/mandos/trunk : revision 442

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add" and "remove" in the "AvahiService" class, the

10

# "server_state_changed" and "entry_group_state_changed" functions,

11

# and some lines in "main".

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

33

34

from __future__ import division, with_statement, absolute_import

35

36

import SocketServer

36

import SocketServer as socketserver

37

import socket

38

import optparse

39

import datetime

44

import gnutls.library.functions

45

import gnutls.library.constants

46

import gnutls.library.types

47

import ConfigParser

47

import ConfigParser as configparser

48

import sys

49

import re

50

import os

51

import signal

52

from sets import Set

53

52

import subprocess

54

53

import atexit

55

54

import stat

56

55

import logging

57

56

import logging.handlers

58

57

import pwd

59

from contextlib import closing

58

import contextlib

60

59

import struct

61

60

import fcntl

61

import functools

62

import cPickle as pickle

63

import multiprocessing

62

64

63

65

import dbus

64

66

import dbus.service

67

69

from dbus.mainloop.glib import DBusGMainLoop

68

70

import ctypes

69

71

import ctypes.util

72

import xml.dom.minidom

73

import inspect

70

74

71

75

try:

72

76

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

74

78

try:

75

79

from IN import SO_BINDTODEVICE

76

80

except ImportError:

77

# From /usr/include/asm/socket.h

78

SO_BINDTODEVICE = 25

79

80

81

version = "1.0.8"

82

81

SO_BINDTODEVICE = None

82

83

84

version = "1.0.14"

85

86

#logger = logging.getLogger(u'mandos')

83

87

logger = logging.Logger(u'mandos')

84

88

syslogger = (logging.handlers.SysLogHandler

85

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

125

129

max_renames: integer; maximum number of renames

126

130

rename_count: integer; counter so we only rename after collisions

127

131

a sensible number of times

132

group: D-Bus Entry Group

133

server: D-Bus Server

134

bus: dbus.SystemBus()

128

135

"""

129

136

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

130

137

servicetype = None, port = None, TXT = None,

131

138

domain = u"", host = u"", max_renames = 32768,

132

protocol = avahi.PROTO_UNSPEC):

139

protocol = avahi.PROTO_UNSPEC, bus = None):

133

140

self.interface = interface

134

141

self.name = name

135

142

self.type = servicetype

140

147

self.rename_count = 0

141

148

self.max_renames = max_renames

142

149

self.protocol = protocol

150

self.group = None # our entry group

151

self.server = None

152

self.bus = bus

143

153

def rename(self):

144

154

"""Derived from the Avahi example code"""

145

155

if self.rename_count >= self.max_renames:

147

157

u" after %i retries, exiting.",

148

158

self.rename_count)

149

159

raise AvahiServiceError(u"Too many renames")

150

self.name = server.GetAlternativeServiceName(self.name)

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

151

161

logger.info(u"Changing Zeroconf service name to %r ...",

152

162

self.name)

153

163

syslogger.setFormatter(logging.Formatter

155

165

u' %%(levelname)s: %%(message)s'

156

166

% self.name))

157

167

self.remove()

158

self.add()

168

try:

169

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

172

self.cleanup()

173

os._exit(1)

159

174

self.rename_count += 1

160

175

def remove(self):

161

176

"""Derived from the Avahi example code"""

162

if group is not None:

163

group.Reset()

177

if self.group is not None:

178

self.group.Reset()

164

179

def add(self):

165

180

"""Derived from the Avahi example code"""

166

global group

167

if group is None:

168

group = dbus.Interface(bus.get_object

169

(avahi.DBUS_NAME,

170

server.EntryGroupNew()),

171

avahi.DBUS_INTERFACE_ENTRY_GROUP)

172

group.connect_to_signal('StateChanged',

173

entry_group_state_changed)

181

if self.group is None:

182

self.group = dbus.Interface(

183

self.bus.get_object(avahi.DBUS_NAME,

184

self.server.EntryGroupNew()),

185

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

174

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

175

service.name, service.type)

176

group.AddService(

177

self.interface, # interface

178

self.protocol, # protocol

179

dbus.UInt32(0), # flags

180

self.name, self.type,

181

self.domain, self.host,

182

dbus.UInt16(self.port),

183

avahi.string_array_to_txt_array(self.TXT))

184

group.Commit()

185

186

# From the Avahi example code:

187

group = None # our entry group

188

# End of Avahi example code

189

190

191

def _datetime_to_dbus(dt, variant_level=0):

192

"""Convert a UTC datetime.datetime() to a D-Bus type."""

193

return dbus.String(dt.isoformat(), variant_level=variant_level)

190

self.name, self.type)

191

self.group.AddService(

192

self.interface,

193

self.protocol,

194

dbus.UInt32(0), # flags

195

self.name, self.type,

196

self.domain, self.host,

197

dbus.UInt16(self.port),

198

avahi.string_array_to_txt_array(self.TXT))

199

self.group.Commit()

200

def entry_group_state_changed(self, state, error):

201

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

203

204

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

logger.debug(u"Zeroconf service established.")

206

elif state == avahi.ENTRY_GROUP_COLLISION:

207

logger.warning(u"Zeroconf service name collision.")

208

self.rename()

209

elif state == avahi.ENTRY_GROUP_FAILURE:

210

logger.critical(u"Avahi: Error in group state changed %s",

211

unicode(error))

212

raise AvahiGroupError(u"State changed: %s"

213

% unicode(error))

214

def cleanup(self):

215

"""Derived from the Avahi example code"""

216

if self.group is not None:

217

self.group.Free()

218

self.group = None

219

def server_state_changed(self, state):

220

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

225

elif state == avahi.SERVER_RUNNING:

226

self.add()

227

def activate(self):

228

"""Derived from the Avahi example code"""

229

if self.server is None:

230

self.server = dbus.Interface(

231

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

233

avahi.DBUS_INTERFACE_SERVER)

234

self.server.connect_to_signal(u"StateChanged",

235

self.server_state_changed)

236

self.server_state_changed(self.server.GetState())

194

237

195

238

196

239

class Client(object):

197

240

"""A representation of a client host served by this server.

