(u'mandos')
86
88
syslogger = (logging.handlers.SysLogHandler
87
89
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
155
157
                            u" after %i retries, exiting.",
156
158
                            self.rename_count)
157
159
            raise AvahiServiceError(u"Too many renames")
158
 
        self.name = self.server.GetAlternativeServiceName(self.name)
 
160
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
159
161
        logger.info(u"Changing Zeroconf service name to %r ...",
160
 
                    unicode(self.name))
 
162
                    self.name)
161
163
        syslogger.setFormatter(logging.Formatter
162
164
                               (u'Mandos (%s) [%%(process)d]:'
163
165
                                u' %%(levelname)s: %%(message)s'
164
166
                                % self.name))
165
167
        self.remove()
166
 
        self.add()
 
168
        try:
 
169
            self.add()
 
170
        except dbus.exceptions.DBusException, error:
 
171
            logger.critical(u"DBusException: %s", error)
 
172
            self.cleanup()
 
173
            os._exit(1)
167
174
        self.rename_count += 1
168
175
    def remove(self):
169
176
        """Derived from the Avahi example code"""
192
199
        self.group.Commit()
193
200
    def entry_group_state_changed(self, state, error):
194
201
        """Derived from the Avahi example code"""
195
 
        logger.debug(u"Avahi state change: %i", state)
 
202
        logger.debug(u"Avahi entry group state change: %i", state)
196
203
        
197
204
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
198
205
            logger.debug(u"Zeroconf service established.")
211
218
            self.group = None
212
219
    def server_state_changed(self, state):
213
220
        """Derived from the Avahi example code"""
 
221
        logger.debug(u"Avahi server state change: %i", state)
214
222
        if state == avahi.SERVER_COLLISION:
215
223
            logger.error(u"Zeroconf server name collision")
216
224
            self.remove()
232
240
    """A representation of a client host served by this server.
233
241
    
234
242
    Attributes:
235
 
    name:       string; from the config file, used in log messages and
236
 
                        D-Bus identifiers
237
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
238
 
                 uniquely identify the client
239
 
    secret:     bytestring; sent verbatim (over TLS) to client
240
 
    host:       string; available for use by the checker command
241
 
    created:    datetime.datetime(); (UTC) object creation
242
 
    last_enabled: datetime.datetime(); (UTC)
243
 
    enabled:    bool()
244
 
    last_checked_ok: datetime.datetime(); (UTC) or None
245
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
246
 
                                      until this client is disabled
247
 
    interval:   datetime.timedelta(); How often to start a new checker
248
 
    disable_hook:  If set, called by disable() as disable_hook(self)
 
243
    _approved:   bool(); 'None' if not yet approved/disapproved
 
244
    approval_delay: datetime.timedelta(); Time to wait for approval
 
245
    approval_duration: datetime.timedelta(); Duration of one approval
249
246
    checker:    subprocess.Popen(); a running checker process used
250
247
                                    to see if the client lives.
251
248
                                    'None' if no process is running.
252
 
    checker_initiator_tag: a gobject event source tag, or None
253
 
    disable_initiator_tag: - '' -
254
249
    checker_callback_tag:  - '' -
255
 
    checker_command: string; External command which is run to check if
256
 
                     client lives.  %() expansions are done at
 
250
    checker_command: string; External command which is run to check
 
251
                     if client lives.  %() expansions are done at
257
252
                     runtime with vars(self) as dict, so that for
258
253
                     instance %(name)s can be used in the command.
 
254
    checker_initiator_tag: a gobject event source tag, or None
 
255
    created:    datetime.datetime(); (UTC) object creation
259
256
    current_checker_command: string; current running checker_command
260
 
    changesignal: File descriptor; written to on object change
261
 
    _reset: File descriptor; for flushing changesignal
262
 
    delay: datetime.timedelta(); how long to wait for approval/secret
263
 
    approved: bool(); None if not yet approved/disapproved
 
257
    disable_hook:  If set, called by disable() as disable_hook(self)
 
258
    disable_initiator_tag: - '' -
 
259
    enabled:    bool()
 
260
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
261
                 uniquely identify the client
 
262
    host:       string; available for use by the checker command
 
263
    interval:   datetime.timedelta(); How often to start a new checker
 
264
    last_checked_ok: datetime.datetime(); (UTC) or None
 
265
    last_enabled: datetime.datetime(); (UTC)
 
266
    name:       string; from the config file, used in log messages and
 
267
                        D-Bus identifiers
 
268
    secret:     bytestring; sent verbatim (over TLS) to client
 
269
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
270
                                      until this client is disabled
 
271
    runtime_expansions: Allowed attributes for runtime expansion.
264
272
    """
265
273
    
 
274
    runtime_expansions = (u"approval_delay", u"approval_duration",
 
275
                          u"created", u"enabled", u"fingerprint",
 
276
                          u"host", u"interval", u"last_checked_ok",
 
277
                          u"last_enabled", u"name", u"timeout")
 
278
    
266
279
    @staticmethod
267
280
    def _timedelta_to_milliseconds(td):
268
281
        "Convert a datetime.timedelta() to milliseconds"
277
290
    def interval_milliseconds(self):
278
291
        "Return the 'interval' attribute in milliseconds"
279
292
        return self._timedelta_to_milliseconds(self.interval)
 
293
 
 
294
    def approval_delay_milliseconds(self):
 
295
        return self._timedelta_to_milliseconds(self.approval_delay)
280
296
    
281
297
    def __init__(self, name = None, disable_hook=None, config=None):
282
298
        """Note: the 'checker' key in 'config' sets the
293
309
                            .replace(u" ", u""))
294
310
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
295
311
        if u"secret" in config:
296
 
            self._secret = config[u"secret"].decode(u"base64")
 
312
            self.secret = config[u"secret"].decode(u"base64")
297
313
        elif u"secfile" in config:
298
314
            with open(os.path.expanduser(os.path.expandvars
299
315
                                         (config[u"secfile"])),
300
316
                      "rb") as secfile:
301
 
                self._secret = secfile.read()
 