198

241

199

242

Attributes:

200

name: string; from the config file, used in log messages and

201

D-Bus identifiers

202

fingerprint: string (40 or 32 hexadecimal digits); used to

203

uniquely identify the client

204

secret: bytestring; sent verbatim (over TLS) to client

205

host: string; available for use by the checker command

206

created: datetime.datetime(); (UTC) object creation

207

last_enabled: datetime.datetime(); (UTC)

208

enabled: bool()

209

last_checked_ok: datetime.datetime(); (UTC) or None

210

timeout: datetime.timedelta(); How long from last_checked_ok

211

until this client is invalid

212

interval: datetime.timedelta(); How often to start a new checker

213

disable_hook: If set, called by disable() as disable_hook(self)

243

_approved: bool(); 'None' if not yet approved/disapproved

244

approval_delay: datetime.timedelta(); Time to wait for approval

245

approval_duration: datetime.timedelta(); Duration of one approval

214

246

checker: subprocess.Popen(); a running checker process used

215

247

to see if the client lives.

216

248

'None' if no process is running.

217

checker_initiator_tag: a gobject event source tag, or None

218

disable_initiator_tag: - '' -

219

checker_callback_tag: - '' -

220

checker_command: string; External command which is run to check if

221

client lives. %() expansions are done at

249

checker_callback_tag: a gobject event source tag, or None

250

checker_command: string; External command which is run to check

251

if client lives. %() expansions are done at

222

252

runtime with vars(self) as dict, so that for

223

253

instance %(name)s can be used in the command.

254

checker_initiator_tag: a gobject event source tag, or None

255

created: datetime.datetime(); (UTC) object creation

224

256

current_checker_command: string; current running checker_command

257

disable_hook: If set, called by disable() as disable_hook(self)

258

disable_initiator_tag: a gobject event source tag, or None

259

enabled: bool()

260

fingerprint: string (40 or 32 hexadecimal digits); used to

261

uniquely identify the client

262

host: string; available for use by the checker command

263

interval: datetime.timedelta(); How often to start a new checker

264

last_approval_request: datetime.datetime(); (UTC) or None

265

last_checked_ok: datetime.datetime(); (UTC) or None

266

last_enabled: datetime.datetime(); (UTC)

267

name: string; from the config file, used in log messages and

268

D-Bus identifiers

269

secret: bytestring; sent verbatim (over TLS) to client

270

timeout: datetime.timedelta(); How long from last_checked_ok

271

until this client is disabled

272

runtime_expansions: Allowed attributes for runtime expansion.

225

273

"""

226

274

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

227

280

@staticmethod

228

def _datetime_to_milliseconds(dt):

229

"Convert a datetime.datetime() to milliseconds"

230

return ((dt.days * 24 * 60 * 60 * 1000)

231

+ (dt.seconds * 1000)

232

+ (dt.microseconds // 1000))

281

def _timedelta_to_milliseconds(td):

282

"Convert a datetime.timedelta() to milliseconds"

283

return ((td.days * 24 * 60 * 60 * 1000)

284

+ (td.seconds * 1000)

285

+ (td.microseconds // 1000))

233

286

234

287

def timeout_milliseconds(self):

235

288

"Return the 'timeout' attribute in milliseconds"

236

return self._datetime_to_milliseconds(self.timeout)

289

return self._timedelta_to_milliseconds(self.timeout)

237

290

238

291

def interval_milliseconds(self):

239

292

"Return the 'interval' attribute in milliseconds"

240

return self._datetime_to_milliseconds(self.interval)

293

return self._timedelta_to_milliseconds(self.interval)

294

295

def approval_delay_milliseconds(self):

296

return self._timedelta_to_milliseconds(self.approval_delay)

241

297

242

298

def __init__(self, name = None, disable_hook=None, config=None):

243

299

"""Note: the 'checker' key in 'config' sets the

256

312

if u"secret" in config:

257

313

self.secret = config[u"secret"].decode(u"base64")

258

314

elif u"secfile" in config:

259

with closing(open(os.path.expanduser

260

(os.path.expandvars

261

(config[u"secfile"])))) as secfile:

315

with open(os.path.expanduser(os.path.expandvars

316

(config[u"secfile"])),

317

"rb") as secfile:

262

318

self.secret = secfile.read()

263

319

else:

264

320

raise TypeError(u"No secret or secfile for client %s"

266

322

self.host = config.get(u"host", u"")

267

323

self.created = datetime.datetime.utcnow()

268

324

self.enabled = False

325

self.last_approval_request = None

269

326

self.last_enabled = None

270

327

self.last_checked_ok = None

271

328

self.timeout = string_to_delta(config[u"timeout"])

278

335

self.checker_command = config[u"checker"]

279

336

self.current_checker_command = None

280

337

self.last_connect = None

338

self._approved = None

339

self.approved_by_default = config.get(u"approved_by_default",

340

True)

341

self.approvals_pending = 0

342

self.approval_delay = string_to_delta(

343

config[u"approval_delay"])

344

self.approval_duration = string_to_delta(

345

config[u"approval_duration"])

346

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

281

347

348

def send_changedstate(self):

349

self.changedstate.acquire()

350

self.changedstate.notify_all()

351

self.changedstate.release()

352

282

353

def enable(self):

283

354

"""Start this client's checker and timeout hooks"""

355

if getattr(self, u"enabled", False):

356

# Already enabled

357

return

358

self.send_changedstate()

284

359

self.last_enabled = datetime.datetime.utcnow()

285

360

# Schedule a new checker to be started an 'interval' from now,

286

361

# and every interval from then on.

287

362

self.checker_initiator_tag = (gobject.timeout_add

288

363

(self.interval_milliseconds(),

289

364

self.start_checker))

290

# Also start a new checker *right now*.

291

self.start_checker()

292

365

# Schedule a disable() when 'timeout' has passed

293

366

self.disable_initiator_tag = (gobject.timeout_add

294

367

(self.timeout_milliseconds(),

295

368

self.disable))

296

369

self.enabled = True

370

# Also start a new checker *right now*.

371

self.start_checker()

297

372

298

def disable(self):

373

def disable(self, quiet=True):

299

374

"""Disable this client."""

300

375

if not getattr(self, "enabled", False):

301

376

return False

302

logger.info(u"Disabling client %s", self.name)

377

if not quiet:

378

self.send_changedstate()

379

if not quiet:

380

logger.info(u"Disabling client %s", self.name)

303

381

if getattr(self, u"disable_initiator_tag", False):

304

382

gobject.source_remove(self.disable_initiator_tag)

305

383

self.disable_initiator_tag = None

346

424

(self.timeout_milliseconds(),

347

425

self.disable))

348

426

427

def need_approval(self):

428

self.last_approval_request = datetime.datetime.utcnow()

429

349

430

def start_checker(self):

350

431

"""Start a new checker subprocess if one is not running.

351

432

357

438

# client would inevitably timeout, since no checker would get

358

439

# a chance to run to completion. If we instead leave running

359

440

# checkers alone, the checker would have to take more time

360

# than 'timeout' for the client to be declared invalid, which

361

# is as it should be.

441

# than 'timeout' for the client to be disabled, which is as it

442

# should be.

362

443

363

444

# If a checker exists, make sure it is not a zombie

364

if self.checker is not None:

445

try:

365

446

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

447

except (AttributeError, OSError), error:

448

if (isinstance(error, OSError)

449

and error.errno != errno.ECHILD):

450

raise error

451

else:

366

452

if pid:

367

453

logger.warning(u"Checker was a zombie")

368

454

gobject.source_remove(self.checker_callback_tag)

375

461

command = self.checker_command % self.host

376

462

except TypeError:

377

463

# Escape attributes for the shell

378

escaped_attrs = dict((key,

379

re.escape(unicode(str(val),

380

errors=

381

u'replace')))

382

for key, val in

383

vars(self).iteritems())

464

escaped_attrs = dict(

465

(attr,

466

re.escape(unicode(str(getattr(self, attr, u"")),

467

errors=

468

u'replace')))

469

for attr in

470

self.runtime_expansions)

471

384

472

try:

385

473

command = self.checker_command % escaped_attrs

386

474

except TypeError, error:

424

512

logger.debug(u"Stopping checker for %(name)s", vars(self))

425

513

try:

426

514

os.kill(self.checker.pid, signal.SIGTERM)

427

#os.sleep(0.5)

515

#time.sleep(0.5)

428

516

#if self.checker.poll() is None:

429

517

# os.kill(self.checker.pid, signal.SIGKILL)

430

518

except OSError, error:

431

519

if error.errno != errno.ESRCH: # No such process

432

520

raise

433

521

self.checker = None

434

435

def still_valid(self):

436

"""Has the timeout not yet passed for this client?"""

437

if not getattr(self, u"enabled", False):

438

return False

439

now = datetime.datetime.utcnow()

440

if self.last_checked_ok is None:

441

return now < (self.created + self.timeout)

442

else:

443

return now < (self.last_checked_ok + self.timeout)

444

445

446

class ClientDBus(Client, dbus.service.Object):

522

523

def dbus_service_property(dbus_interface, signature=u"v",

524

access=u"readwrite", byte_arrays=False):

525

"""Decorators for marking methods of a DBusObjectWithProperties to

526

become properties on the D-Bus.

527

528

The decorated method will be called with no arguments by "Get"

529

and with one argument by "Set".

530

531

The parameters, where they are supported, are the same as

532

dbus.service.method, except there is only "signature", since the

533

type from Get() and the type sent to Set() is the same.

534

"""

535

# Encoding deeply encoded byte arrays is not supported yet by the

536

# "Set" method, so we fail early here:

537

if byte_arrays and signature != u"ay":

538

raise ValueError(u"Byte arrays not supported for non-'ay'"

539

u" signature %r" % signature)

540

def decorator(func):

541

func._dbus_is_property = True

542

func._dbus_interface = dbus_interface

543

func._dbus_signature = signature

544

func._dbus_access = access

545

func._dbus_name = func.__name__

546

if func._dbus_name.endswith(u"_dbus_property"):

547

func._dbus_name = func._dbus_name[:-14]

548

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

549

return func

550

return decorator

551

552

553

class DBusPropertyException(dbus.exceptions.DBusException):

554

"""A base class for D-Bus property-related exceptions

555

"""

556

def __unicode__(self):

557

return unicode(str(self))

558

559

560

class DBusPropertyAccessException(DBusPropertyException):

561

"""A property's access permissions disallows an operation.

562

"""

563

pass

564

565

566

class DBusPropertyNotFound(DBusPropertyException):

567

"""An attempt was made to access a non-existing property.

568

"""

569

pass

570

571

572

class DBusObjectWithProperties(dbus.service.Object):

573

"""A D-Bus object with properties.

574

575

Classes inheriting from this can use the dbus_service_property

576

decorator to expose methods as D-Bus properties. It exposes the

577

standard Get(), Set(), and GetAll() methods on the D-Bus.

578

"""

579

580

@staticmethod

581

def _is_dbus_property(obj):

582

return getattr(obj, u"_dbus_is_property", False)

583

584

def _get_all_dbus_properties(self):

585

"""Returns a generator of (name, attribute) pairs

586

"""

587

return ((prop._dbus_name, prop)

588

for name, prop in

589

inspect.getmembers(self, self._is_dbus_property))

590

591

def _get_dbus_property(self, interface_name, property_name):

592

"""Returns a bound method if one exists which is a D-Bus

593

property with the specified name and interface.

594

"""

595

for name in (property_name,

596

property_name + u"_dbus_property"):

597

prop = getattr(self, name, None)

598

if (prop is None

599

or not self._is_dbus_property(prop)

600

or prop._dbus_name != property_name

601

or (interface_name and prop._dbus_interface

602

and interface_name != prop._dbus_interface)):

603

continue

604

return prop

605

# No such property

606

raise DBusPropertyNotFound(self.dbus_object_path + u":"

607

+ interface_name + u"."

608

+ property_name)

609

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

611

out_signature=u"v")

612

def Get(self, interface_name, property_name):

613

"""Standard D-Bus property Get() method, see D-Bus standard.