317
                self.secret = secfile.read()
302
318
        else:
303
 
            #XXX Need to allow secret on demand!
304
319
            raise TypeError(u"No secret or secfile for client %s"
305
320
                            % self.name)
306
321
        self.host = config.get(u"host", u"")
318
333
        self.checker_command = config[u"checker"]
319
334
        self.current_checker_command = None
320
335
        self.last_connect = None
321
 
        self.changesignal, self._reset = os.pipe()
322
 
        self._approved = None #XXX should be based on configfile
323
 
        self.delay = 10; #XXX Should be based on configfile
324
 
 
325
 
    def setsecret(self, value):
326
 
        self._secret = value
327
 
        os.write(self.changesignal, "\0")
328
 
        os.read(self._reset, 1)
329
 
 
330
 
    secret = property(lambda self: self._secret, setsecret)
331
 
    del setsecret
 
336
        self._approved = None
 
337
        self.approved_by_default = config.get(u"approved_by_default",
 
338
                                              True)
 
339
        self.approvals_pending = 0
 
340
        self.approval_delay = string_to_delta(
 
341
            config[u"approval_delay"])
 
342
        self.approval_duration = string_to_delta(
 
343
            config[u"approval_duration"])
 
344
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
332
345
    
333
 
    def setapproved(self, value):
334
 
        self._approved = value
335
 
        os.write(self.changesignal, "\0")
336
 
        os.read(self._reset, 1)
337
 
 
338
 
    approved = property(lambda self: self._approved, setapproved)
339
 
    del setapproved
340
 
 
 
346
    def send_changedstate(self):
 
347
        self.changedstate.acquire()
 
348
        self.changedstate.notify_all()
 
349
        self.changedstate.release()
 
350
        
341
351
    def enable(self):
342
352
        """Start this client's checker and timeout hooks"""
343
353
        if getattr(self, u"enabled", False):
344
354
            # Already enabled
345
355
            return
 
356
        self.send_changedstate()
346
357
        self.last_enabled = datetime.datetime.utcnow()
347
358
        # Schedule a new checker to be started an 'interval' from now,
348
359
        # and every interval from then on.
362
373
        if not getattr(self, "enabled", False):
363
374
            return False
364
375
        if not quiet:
 
376
            self.send_changedstate()
 
377
        if not quiet:
365
378
            logger.info(u"Disabling client %s", self.name)
366
379
        if getattr(self, u"disable_initiator_tag", False):
367
380
            gobject.source_remove(self.disable_initiator_tag)
443
456
                command = self.checker_command % self.host
444
457
            except TypeError:
445
458
                # Escape attributes for the shell
446
 
                escaped_attrs = dict((key,
447
 
                                      re.escape(unicode(str(val),
448
 
                                                        errors=
449
 
                                                        u'replace')))
450
 
                                     for key, val in
451
 
                                     vars(self).iteritems())
 
459
                escaped_attrs = dict(
 
460
                    (attr,
 
461
                     re.escape(unicode(str(getattr(self, attr, u"")),
 
462
                                       errors=
 
463
                                       u'replace')))
 
464
                    for attr in
 
465
                    self.runtime_expansions)
 
466
 
452
467
                try:
453
468
                    command = self.checker_command % escaped_attrs
454
469
                except TypeError, error:
500
515
                raise
501
516
        self.checker = None
502
517
 
503
 
 
504
518
def dbus_service_property(dbus_interface, signature=u"v",
505
519
                          access=u"readwrite", byte_arrays=False):
506
520
    """Decorators for marking methods of a DBusObjectWithProperties to
697
711
    dbus_object_path: dbus.ObjectPath
698
712
    bus: dbus.SystemBus()
699
713
    """
 
714
    
 
715
    runtime_expansions = (Client.runtime_expansions
 
716
                          + (u"dbus_object_path",))
 
717
    
700
718
    # dbus.service.Object doesn't use super(), so we can't either.
701
719
    
702
720
    def __init__(self, bus = None, *args, **kwargs):
 
721
        self._approvals_pending = 0
703
722
        self.bus = bus
704
723
        Client.__init__(self, *args, **kwargs)
705
724
        # Only now, when this client is initialized, can it show up on
706
725
        # the D-Bus
 
726
        client_object_name = unicode(self.name).translate(
 
727
            {ord(u"."): ord(u"_"),
 
728
             ord(u"-"): ord(u"_")})
707
729
        self.dbus_object_path = (dbus.ObjectPath
708
 
                                 (u"/clients/"
709
 
                                  + self.name.replace(u".", u"_")))
 
730
                                 (u"/clients/" + client_object_name))
710
731
        DBusObjectWithProperties.__init__(self, self.bus,
711
732
                                          self.dbus_object_path)
 
733
        
 
734
    def _get_approvals_pending(self):
 
735
        return self._approvals_pending
 
736
    def _set_approvals_pending(self, value):
 
737
        old_value = self._approvals_pending
 
738
        self._approvals_pending = value
 
739
        bval = bool(value)
 
740
        if (hasattr(self, "dbus_object_path")
 
741
            and bval is not bool(old_value)):
 
742
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
743
            self.PropertyChanged(dbus.String(u"ApprovalPending"),
 
744
                                 dbus_bool)
 
745
 
 
746
    approvals_pending = property(_get_approvals_pending,
 
747
                                 _set_approvals_pending)
 
748
    del _get_approvals_pending, _set_approvals_pending
712
749
    
713
750
    @staticmethod
714
751
    def _datetime_to_dbus(dt, variant_level=0):
721
758
        r = Client.enable(self)
722
759
        if oldstate != self.enabled:
723
760
            # Emit D-Bus signals
724
 
            self.PropertyChanged(dbus.String(u"enabled"),
 
761
            self.PropertyChanged(dbus.String(u"Enabled"),
725
762
                                 dbus.Boolean(True, variant_level=1))
726
763
            self.PropertyChanged(
727
 
                dbus.String(u"last_enabled"),
 
764
                dbus.String(u"LastEnabled"),
728
765
                self._datetime_to_dbus(self.last_enabled,
729
766
                                       variant_level=1))
730
767
        return r
734
771
        r = Client.disable(self, quiet=quiet)
735
772
        if not quiet and oldstate != self.enabled:
736
773
            # Emit D-Bus signal
737
 
            self.PropertyChanged(dbus.String(u"enabled"),
 
774
            self.PropertyChanged(dbus.String(u"Enabled"),
738
775
                                 dbus.Boolean(False, variant_level=1))
739
776
        return r
740
777
    