614

"""

615

prop = self._get_dbus_property(interface_name, property_name)

616

if prop._dbus_access == u"write":

617

raise DBusPropertyAccessException(property_name)

618

value = prop()

619

if not hasattr(value, u"variant_level"):

620

return value

621

return type(value)(value, variant_level=value.variant_level+1)

622

623

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

624

def Set(self, interface_name, property_name, value):

625

"""Standard D-Bus property Set() method, see D-Bus standard.

626

"""

627

prop = self._get_dbus_property(interface_name, property_name)

628

if prop._dbus_access == u"read":

629

raise DBusPropertyAccessException(property_name)

630

if prop._dbus_get_args_options[u"byte_arrays"]:

631

# The byte_arrays option is not supported yet on

632

# signatures other than "ay".

633

if prop._dbus_signature != u"ay":

634

raise ValueError

635

value = dbus.ByteArray(''.join(unichr(byte)

636

for byte in value))

637

prop(value)

638

639

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

640

out_signature=u"a{sv}")

641

def GetAll(self, interface_name):

642

"""Standard D-Bus property GetAll() method, see D-Bus

643

standard.

644

645

Note: Will not include properties with access="write".

646

"""

647

all = {}

648

for name, prop in self._get_all_dbus_properties():

649

if (interface_name

650

and interface_name != prop._dbus_interface):

651

# Interface non-empty but did not match

652

continue

653

# Ignore write-only properties

654

if prop._dbus_access == u"write":

655

continue

656

value = prop()

657

if not hasattr(value, u"variant_level"):

658

all[name] = value

659

continue

660

all[name] = type(value)(value, variant_level=

661

value.variant_level+1)

662

return dbus.Dictionary(all, signature=u"sv")

663

664

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

665

out_signature=u"s",

666

path_keyword='object_path',

667

connection_keyword='connection')

668

def Introspect(self, object_path, connection):

669

"""Standard D-Bus method, overloaded to insert property tags.

670

"""

671

xmlstring = dbus.service.Object.Introspect(self, object_path,

672

connection)

673

try:

674

document = xml.dom.minidom.parseString(xmlstring)

675

def make_tag(document, name, prop):

676

e = document.createElement(u"property")

677

e.setAttribute(u"name", name)

678

e.setAttribute(u"type", prop._dbus_signature)

679

e.setAttribute(u"access", prop._dbus_access)

680

return e

681

for if_tag in document.getElementsByTagName(u"interface"):

682

for tag in (make_tag(document, name, prop)

683

for name, prop

684

in self._get_all_dbus_properties()

685

if prop._dbus_interface

686

== if_tag.getAttribute(u"name")):

687

if_tag.appendChild(tag)

688

# Add the names to the return values for the

689

# "org.freedesktop.DBus.Properties" methods

690

if (if_tag.getAttribute(u"name")

691

== u"org.freedesktop.DBus.Properties"):

692

for cn in if_tag.getElementsByTagName(u"method"):

693

if cn.getAttribute(u"name") == u"Get":

694

for arg in cn.getElementsByTagName(u"arg"):

695

if (arg.getAttribute(u"direction")

696

== u"out"):

697

arg.setAttribute(u"name", u"value")

698

elif cn.getAttribute(u"name") == u"GetAll":

699

for arg in cn.getElementsByTagName(u"arg"):

700

if (arg.getAttribute(u"direction")

701

== u"out"):

702

arg.setAttribute(u"name", u"props")

703

xmlstring = document.toxml(u"utf-8")

704

document.unlink()

705

except (AttributeError, xml.dom.DOMException,

706

xml.parsers.expat.ExpatError), error:

707

logger.error(u"Failed to override Introspection method",

708

error)

709

return xmlstring

710

711

712

class ClientDBus(Client, DBusObjectWithProperties):

447

713

"""A Client class using D-Bus

448

714

449

715

Attributes:

450

dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus

716

dbus_object_path: dbus.ObjectPath

717

bus: dbus.SystemBus()

451

718

"""

719

720

runtime_expansions = (Client.runtime_expansions

721

+ (u"dbus_object_path",))

722

452

723

# dbus.service.Object doesn't use super(), so we can't either.

453

724

454

def __init__(self, *args, **kwargs):

725

def __init__(self, bus = None, *args, **kwargs):

726

self._approvals_pending = 0

727

self.bus = bus

455

728

Client.__init__(self, *args, **kwargs)

456

729

# Only now, when this client is initialized, can it show up on

457

730

# the D-Bus

731

client_object_name = unicode(self.name).translate(

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

458

734

self.dbus_object_path = (dbus.ObjectPath

459

(u"/clients/"

460

+ self.name.replace(u".", u"_")))

461

dbus.service.Object.__init__(self, bus,

462

self.dbus_object_path)

735

(u"/clients/" + client_object_name))

736

DBusObjectWithProperties.__init__(self, self.bus,

737

self.dbus_object_path)

738

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

750

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

754

755

@staticmethod

756

def _datetime_to_dbus(dt, variant_level=0):

757

"""Convert a UTC datetime.datetime() to a D-Bus type."""

758

return dbus.String(dt.isoformat(),

759

variant_level=variant_level)

760

463

761

def enable(self):

464

762

oldstate = getattr(self, u"enabled", False)

465

763

r = Client.enable(self)

466

764

if oldstate != self.enabled:

467

765

# Emit D-Bus signals

468

self.PropertyChanged(dbus.String(u"enabled"),

766

self.PropertyChanged(dbus.String(u"Enabled"),

469

767

dbus.Boolean(True, variant_level=1))

470

self.PropertyChanged(dbus.String(u"last_enabled"),

471

(_datetime_to_dbus(self.last_enabled,

472

variant_level=1)))

768

self.PropertyChanged(

769

dbus.String(u"LastEnabled"),

770

self._datetime_to_dbus(self.last_enabled,

771

variant_level=1))

473

772

return r

474

773

475

def disable(self, signal = True):

774

def disable(self, quiet = False):

476

775

oldstate = getattr(self, u"enabled", False)

477

r = Client.disable(self)

478

if signal and oldstate != self.enabled:

776

r = Client.disable(self, quiet=quiet)

777

if not quiet and oldstate != self.enabled:

479

778

# Emit D-Bus signal

480

self.PropertyChanged(dbus.String(u"enabled"),

779

self.PropertyChanged(dbus.String(u"Enabled"),

481

780

dbus.Boolean(False, variant_level=1))

482

781

return r

483

782

486

785

self.remove_from_connection()

487

786

except LookupError:

488

787

pass

489

if hasattr(dbus.service.Object, u"__del__"):

490

dbus.service.Object.__del__(self, *args, **kwargs)

788

if hasattr(DBusObjectWithProperties, u"__del__"):

789

DBusObjectWithProperties.__del__(self, *args, **kwargs)

491

790

Client.__del__(self, *args, **kwargs)

492

791

493

792

def checker_callback(self, pid, condition, command,

495

794

self.checker_callback_tag = None

496

795

self.checker = None

497

796

# Emit D-Bus signal

498

self.PropertyChanged(dbus.String(u"checker_running"),

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

499

798

dbus.Boolean(False, variant_level=1))

500

799

if os.WIFEXITED(condition):

501

800

exitstatus = os.WEXITSTATUS(condition)

516

815

r = Client.checked_ok(self, *args, **kwargs)

517

816

# Emit D-Bus signal

518

817

self.PropertyChanged(

519

dbus.String(u"last_checked_ok"),

520

(_datetime_to_dbus(self.last_checked_ok,

521

variant_level=1)))

818

dbus.String(u"LastCheckedOK"),

819

(self._datetime_to_dbus(self.last_checked_ok,

820

variant_level=1)))

821

return r

822

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

522

830

return r

523

831

524

832

def start_checker(self, *args, **kwargs):

534

842

# Emit D-Bus signal

535

843

self.CheckerStarted(self.current_checker_command)

536

844

self.PropertyChanged(

537

dbus.String(u"checker_running"),

845

dbus.String(u"CheckerRunning"),

538

846

dbus.Boolean(True, variant_level=1))

539

847

return r

540

848

543

851

r = Client.stop_checker(self, *args, **kwargs)

544

852

if (old_checker is not None

545

853

and getattr(self, u"checker", None) is None):

546

self.PropertyChanged(dbus.String(u"checker_running"),

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

547

855

dbus.Boolean(False, variant_level=1))

548

856

return r

549

550

## D-Bus methods & signals

857

858

def _reset_approved(self):

859

self._approved = None

860

return False

861

862

def approve(self, value=True):

863

self.send_changedstate()

864

self._approved = value

865

gobject.timeout_add(self._timedelta_to_milliseconds

866

(self.approval_duration),

867

self._reset_approved)

868

869

870

## D-Bus methods, signals & properties

551

871

_interface = u"se.bsnet.fukt.Mandos.Client"

552

872

553

# CheckedOK - method

554

@dbus.service.method(_interface)

555

def CheckedOK(self):

556

return self.checked_ok()

873

## Signals

557

874

558

875

# CheckerCompleted - signal

559

876

@dbus.service.signal(_interface, signature=u"nxs")

567

884

"D-Bus signal"

568

885

pass

569

886

570

# GetAllProperties - method

571

@dbus.service.method(_interface, out_signature=u"a{sv}")

572

def GetAllProperties(self):

573

"D-Bus method"

574

return dbus.Dictionary({

575

dbus.String(u"name"):

576

dbus.String(self.name, variant_level=1),

577

dbus.String(u"fingerprint"):

578

dbus.String(self.fingerprint, variant_level=1),

579

dbus.String(u"host"):

580

dbus.String(self.host, variant_level=1),

581

dbus.String(u"created"):

582

_datetime_to_dbus(self.created, variant_level=1),

583

dbus.String(u"last_enabled"):

584

(_datetime_to_dbus(self.last_enabled,

585

variant_level=1)

586

if self.last_enabled is not None

587

else dbus.Boolean(False, variant_level=1)),

588

dbus.String(u"enabled"):

589

dbus.Boolean(self.enabled, variant_level=1),

590

dbus.String(u"last_checked_ok"):

591

(_datetime_to_dbus(self.last_checked_ok,

592

variant_level=1)

593

if self.last_checked_ok is not None

594

else dbus.Boolean (False, variant_level=1)),

595

dbus.String(u"timeout"):

596

dbus.UInt64(self.timeout_milliseconds(),

597

variant_level=1),

598

dbus.String(u"interval"):

599

dbus.UInt64(self.interval_milliseconds(),

600

variant_level=1),

601

dbus.String(u"checker"):

602

dbus.String(self.checker_command,

603

variant_level=1),

604

dbus.String(u"checker_running"):

605

dbus.Boolean(self.checker is not None,

606

variant_level=1),

607

dbus.String(u"object_path"):

608

dbus.ObjectPath(self.dbus_object_path,

609

variant_level=1)

610

}, signature=u"sv")

611

612

# IsStillValid - method

613

@dbus.service.method(_interface, out_signature=u"b")

614

def IsStillValid(self):

615

return self.still_valid()

616

617

887

# PropertyChanged - signal

618

888

@dbus.service.signal(_interface, signature=u"sv")

619

889

def PropertyChanged(self, property, value):

620

890

"D-Bus signal"

621

891

pass

622

892

623

# ReceivedSecret - signal

893

# GotSecret - signal

624

894

@dbus.service.signal(_interface)

625

def ReceivedSecret(self):

626

"D-Bus signal"

895

def GotSecret(self):

896

"""D-Bus signal

897

Is sent after a successful transfer of secret from the Mandos

898

server to mandos-client

899

"""

627

900

pass

628

901

629

902

# Rejected - signal

630

@dbus.service.signal(_interface)

631

def Rejected(self):

903

@dbus.service.signal(_interface, signature=u"s")

904

def Rejected(self, reason):

632

905

"D-Bus signal"

633

906

pass

634

907

635

# SetChecker - method

636

@dbus.service.method(_interface, in_signature=u"s")

637

def SetChecker(self, checker):

638

"D-Bus setter method"

639

self.checker_command = checker

640

# Emit D-Bus signal

641

self.PropertyChanged(dbus.String(u"checker"),

642

dbus.String(self.checker_command,

643

variant_level=1))

644

645

# SetHost - method

646

@dbus.service.method(_interface, in_signature=u"s")

647

def SetHost(self, host):

648

"D-Bus setter method"