752
789
        self.checker_callback_tag = None
753
790
        self.checker = None
754
791
        # Emit D-Bus signal
755
 
        self.PropertyChanged(dbus.String(u"checker_running"),
 
792
        self.PropertyChanged(dbus.String(u"CheckerRunning"),
756
793
                             dbus.Boolean(False, variant_level=1))
757
794
        if os.WIFEXITED(condition):
758
795
            exitstatus = os.WEXITSTATUS(condition)
773
810
        r = Client.checked_ok(self, *args, **kwargs)
774
811
        # Emit D-Bus signal
775
812
        self.PropertyChanged(
776
 
            dbus.String(u"last_checked_ok"),
 
813
            dbus.String(u"LastCheckedOK"),
777
814
            (self._datetime_to_dbus(self.last_checked_ok,
778
815
                                    variant_level=1)))
779
816
        return r
791
828
            # Emit D-Bus signal
792
829
            self.CheckerStarted(self.current_checker_command)
793
830
            self.PropertyChanged(
794
 
                dbus.String(u"checker_running"),
 
831
                dbus.String(u"CheckerRunning"),
795
832
                dbus.Boolean(True, variant_level=1))
796
833
        return r
797
834
    
800
837
        r = Client.stop_checker(self, *args, **kwargs)
801
838
        if (old_checker is not None
802
839
            and getattr(self, u"checker", None) is None):
803
 
            self.PropertyChanged(dbus.String(u"checker_running"),
 
840
            self.PropertyChanged(dbus.String(u"CheckerRunning"),
804
841
                                 dbus.Boolean(False, variant_level=1))
805
842
        return r
 
843
 
 
844
    def _reset_approved(self):
 
845
        self._approved = None
 
846
        return False
 
847
    
 
848
    def approve(self, value=True):
 
849
        self.send_changedstate()
 
850
        self._approved = value
 
851
        gobject.timeout_add(self._timedelta_to_milliseconds
 
852
                            (self.approval_duration),
 
853
                            self._reset_approved)
 
854
    
806
855
    
807
856
    ## D-Bus methods, signals & properties
808
857
    _interface = u"se.bsnet.fukt.Mandos.Client"
830
879
    # GotSecret - signal
831
880
    @dbus.service.signal(_interface)
832
881
    def GotSecret(self):
833
 
        "D-Bus signal"
 
882
        """D-Bus signal
 
883
        Is sent after a successful transfer of secret from the Mandos
 
884
        server to mandos-client
 
885
        """
834
886
        pass
835
887
    
836
888
    # Rejected - signal
837
 
    @dbus.service.signal(_interface)
838
 
    def Rejected(self):
 
889
    @dbus.service.signal(_interface, signature=u"s")
 
890
    def Rejected(self, reason):
 
891
        "D-Bus signal"
 
892
        pass
 
893
    
 
894
    # NeedApproval - signal
 
895
    @dbus.service.signal(_interface, signature=u"tb")
 
896
    def NeedApproval(self, timeout, default):
839
897
        "D-Bus signal"
840
898
        pass
841
899
    
842
900
    ## Methods
843
 
    
 
901
 
 
902
    # Approve - method
 
903
    @dbus.service.method(_interface, in_signature=u"b")
 
904
    def Approve(self, value):
 
905
        self.approve(value)
 
906
 
844
907
    # CheckedOK - method
845
908
    @dbus.service.method(_interface)
846
909
    def CheckedOK(self):
871
934
    
872
935
    ## Properties
873
936
    
874
 
    # name - property
 
937
    # ApprovalPending - property
 
938
    @dbus_service_property(_interface, signature=u"b", access=u"read")
 
939
    def ApprovalPending_dbus_property(self):
 
940
        return dbus.Boolean(bool(self.approvals_pending))
 
941
    
 
942
    # ApprovedByDefault - property
 
943
    @dbus_service_property(_interface, signature=u"b",
 
944
                           access=u"readwrite")
 
945
    def ApprovedByDefault_dbus_property(self, value=None):
 
946
        if value is None:       # get
 
947
            return dbus.Boolean(self.approved_by_default)
 
948
        self.approved_by_default = bool(value)
 
949
        # Emit D-Bus signal
 
950
        self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
 
951
                             dbus.Boolean(value, variant_level=1))
 
952
    
 
953
    # ApprovalDelay - property
 
954
    @dbus_service_property(_interface, signature=u"t",
 
955
                           access=u"readwrite")
 
956
    def ApprovalDelay_dbus_property(self, value=None):
 
957
        if value is None:       # get
 
958
            return dbus.UInt64(self.approval_delay_milliseconds())
 
959
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
960
        # Emit D-Bus signal
 
961
        self.PropertyChanged(dbus.String(u"ApprovalDelay"),
 
962
                             dbus.UInt64(value, variant_level=1))
 
963
    
 
964
    # ApprovalDuration - property
 
965
    @dbus_service_property(_interface, signature=u"t",
 
966
                           access=u"readwrite")
 
967
    def ApprovalDuration_dbus_property(self, value=None):
 
968
        if value is None:       # get
 
969
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
970
                    self.approval_duration))
 
971
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
972
        # Emit D-Bus signal
 
973
        self.PropertyChanged(dbus.String(u"ApprovalDuration"),
 
974
                             dbus.UInt64(value, variant_level=1))
 
975
    
 
976
    # Name - property
875
977
    @dbus_service_property(_interface, signature=u"s", access=u"read")
876
 
    def name_dbus_property(self):
 
978
    def Name_dbus_property(self):
877
979
        return dbus.String(self.name)
878
980
    
879
 
    # fingerprint - property
 
981
    # Fingerprint - property
880
982
    @dbus_service_property(_interface, signature=u"s", access=u"read")
881
 
    def fingerprint_dbus_property(self):
 
983
    def Fingerprint_dbus_property(self):
882
984
        return dbus.String(self.fingerprint)
883
985
    
884
 
    # host - property
 
986
    # Host - property
885
987
    @dbus_service_property(_interface, signature=u"s",
886
988
                           access=u"readwrite")
887
 
    def host_dbus_property(self, value=None):
 