649

self.host = host

650

# Emit D-Bus signal

651

self.PropertyChanged(dbus.String(u"host"),

652

dbus.String(self.host, variant_level=1))

653

654

# SetInterval - method

655

@dbus.service.method(_interface, in_signature=u"t")

656

def SetInterval(self, milliseconds):

657

self.interval = datetime.timedelta(0, 0, 0, milliseconds)

658

# Emit D-Bus signal

659

self.PropertyChanged(dbus.String(u"interval"),

660

(dbus.UInt64(self.interval_milliseconds(),

661

variant_level=1)))

662

663

# SetSecret - method

664

@dbus.service.method(_interface, in_signature=u"ay",

665

byte_arrays=True)

666

def SetSecret(self, secret):

667

"D-Bus setter method"

668

self.secret = str(secret)

669

670

# SetTimeout - method

671

@dbus.service.method(_interface, in_signature=u"t")

672

def SetTimeout(self, milliseconds):

673

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

674

# Emit D-Bus signal

675

self.PropertyChanged(dbus.String(u"timeout"),

676

(dbus.UInt64(self.timeout_milliseconds(),

677

variant_level=1)))

908

# NeedApproval - signal

909

@dbus.service.signal(_interface, signature=u"tb")

910

def NeedApproval(self, timeout, default):

911

"D-Bus signal"

912

return self.need_approval()

913

914

## Methods

915

916

# Approve - method

917

@dbus.service.method(_interface, in_signature=u"b")

918

def Approve(self, value):

919

self.approve(value)

920

921

# CheckedOK - method

922

@dbus.service.method(_interface)

923

def CheckedOK(self):

924

return self.checked_ok()

678

925

679

926

# Enable - method

680

927

@dbus.service.method(_interface)

699

946

def StopChecker(self):

700

947

self.stop_checker()

701

948

949

## Properties

950

951

# ApprovalPending - property

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

953

def ApprovalPending_dbus_property(self):

954

return dbus.Boolean(bool(self.approvals_pending))

955

956

# ApprovedByDefault - property

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

959

def ApprovedByDefault_dbus_property(self, value=None):

960

if value is None: # get

961

return dbus.Boolean(self.approved_by_default)

962

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

966

967

# ApprovalDelay - property

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

970

def ApprovalDelay_dbus_property(self, value=None):

971

if value is None: # get

972

return dbus.UInt64(self.approval_delay_milliseconds())

973

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

977

978

# ApprovalDuration - property

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

981

def ApprovalDuration_dbus_property(self, value=None):

982

if value is None: # get

983

return dbus.UInt64(self._timedelta_to_milliseconds(

984

self.approval_duration))

985

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

989

990

# Name - property

991

@dbus_service_property(_interface, signature=u"s", access=u"read")

992

def Name_dbus_property(self):

993

return dbus.String(self.name)

994

995

# Fingerprint - property

996

@dbus_service_property(_interface, signature=u"s", access=u"read")

997

def Fingerprint_dbus_property(self):

998

return dbus.String(self.fingerprint)

999

1000

# Host - property

1001

@dbus_service_property(_interface, signature=u"s",

1002

access=u"readwrite")

1003

def Host_dbus_property(self, value=None):

1004

if value is None: # get

1005

return dbus.String(self.host)

1006

self.host = value

1007

# Emit D-Bus signal

1008

self.PropertyChanged(dbus.String(u"Host"),

1009

dbus.String(value, variant_level=1))

1010

1011

# Created - property

1012

@dbus_service_property(_interface, signature=u"s", access=u"read")

1013

def Created_dbus_property(self):

1014

return dbus.String(self._datetime_to_dbus(self.created))

1015

1016

# LastEnabled - property

1017

@dbus_service_property(_interface, signature=u"s", access=u"read")

1018

def LastEnabled_dbus_property(self):

1019

if self.last_enabled is None:

1020

return dbus.String(u"")

1021

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1022

1023

# Enabled - property

1024

@dbus_service_property(_interface, signature=u"b",

1025

access=u"readwrite")

1026

def Enabled_dbus_property(self, value=None):

1027

if value is None: # get

1028

return dbus.Boolean(self.enabled)

1029

if value:

1030

self.enable()

1031

else:

1032

self.disable()

1033

1034

# LastCheckedOK - property

1035

@dbus_service_property(_interface, signature=u"s",

1036

access=u"readwrite")

1037

def LastCheckedOK_dbus_property(self, value=None):

1038

if value is not None:

1039

self.checked_ok()

1040

return

1041

if self.last_checked_ok is None:

1042

return dbus.String(u"")

1043

return dbus.String(self._datetime_to_dbus(self

1044

.last_checked_ok))

1045

1046

# LastApprovalRequest - property

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1048

def LastApprovalRequest_dbus_property(self):

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1054

1055

# Timeout - property

1056

@dbus_service_property(_interface, signature=u"t",

1057

access=u"readwrite")

1058

def Timeout_dbus_property(self, value=None):

1059

if value is None: # get

1060

return dbus.UInt64(self.timeout_milliseconds())

1061

self.timeout = datetime.timedelta(0, 0, 0, value)

1062

# Emit D-Bus signal

1063

self.PropertyChanged(dbus.String(u"Timeout"),

1064

dbus.UInt64(value, variant_level=1))

1065

if getattr(self, u"disable_initiator_tag", None) is None:

1066

return

1067

# Reschedule timeout

1068

gobject.source_remove(self.disable_initiator_tag)

1069

self.disable_initiator_tag = None

1070

time_to_die = (self.