989
    def Host_dbus_property(self, value=None):
888
990
        if value is None:       # get
889
991
            return dbus.String(self.host)
890
992
        self.host = value
891
993
        # Emit D-Bus signal
892
 
        self.PropertyChanged(dbus.String(u"host"),
 
994
        self.PropertyChanged(dbus.String(u"Host"),
893
995
                             dbus.String(value, variant_level=1))
894
996
    
895
 
    # created - property
 
997
    # Created - property
896
998
    @dbus_service_property(_interface, signature=u"s", access=u"read")
897
 
    def created_dbus_property(self):
 
999
    def Created_dbus_property(self):
898
1000
        return dbus.String(self._datetime_to_dbus(self.created))
899
1001
    
900
 
    # last_enabled - property
 
1002
    # LastEnabled - property
901
1003
    @dbus_service_property(_interface, signature=u"s", access=u"read")
902
 
    def last_enabled_dbus_property(self):
 
1004
    def LastEnabled_dbus_property(self):
903
1005
        if self.last_enabled is None:
904
1006
            return dbus.String(u"")
905
1007
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
906
1008
    
907
 
    # enabled - property
 
1009
    # Enabled - property
908
1010
    @dbus_service_property(_interface, signature=u"b",
909
1011
                           access=u"readwrite")
910
 
    def enabled_dbus_property(self, value=None):
 
1012
    def Enabled_dbus_property(self, value=None):
911
1013
        if value is None:       # get
912
1014
            return dbus.Boolean(self.enabled)
913
1015
        if value:
915
1017
        else:
916
1018
            self.disable()
917
1019
    
918
 
    # last_checked_ok - property
 
1020
    # LastCheckedOK - property
919
1021
    @dbus_service_property(_interface, signature=u"s",
920
1022
                           access=u"readwrite")
921
 
    def last_checked_ok_dbus_property(self, value=None):
 
1023
    def LastCheckedOK_dbus_property(self, value=None):
922
1024
        if value is not None:
923
1025
            self.checked_ok()
924
1026
            return
927
1029
        return dbus.String(self._datetime_to_dbus(self
928
1030
                                                  .last_checked_ok))
929
1031
    
930
 
    # timeout - property
 
1032
    # Timeout - property
931
1033
    @dbus_service_property(_interface, signature=u"t",
932
1034
                           access=u"readwrite")
933
 
    def timeout_dbus_property(self, value=None):
 
1035
    def Timeout_dbus_property(self, value=None):
934
1036
        if value is None:       # get
935
1037
            return dbus.UInt64(self.timeout_milliseconds())
936
1038
        self.timeout = datetime.timedelta(0, 0, 0, value)
937
1039
        # Emit D-Bus signal
938
 
        self.PropertyChanged(dbus.String(u"timeout"),
 
1040
        self.PropertyChanged(dbus.String(u"Timeout"),
939
1041
                             dbus.UInt64(value, variant_level=1))
940
1042
        if getattr(self, u"disable_initiator_tag", None) is None:
941
1043
            return
955
1057
            self.disable_initiator_tag = (gobject.timeout_add
956
1058
                                          (time_to_die, self.disable))
957
1059
    
958
 
    # interval - property
 
1060
    # Interval - property
959
1061
    @dbus_service_property(_interface, signature=u"t",
960
1062
                           access=u"readwrite")
961
 
    def interval_dbus_property(self, value=None):
 
1063
    def Interval_dbus_property(self, value=None):
962
1064
        if value is None:       # get
963
1065
            return dbus.UInt64(self.interval_milliseconds())
964
1066
        self.interval = datetime.timedelta(0, 0, 0, value)
965
1067
        # Emit D-Bus signal
966
 
        self.PropertyChanged(dbus.String(u"interval"),
 
1068
        self.PropertyChanged(dbus.String(u"Interval"),
967
1069
                             dbus.UInt64(value, variant_level=1))
968
1070
        if getattr(self, u"checker_initiator_tag", None) is None:
969
1071
            return
973
1075
                                      (value, self.start_checker))
974
1076
        self.start_checker()    # Start one now, too
975
1077
 
976
 
    # checker - property
 
1078
    # Checker - property
977
1079
    @dbus_service_property(_interface, signature=u"s",
978
1080
                           access=u"readwrite")
979
 
    def checker_dbus_property(self, value=None):
 
1081
    def Checker_dbus_property(self, value=None):
980
1082
        if value is None:       # get
981
1083
            return dbus.String(self.checker_command)
982
1084
        self.checker_command = value
983
1085
        # Emit D-Bus signal
984
 
        self.PropertyChanged(dbus.String(u"checker"),
 
1086
        self.PropertyChanged(dbus.String(u"Checker"),
985
1087
                             dbus.String(self.checker_command,
986
1088
                                         variant_level=1))
987
1089
    
988
 
    # checker_running - property
 
1090
    # CheckerRunning - property
989
1091
    @dbus_service_property(_interface, signature=u"b",
990
1092
                           access=u"readwrite")
991
 
    def checker_running_dbus_property(self, value=None):
 
1093
    def CheckerRunning_dbus_property(self, value=None):
992
1094
        if value is None:       # get
993
1095
            return dbus.Boolean(self.checker is not None)
994
1096
        if value:
996
1098
        else:
997
1099
            self.stop_checker()
998
1100
    
999
 
    # object_path - property
 
1101
    # ObjectPath - property
1000
1102
    @dbus_service_property(_interface, signature=u"o", access=u"read")
1001
 
    def object_path_dbus_property(self):
 
1103
    def ObjectPath_dbus_property(self):
1002
1104
        return self.dbus_object_path # is already a dbus.ObjectPath
1003
1105
    
1004
 
    # secret = property
 
1106
    # Secret = property
1005
1107
    @dbus_service_property(_interface, signature=u"ay",
1006
1108
                           access=u"write", byte_arrays=True)
1007
 
    def secret_dbus_property(self, value):
 
1109
    def Secret_dbus_property(self, value):
1008
1110
        self.secret = str(value)
1009
1111
    
1010
1112
    del _interface
1011
1113
 
1012
1114
 
 
1115
class ProxyClient(object):
 
1116
    def __init__(self, child_pipe, fpr, address):
 
1117
        self._pipe = child_pipe
 
1118
        self._pipe.send(('init', fpr, address))
 
1119
        if not self._pipe.recv():
 
1120
            raise KeyError()
 
1121
 
 
1122
    def __getattribute__(self, name):
 
1123
        if(name == '_pipe'):
 
1124
            return super(ProxyClient, self).__getattribute__(name)
 
1125
        self._pipe.send(('getattr', name))
 
1126
        data = self._pipe.recv()
 
1127
        if data[0] == 'data':
 
1128
            return data[1]
 
1129
        if data[0] == 'function':
 
1130
            def func(*args, **kwargs):
 
1131
                self._pipe.send(('funcall', name, args, kwargs))
 
1132
                return self._pipe.recv()[1]
 
1133
            return func
 
1134
 
 
1135
    def __setattr__(self, name, value):
 
1136
        if(name == '_pipe'):
 
1137
            return super(ProxyClient, self).__setattr__(name, value)
 
1138
        self._pipe.send(('setattr', name, value))
 
1139
 
 
1140
 
1013
1141
class ClientHandler(socketserver.BaseRequestHandler, object):
1014
1142
    """A class to handle client connections.
1015
1143
    
1017
1145
    Note: This will run in its own forked process."""
1018
1146
    
1019
1147
    def handle(self):
1020
 
        logger.info(u"TCP connection from: %s",
1021
 
                    unicode(self.client_address))
1022
 
        logger.debug(u"IPC Pipe FD: %d",
1023
 
                     self.server.child_pipe[1].fileno())
1024
 
        # Open IPC pipe to parent process
1025
 
        with contextlib.nested(self.server.child_pipe[1],
1026
 
                               self.server.parent_pipe[0]
1027
 
                               ) as (ipc, ipc_return):
 
1148
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1149
            logger.info(u"TCP connection from: %s",
 
1150
                        unicode(self.client_address))
 
1151
            logger.debug(u"Pipe FD: %d",
 
1152
                         self.server.child_pipe.fileno())
 
1153
 
1028
1154
            session = (gnutls.connection
1029
1155
                       .ClientSession(self.request,
1030
1156
                                      gnutls.connection
1031
1157
                                      .X509Credentials()))
1032
 
            
1033
 
            line = self.request.makefile().readline()
1034
 
            logger.debug(u"Protocol version: %r", line)
1035
 
            try:
1036
 
                if int(line.strip().split()[0]) > 1:
1037
 
                    raise RuntimeError
1038
 
            except (ValueError, IndexError, RuntimeError), error:
1039
 
                logger.error(u"Unknown protocol version: %s", error)
1040
 
                return
1041
 
            
 
1158
 
1042
1159
            # Note: gnutls.connection.X509Credentials is really a
1043
1160
            # generic GnuTLS certificate credentials object so long as
1044
1161
            # no X.509 keys are added to it.  Therefore, we can use it
1045
1162
            # here despite using OpenPGP certificates.
1046
 
            
 
1163
 
1047
1164
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1048
1165
            #                      u"+AES-256-CBC", u"+SHA1",
1049
1166
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
1055
1172
            (gnutls.library.functions
1056
1173
             .gnutls_priority_set_direct(session._c_object,
1057
1174
                                         priority, None))
1058
 
            
 
1175
 
 
1176
            # Start communication using the Mandos protocol
 
1177
            # Get protocol number
 
1178
            line = self.request.makefile().readline()
 
1179
            logger.debug(u"Protocol version: %r", line)
 
1180
            try:
 
1181
                if int(line.strip().split()[0]) > 1:
 
1182
                    raise RuntimeError
 
1183
            except (ValueError, IndexError, RuntimeError), error:
 
1184
                logger.error(u"Unknown protocol version: %s", error)
 
1185
                return
 
1186
 
 
1187
            # Start GnuTLS connection
1059
1188
            try:
1060
1189
                session.handshake()
1061
1190
            except gnutls.errors.GNUTLSError, error:
1064
1193
                # established.  Just abandon the request.
1065
1194
                return
1066
1195
            logger.debug(u"Handshake succeeded")
 
1196
 
 
1197
            approval_required = False
1067
1198
            try:
1068
1199
                try:
1069
1200
                    fpr = self.fingerprint(self.peer_certificate
1073
1204
                    return
1074
1205
                logger.debug(u"Fingerprint: %s", fpr)
1075
1206
 
1076
 
                for c in self.server.clients:
1077
 
                    if c.fingerprint == fpr:
1078
 
                        client = c
1079
 
                        break
1080
 
                else:
1081
 
                    ipc.write(u"NOTFOUND %s %s\n"
1082
 
                              % (fpr, unicode(self.client_address)))
 
1207
                try:
 
1208
                    client = ProxyClient(child_pipe, fpr,
 
1209
                                         self.client_address)
 
1210
                except KeyError:
1083
1211
                    return
1084
 
 
1085
 
                class proxyclient(object):
1086
 
                    def __getattribute__(self, name):
1087
 
                        ipc.write(u"GETATTR %s %s\n" % name, client.fpr)
1088
 
                        return pickle.load(ipc_reply)
1089
 
                p = proxyclient(client)
1090
 
 
 
1212
                
 
1213
                if client.approval_delay:
 
1214
                    delay = client.approval_delay
 
1215
                    client.approvals_pending += 1
 
1216
                    approval_required = True
 
1217
                
1091
1218
                while True:
1092
 
                    if not p.client.enabled:
1093
 
                        icp.write("DISABLED %s\n" % client.fpr)
1094
 
                        return
1095
 
                    if p.client.approved == False:
1096
 
                        icp.write("Disaproved")
 
1219
                    if not client.enabled:
 
1220
                        logger.warning(u"Client %s is disabled",
 
1221
                                       client.name)
 
1222
                        if self.server.use_dbus:
 
1223
                            # Emit D-Bus signal
 
1224
                            client.Rejected("Disabled")                    
1097
1225
                        return
1098
1226
                    
1099
 
                    if not p.client.secret:
1100
 
                        icp.write("No password")
1101
 
                    elif not p.client.approved:
1102
 
                        icp.write("Need approval"):
1103
 
                    else:
1104
 
                        #We have a password and are approved
 
1227
                    if client._approved or not client.approval_delay:
 
1228
                        #We are approved or approval is disabled
1105
1229
                        break
1106
 
                    i, o, e = select(p.changesignal, (), (), client.delay)
1107
 
                    if not i:
1108
 
                        icp.write("Timeout passed")
 
1230
                    elif client._approved is None:
 
1231
                        logger.info(u"Client %s needs approval",
 
1232
                                    client.name)
 
1233
                        if self.server.use_dbus:
 
1234
                            # Emit D-Bus signal
 
1235
                            client.NeedApproval(
 
1236
                                client.approval_delay_milliseconds(),
 
1237
                                client.approved_by_default)
 
1238
                    else:
 
1239
                        logger.warning(u"Client %s was not approved",
 
1240
                                       client.name)
 
1241
                        if self.server.use_dbus:
 
1242
                            # Emit D-Bus signal
 
1243
                            client.Rejected("Denied")
1109
1244
                        return
1110
1245
                    
1111
 
                ipc.write(u"SENDING %s\n" % client.name)
 
1246
                    #wait until timeout or approved
 
1247
                    #x = float(client._timedelta_to_milliseconds(delay))
 
1248
                    time = datetime.datetime.now()
 
1249
                    client.changedstate.acquire()
 
1250
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1251
                    client.changedstate.release()
 
1252
                    time2 = datetime.datetime.now()
 
1253
                    if (time2 - time) >= delay:
 
1254
                        if not client.approved_by_default:
 
1255
                            logger.warning("Client %s timed out while"
 
1256
                                           " waiting for approval",
 
1257
                                           client.name)
 
1258
                            if self.server.use_dbus:
 
1259
                                # Emit D-Bus signal
 
1260
                                client.Rejected("Approval timed out")
 
1261
                            return
 
1262
                        else:
 
1263
                            break
 
1264
                    else:
 
1265
                        delay -= time2 - time
 
1266
                
1112
1267
                sent_size = 0
1113
1268
                while sent_size < len(client.secret):
1114
 
                    sent = session.send(client.secret[sent_size:])
 
1269
                    try:
 
1270
                        sent = session.send(client.secret[sent_size:])
 
1271
                    except (gnutls.errors.GNUTLSError), error:
 
1272
                        logger.warning("gnutls send failed")
 
1273
                        return
1115
1274
                    logger.debug(u"Sent: %d, remaining: %d",
1116
1275
                                 sent, len(client.secret)
1117
1276
                                 - (sent_size + sent))
1118
1277
                    sent_size += sent
 
1278
 
 
1279
                logger.info(u"Sending secret to %s", client.name)
 
1280
                # bump the timeout as if seen
 
1281
                client.checked_ok()
 
1282
                if self.server.use_dbus:
 
1283
                    # Emit D-Bus signal
 
1284
                    client.GotSecret()
 
1285
            
1119
1286
            finally:
1120
 
                session.bye()
 
1287
                if approval_required:
 
1288
                    client.approvals_pending -= 1
 
1289
                try:
 
1290
                    session.bye()
 
1291
                except (gnutls.errors.GNUTLSError), error:
 
1292
                    logger.warning("GnuTLS bye failed")
1121
1293
    
1122
1294
    @staticmethod
1123
1295
    def peer_certificate(session):
1183
1355
        return hex_fpr
1184
1356
 
1185
1357
 
1186
 
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
1187
 
    """Like socketserver.ForkingMixIn, but also pass a pipe pair."""
 
1358
class MultiprocessingMixIn(object):
 
1359
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1360
    def sub_process_main(self, request, address):
 
1361
        try:
 
1362
            self.finish_request(request, address)
 
1363
        except:
 
1364
            self.handle_error(request, address)
 
1365
        self.close_request(request)
 
1366
            
 
1367
    def process_request(self, request, address):
 
1368
        """Start a new process to process the request."""
 
1369
        multiprocessing.Process(target = self.sub_process_main,
 
1370
                                args = (request, address)).start()
 
1371
 
 
1372
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1373
    """ adds a pipe to the MixIn """
1188
1374
    def process_request(self, request, client_address):
1189
1375
        """Overrides and wraps the original process_request().
1190
1376
        
1191
1377
        This function creates a new pipe in self.pipe
1192
1378
        """
1193
 
        # Child writes to child_pipe
1194
 
        self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1195
 
        # Parent writes to parent_pipe
1196
 
        self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1197
 
        super(ForkingMixInWithPipes,
 
1379
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1380
 
 
1381
        super(MultiprocessingMixInWithPipe,
1198
1382
              self).process_request(request, client_address)
1199
 
        # Close unused ends for parent
1200
 
        self.parent_pipe[0].close() # close read end
1201
 
        self.child_pipe[1].close()  # close write end
1202
 
        self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
1203
 
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
 
1383
        self.child_pipe.close()
 
1384
        self.add_pipe(parent_pipe)
 
1385
 
 
1386
    def add_pipe(self, parent_pipe):
1204
1387
        """Dummy function; override as necessary"""
1205
 
        child_pipe_fd.close()
1206
 
        parent_pipe_fd.close()
1207
 
 
1208
 
 
1209
 
class IPv6_TCPServer(ForkingMixInWithPipes,
 
1388
        pass
 
1389
 
 
1390
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1210
1391
                     socketserver.TCPServer, object):
1211
1392
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1212
1393
    
1297
1478
            return socketserver.TCPServer.server_activate(self)
1298
1479
    def enable(self):
1299
1480
        self.enabled = True
1300
 
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
 
1481
    def add_pipe(self, parent_pipe):
1301
1482
        # Call "handle_ipc" for both data and EOF events
1302
 
        gobject.io_add_watch(child_pipe_fd.fileno(),
 
1483
        gobject.io_add_watch(parent_pipe.fileno(),
1303
1484
                             gobject.IO_IN | gobject.IO_HUP,
1304
1485
                             functools.partial(self.handle_ipc,
1305
 
                                               reply = parent_pipe_fd,
1306
 
                                               sender= child_pipe_fd))
1307
 
    def handle_ipc(self, source, condition, reply=None, sender=None):
 
1486
                                               parent_pipe = parent_pipe))
 
1487
        
 
1488
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1489
                   client_object=None):
1308
1490
        condition_names = {
1309
1491
            gobject.IO_IN: u"IN",   # There is data to read.
1310
1492
            gobject.IO_OUT: u"OUT", # Data can be written (without
1319
1501
                                       for cond, name in
1320
1502
                                       condition_names.iteritems()
1321
1503
                                       if cond & condition)
1322
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1323
 
                     conditions_string)
1324
 
        
1325
 
        # Read a line from the file object
1326
 
        cmdline = sender.readline()
1327
 
        if not cmdline:             # Empty line means end of file
1328
 
            # close the IPC pipes
1329
 
            sender.close()
1330
 
            reply.close()
1331
 
            
1332
 
            # Stop calling this function
1333
 
            return False
1334
 
        
1335
 
        logger.debug(u"IPC command: %r", cmdline)
1336
 
        
1337
 
        # Parse and act on command
1338
 
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1339
 
        
1340
 
        if cmd == u"NOTFOUND":
1341
 
            fpr, address = args.split(None, 1)
1342
 
            logger.warning(u"Client not found for fingerprint: %s, ad"
1343
 
                           u"dress: %s", fpr, address)
1344
 
            if self.use_dbus:
1345
 
                # Emit D-Bus signal
1346
 
                mandos_dbus_service.ClientNotFound(fpr, address)
1347
 
        elif cmd == u"DISABLED":
1348
 
            for client in self.clients:
1349
 
                if client.name == args:
1350
 
                    logger.warning(u"Client %s is disabled", args)
1351
 
                    if self.use_dbus:
1352
 
                        # Emit D-Bus signal
1353
 
                        client.Rejected()
1354
 
                    break
1355
 
            else:
1356
 
                logger.error(u"Unknown client %s is disabled", args)
1357
 
        elif cmd == u"SENDING":
1358
 
            for client in self.clients:
1359
 
                if client.name == args:
1360
 
                    logger.info(u"Sending secret to %s", client.name)
1361
 
                    client.checked_ok()
1362
 
                    if self.use_dbus:
1363
 
                        # Emit D-Bus signal
1364
 
                        client.GotSecret()
1365
 
                    break
1366
 
            else:
1367
 
                logger.error(u"Sending secret to unknown client %s",
1368
 
                             args)
1369
 
        elif cmd == u"GETATTR":
1370
 
            attr_name, fpr = args.split(None, 1)
1371
 
            for client in self.clients:
1372
 
                if client.fingerprint == fpr:
1373
 
                    attr_value = getattr(client, attr_name, None)
1374
 
                    logger.debug("IPC reply: %r", attr_value)
1375
 
                    pickle.dump(attr_value, reply)
1376
 
                    break
1377
 
            else:
1378
 
                logger.error(u"Client %s on address %s requesting "
1379
 
                             u"attribute %s not found", fpr, address,
1380
 
                             attr_name)
1381
 
                pickle.dump(None, reply)
1382
 
        else:
1383
 
            logger.error(u"Unknown IPC command: %r", cmdline)
1384
 
        
1385
 
        # Keep calling this function
 
1504
        # error or the other end of multiprocessing.Pipe has closed
 
1505
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1506
            return False
 
1507
        
 
1508
        # Read a request from the child
 
1509
        request = parent_pipe.recv()
 
1510
        command = request[0]
 
1511
        
 
1512
        if command == 'init':
 
1513
            fpr = request[1]
 
1514
            address = request[2]
 
1515
            
 
1516
            for c in self.clients:
 
1517
                if c.fingerprint == fpr:
 
1518
                    client = c
 
1519
                    break
 
1520
            else:
 
1521
                logger.warning(u"Client not found for fingerprint: %s, ad"
 
1522
                               u"dress: %s", fpr, address)
 
1523
                if self.use_dbus:
 
1524
                    # Emit D-Bus signal
 
1525
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
1526
                parent_pipe.send(False)
 
1527
                return False
 
1528
            
 
1529
            gobject.io_add_watch(parent_pipe.fileno(),
 
1530
                                 gobject.IO_IN | gobject.IO_HUP,
 
1531
                                 functools.partial(self.handle_ipc,
 
1532
                                                   parent_pipe = parent_pipe,
 
1533
                                                   client_object = client))
 
1534
            parent_pipe.send(True)
 
1535
            # remove the old hook in favor of the new above hook on same fileno
 
1536
            return False
 
1537
        if command == 'funcall':
 
1538
            funcname = request[1]
 
1539
            args = request[2]
 
1540
            kwargs = request[3]
 
1541
            
 
1542
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1543
 
 
1544
        if command == 'getattr':
 
1545
            attrname = request[1]
 
1546
            if callable(client_object.__getattribute__(attrname)):
 
1547
                parent_pipe.send(('function',))
 
1548
            else:
 
1549
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
1550
        
 
1551
        if command == 'setattr':
 
1552
            attrname = request[1]
 
1553
            value = request[2]
 
1554
            setattr(client_object, attrname, value)
 
1555
 
1386
1556
        return True
1387
1557
 
1388
1558
 
1491
1661
    parser.add_option("--debug", action=u"store_true",
1492
1662
                      help=u"Debug mode; run in foreground and log to"
1493
1663
                      u" terminal")
 
1664
    parser.add_option("--debuglevel", type=u"string", metavar="Level",
 
1665
                      help=u"Debug level for stdout output")
1494
1666
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1495
1667
                      u" priority string (see GnuTLS documentation)")
1496
1668
    parser.add_option("--servicename", type=u"string",
1521
1693
                        u"servicename": u"Mandos",
1522
1694
                        u"use_dbus": u"True",
1523
1695
                        u"use_ipv6": u"True",
 
1696
                        u"debuglevel": u"",
1524
1697
                        }
1525
1698
    
1526
1699
    # Parse config file for server-global settings
1543
1716
    # options, if set.
1544
1717
    for option in (u"interface", u"address", u"port", u"debug",
1545
1718
                   u"priority", u"servicename", u"configdir",
1546
 
                   u"use_dbus", u"use_ipv6"):
 
1719
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
1547
1720
        value = getattr(options, option)
1548
1721
        if value is not None:
1549
1722
            server_settings[option] = value
1558
1731
    
1559
1732
    # For convenience
1560
1733
    debug = server_settings[u"debug"]
 
1734
    debuglevel = server_settings[u"debuglevel"]
1561
1735
    use_dbus = server_settings[u"use_dbus"]
1562
1736
    use_ipv6 = server_settings[u"use_ipv6"]
1563
 
    
1564
 
    if not debug:
1565
 
        syslogger.setLevel(logging.WARNING)
1566
 
        console.setLevel(logging.WARNING)
1567
 
    
 
1737
 
1568
1738
    if server_settings[u"servicename"] != u"Mandos":
1569
1739
        syslogger.setFormatter(logging.Formatter
1570
1740
                               (u'Mandos (%s) [%%(process)d]:'
1576
1746
                        u"interval": u"5m",
1577
1747
                        u"checker": u"fping -q -- %%(host)s",
1578
1748
                        u"host": u"",
 
1749
                        u"approval_delay": u"0s",
 
1750
                        u"approval_duration": u"1s",
1579
1751
                        }
1580
1752
    client_config = configparser.SafeConfigParser(client_defaults)
1581
1753
    client_config.read(os.path.join(server_settings[u"configdir"],
1587
1759
    tcp_server = MandosServer((server_settings[u"address"],
1588
1760
                               server_settings[u"port"]),
1589
1761
                              ClientHandler,
1590
 
                              interface=server_settings[u"interface"],
 
1762
                              interface=(server_settings[u"interface"]
 
1763
                                         or None),
1591
1764
                              use_ipv6=use_ipv6,
1592
1765
                              gnutls_priority=
1593
1766
                              server_settings[u"priority"],
1594
1767
                              use_dbus=use_dbus)
1595
 
    pidfilename = u"/var/run/mandos.pid"
1596
 
    try:
1597
 
        pidfile = open(pidfilename, u"w")
1598
 
    except IOError:
1599
 
        logger.error(u"Could not open file %r", pidfilename)
 
1768
    if not debug:
 
1769
        pidfilename = u"/var/run/mandos.pid"
 
1770
        try:
 
1771
            pidfile = open(pidfilename, u"w")
 
1772
        except IOError:
 
1773
            logger.error(u"Could not open file %r", pidfilename)
1600
1774
    
1601
1775
    try:
1602
1776
        uid = pwd.getpwnam(u"_mandos").pw_uid
1619
1793
        if error[0] != errno.EPERM:
1620
1794
            raise error
1621
1795
    
1622
 
    # Enable all possible GnuTLS debugging
 
1796
    if not debug and not debuglevel:
 
1797
        syslogger.setLevel(logging.WARNING)
 
1798
        console.setLevel(logging.WARNING)
 
1799
    if debuglevel:
 
1800
        level = getattr(logging, debuglevel.upper())
 
1801
        syslogger.setLevel(level)
 
1802
        console.setLevel(level)
 
1803
 
1623
1804
    if debug:
 
1805
        # Enable all possible GnuTLS debugging
 
1806
        
1624
1807
        # "Use a log level over 10 to enable all debugging options."
1625
1808
        # - GnuTLS manual
1626
1809
        gnutls.library.functions.gnutls_global_set_log_level(11)
1631
1814
        
1632
1815
        (gnutls.library.functions
1633
1816
         .gnutls_global_set_log_function(debug_gnutls))
 
1817
        
 
1818
        # Redirect stdin so all checkers get /dev/null
 
1819
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1820
        os.dup2(null, sys.stdin.fileno())
 
1821
        if null > 2:
 
1822
            os.close(null)
 
1823
    else:
 
1824
        # No console logging
 
1825
        logger.removeHandler(console)
 
1826
    
1634
1827
    
1635
1828
    global main_loop
1636
1829
    # From the Avahi example code
1654
1847
    if server_settings["interface"]:
1655
1848
        service.interface = (if_nametoindex
1656
1849
                             (str(server_settings[u"interface"])))
 
1850
 
 
1851
    if not debug:
 
1852
        # Close all input and output, do double fork, etc.
 
1853
        daemon()
 
1854
        
 
1855
    global multiprocessing_manager
 
1856
    multiprocessing_manager = multiprocessing.Manager()
1657
1857
    
1658
1858
    client_class = Client
1659
1859
    if use_dbus:
1660
1860
        client_class = functools.partial(ClientDBus, bus = bus)
 
1861
    def client_config_items(config, section):
 
1862
        special_settings = {
 
1863
            "approved_by_default":
 
1864
                lambda: config.getboolean(section,
 
1865
                                          "approved_by_default"),
 
1866
            }
 
1867
        for name, value in config.items(section):
 
1868
            try:
 
1869
                yield (name, special_settings[name]())
 
1870
            except KeyError:
 
1871
                yield (name, value)
 
1872
    
1661
1873
    tcp_server.clients.update(set(
1662
1874
            client_class(name = section,
1663
 
                         config= dict(client_config.items(section)))
 
1875
                         config= dict(client_config_items(
 
1876
                        client_config, section)))
1664
1877
            for section in client_config.sections()))
1665
1878
    if not tcp_server.clients:
1666
1879
        logger.warning(u"No clients defined")
1667
 
    
1668
 
    if debug:
1669
 
        # Redirect stdin so all checkers get /dev/null
1670
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1671
 
        os.dup2(null, sys.stdin.fileno())
1672
 
        if null > 2:
1673
 
            os.close(null)
1674
 
    else:
1675
 
        # No console logging
1676
 
        logger.removeHandler(console)
1677
 
        # Close all input and output, do double fork, etc.
1678
 
        daemon()
1679
 
    
1680
 
    try:
1681
 
        with pidfile:
1682
 
            pid = os.getpid()
1683
 
            pidfile.write(str(pid) + "\n")
1684
 
        del pidfile
1685
 
    except IOError:
1686
 
        logger.error(u"Could not write to file %r with PID %d",
1687
 
                     pidfilename, pid)
1688
 
    except NameError:
1689
 
        # "pidfile" was never created
1690
 
        pass
1691
 
    del pidfilename
1692
 
    
 
1880
        
1693
1881
    if not debug:
 
1882
        try:
 
1883
            with pidfile:
 
1884
                pid = os.getpid()
 
1885
                pidfile.write(str(pid) + "\n")
 
1886
            del pidfile
 
1887
        except IOError:
 
1888
            logger.error(u"Could not write to file %r with PID %d",
 
1889
                         pidfilename, pid)
 
1890
        except NameError:
 
1891
            # "pidfile" was never created
 
1892
            pass
 
1893
        del pidfilename
 
1894
        
1694
1895
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
1896
 
1695
1897
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1696
1898
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1697
1899