1071

_timedelta_to_milliseconds((self

1072

.last_checked_ok

1073

+ self.timeout)

1074

- datetime.datetime

1075

.utcnow()))

1076

if time_to_die <= 0:

1077

# The timeout has passed

1078

self.disable()

1079

else:

1080

self.disable_initiator_tag = (gobject.timeout_add

1081

(time_to_die, self.disable))

1082

1083

# Interval - property

1084

@dbus_service_property(_interface, signature=u"t",

1085

access=u"readwrite")

1086

def Interval_dbus_property(self, value=None):

1087

if value is None: # get

1088

return dbus.UInt64(self.interval_milliseconds())

1089

self.interval = datetime.timedelta(0, 0, 0, value)

1090

# Emit D-Bus signal

1091

self.PropertyChanged(dbus.String(u"Interval"),

1092

dbus.UInt64(value, variant_level=1))

1093

if getattr(self, u"checker_initiator_tag", None) is None:

1094

return

1095

# Reschedule checker run

1096

gobject.source_remove(self.checker_initiator_tag)

1097

self.checker_initiator_tag = (gobject.timeout_add

1098

(value, self.start_checker))

1099

self.start_checker() # Start one now, too

1100

1101

# Checker - property

1102

@dbus_service_property(_interface, signature=u"s",

1103

access=u"readwrite")

1104

def Checker_dbus_property(self, value=None):

1105

if value is None: # get

1106

return dbus.String(self.checker_command)

1107

self.checker_command = value

1108

# Emit D-Bus signal

1109

self.PropertyChanged(dbus.String(u"Checker"),

1110

dbus.String(self.checker_command,

1111

variant_level=1))

1112

1113

# CheckerRunning - property

1114

@dbus_service_property(_interface, signature=u"b",

1115

access=u"readwrite")

1116

def CheckerRunning_dbus_property(self, value=None):

1117

if value is None: # get

1118

return dbus.Boolean(self.checker is not None)

1119

if value:

1120

self.start_checker()

1121

else:

1122

self.stop_checker()

1123

1124

# ObjectPath - property

1125

@dbus_service_property(_interface, signature=u"o", access=u"read")

1126

def ObjectPath_dbus_property(self):

1127

return self.dbus_object_path # is already a dbus.ObjectPath

1128

1129

# Secret = property

1130

@dbus_service_property(_interface, signature=u"ay",

1131

access=u"write", byte_arrays=True)

1132

def Secret_dbus_property(self, value):

1133

self.secret = str(value)

1134

702

1135

del _interface

703

1136

704

1137

705

class ClientHandler(SocketServer.BaseRequestHandler, object):

1138

class ProxyClient(object):

1139

def __init__(self, child_pipe, fpr, address):

1140

self._pipe = child_pipe

1141

self._pipe.send(('init', fpr, address))

1142

if not self._pipe.recv():

1143

raise KeyError()

1144

1145

def __getattribute__(self, name):

1146

if(name == '_pipe'):

1147

return super(ProxyClient, self).__getattribute__(name)

1148

self._pipe.send(('getattr', name))

1149

data = self._pipe.recv()

1150

if data[0] == 'data':

1151

return data[1]

1152

if data[0] == 'function':

1153

def func(*args, **kwargs):

1154

self._pipe.send(('funcall', name, args, kwargs))

1155

return self._pipe.recv()[1]

1156

return func

1157

1158

def __setattr__(self, name, value):

1159

if(name == '_pipe'):

1160

return super(ProxyClient, self).__setattr__(name, value)

1161

self._pipe.send(('setattr', name, value))

1162

1163

1164

class ClientHandler(socketserver.BaseRequestHandler, object):

706

1165

"""A class to handle client connections.

707

1166

708

1167

Instantiated once for each connection to handle it.

709

1168

Note: This will run in its own forked process."""

710

1169

711

1170

def handle(self):

712

logger.info(u"TCP connection from: %s",

713

unicode(self.client_address))

714

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

715

# Open IPC pipe to parent process

716

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1171

with contextlib.closing(self.server.child_pipe) as child_pipe:

1172

logger.info(u"TCP connection from: %s",

1173

unicode(self.client_address))

1174

logger.debug(u"Pipe FD: %d",

1175

self.server.child_pipe.fileno())

1176

717

1177

session = (gnutls.connection

718

1178

.ClientSession(self.request,

719

1179

gnutls.connection

720

1180

.X509Credentials()))

721

722

line = self.request.makefile().readline()

723

logger.debug(u"Protocol version: %r", line)

724

try:

725

if int(line.strip().split()[0]) > 1:

726

raise RuntimeError

727

except (ValueError, IndexError, RuntimeError), error:

728

logger.error(u"Unknown protocol version: %s", error)

729

return

730

1181

731

1182

# Note: gnutls.connection.X509Credentials is really a

732

1183

# generic GnuTLS certificate credentials object so long as

733

1184

# no X.509 keys are added to it. Therefore, we can use it

734

1185

# here despite using OpenPGP certificates.

735

1186

736

1187

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

737

1188

# u"+AES-256-CBC", u"+SHA1",

738

1189

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

744

1195

(gnutls.library.functions

745

1196

.gnutls_priority_set_direct(session._c_object,

746

1197

priority, None))

747

1198

1199

# Start communication using the Mandos protocol

1200

# Get protocol number

1201

line = self.request.makefile().readline()

1202

logger.debug(u"Protocol version: %r", line)

1203

try:

1204

if int(line.strip().split()[0]) > 1:

1205

raise RuntimeError

1206

except (ValueError, IndexError, RuntimeError), error:

1207

logger.error(u"Unknown protocol version: %s", error)

1208

return

1209

1210

# Start GnuTLS connection

748

1211

try:

749

1212

session.handshake()

750

1213

except gnutls.errors.GNUTLSError, error:

753

1216

# established. Just abandon the request.

754

1217

return

755

1218

logger.debug(u"Handshake succeeded")

1219

1220

approval_required = False

756

1221

try:

757

fpr = self.fingerprint(self.peer_certificate(session))

758

except (TypeError, gnutls.errors.GNUTLSError), error:

759

logger.warning(u"Bad certificate: %s", error)

760

session.bye()

761

return

762

logger.debug(u"Fingerprint: %s", fpr)

1222

try:

1223

fpr = self.fingerprint(self.peer_certificate

1224

(session))

1225

except (TypeError, gnutls.errors.GNUTLSError), error:

1226

logger.warning(u"Bad certificate: %s", error)

1227

return

1228

logger.debug(u"Fingerprint: %s", fpr)

1229

1230

try:

1231

client = ProxyClient(child_pipe, fpr,

1232

self.client_address)

1233

except KeyError:

1234

return

1235

1236

if client.approval_delay:

1237

delay = client.approval_delay

1238

client.approvals_pending += 1

1239

approval_required = True

1240

1241

while True:

1242

if not client.enabled:

1243

logger.warning(u"Client %s is disabled",

1244

client.name)

1245

if self.server.use_dbus:

1246

# Emit D-Bus signal

1247

client.Rejected("Disabled")

1248

return

1249

1250

if client._approved or not client.approval_delay:

1251

#We are approved or approval is disabled

1252

break

1253

elif client._approved is None:

1254

logger.info(u"Client %s needs approval",

1255

client.name)

1256

if self.server.use_dbus:

1257

# Emit D-Bus signal

1258

client.NeedApproval(

1259

client.approval_delay_milliseconds(),

1260

client.approved_by_default)

1261

else:

1262

logger.warning(u"Client %s was not approved",

1263

client.name)

1264

if self.server.use_dbus:

1265

# Emit D-Bus signal

1266

client.Rejected("Denied")

1267

return

1268

1269

#wait until timeout or approved

1270

#x = float(client._timedelta_to_milliseconds(delay))

1271

time = datetime.datetime.now()

1272

client.changedstate.acquire()

1273

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1274

client.changedstate.release()

1275

time2 = datetime.datetime.now()

1276

if (time2 - time) >= delay:

1277

if not client.approved_by_default:

1278

logger.warning("Client %s timed out while"

1279

" waiting for approval",

1280

client.name)

1281

if self.server.use_dbus:

1282

# Emit D-Bus signal

1283

client.Rejected("Approval timed out")

1284

return

1285

else:

1286

break

1287

else:

1288

delay -= time2 - time

1289

1290

sent_size = 0

1291

while sent_size < len(client.secret):

1292

try:

1293

sent = session.send(client.secret[sent_size:])

1294

except (gnutls.errors.GNUTLSError), error:

1295

logger.warning("gnutls send failed")

1296

return

1297

logger.debug(u"Sent: %d, remaining: %d",

1298

sent, len(client.secret)

1299

- (sent_size + sent))

1300

sent_size += sent

1301

1302

logger.info(u"Sending secret to %s", client.name)

1303

# bump the timeout as if seen

1304

client.checked_ok()

1305

if self.server.use_dbus:

1306

# Emit D-Bus signal

1307

client.GotSecret()

763

1308

764

for c in self.server.clients:

765

if c.fingerprint == fpr:

766

client = c

767

break

768

else:

769

ipc.write(u"NOTFOUND %s\n" % fpr)

770

session.bye()

771

return

772

# Have to check if client.still_valid(), since it is

773

# possible that the client timed out while establishing

774

# the GnuTLS session.

775

if not client.still_valid():

776

ipc.write(u"INVALID %s\n" % client.name)

777

session.bye()

778

return

779

ipc.write(u"SENDING %s\n" % client.name)

780

sent_size = 0

781

while sent_size < len(client.secret):

782

sent = session.send(client.secret[sent_size:])

783

logger.debug(u"Sent: %d, remaining: %d",

784

sent, len(client.secret)

785

- (sent_size + sent))

786

sent_size += sent

787

session.bye()

1309

finally:

1310

if approval_required:

1311

client.approvals_pending -= 1

1312

try:

1313

session.bye()

1314

except (gnutls.errors.GNUTLSError), error:

1315

logger.warning("GnuTLS bye failed")

788

1316

789

1317

@staticmethod

790

1318

def peer_certificate(session):

850

1378

return hex_fpr

851

1379

852

1380

853

class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):

854

"""Like SocketServer.ForkingMixIn, but also pass a pipe.

855

856

Assumes a gobject.MainLoop event loop.

857

"""

1381

class MultiprocessingMixIn(object):

1382

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1383

def sub_process_main(self, request, address):

1384

try:

1385

self.finish_request(request, address)

1386

except:

1387

self.handle_error(request, address)

1388

self.close_request(request)

1389

1390

def process_request(self, request, address):

1391

"""Start a new process to process the request."""

1392

multiprocessing.Process(target = self.sub_process_main,

1393

args = (request, address)).start()

1394

1395

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1396

""" adds a pipe to the MixIn """

858

1397

def process_request(self, request, client_address):

859

1398

"""Overrides and wraps the original process_request().

860

1399

861

This function creates a new pipe in self.pipe

1400

This function creates a new pipe in self.pipe

862

1401

"""

863

self.pipe = os.pipe()

864

super(ForkingMixInWithPipe,

1402

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1403

1404

super(MultiprocessingMixInWithPipe,

865

1405

self).process_request(request, client_address)

866

os.close(self.pipe[1]) # close write end

867

# Call "handle_ipc" for both data and EOF events

868

gobject.io_add_watch(self.pipe[0],

869

gobject.IO_IN | gobject.IO_HUP,

870

self.handle_ipc)

871

def handle_ipc(source, condition):

1406

self.child_pipe.close()

1407

self.add_pipe(parent_pipe)

1408

1409

def add_pipe(self, parent_pipe):

872

1410

"""Dummy function; override as necessary"""

873

os.close(source)

874

return False

875

876

877

class IPv6_TCPServer(ForkingMixInWithPipe,

878

SocketServer.TCPServer, object):

1411

pass

1412

1413

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1414

socketserver.TCPServer, object):

879

1415

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

880

1416

881

1417

Attributes:

882

1418

enabled: Boolean; whether this server is activated yet

883

1419

interface: None or a network interface name (string)

884

1420

use_ipv6: Boolean; to use IPv6 or not

885

----

886

clients: Set() of Client objects

887

gnutls_priority GnuTLS priority string

888

use_dbus: Boolean; to emit D-Bus signals or not

889

1421

"""

890

1422

def __init__(self, server_address, RequestHandlerClass,

891

interface=None, use_ipv6=True, clients=None,

892

gnutls_priority=None, use_dbus=True):

893

self.enabled = False

1423

interface=None, use_ipv6=True):

894

1424

self.interface = interface

895

1425

if use_ipv6:

896

1426

self.address_family = socket.AF_INET6

897

self.clients = clients

898

self.use_dbus = use_dbus

899

self.gnutls_priority = gnutls_priority

900

SocketServer.TCPServer.__init__(self, server_address,

1427

socketserver.TCPServer.__init__(self, server_address,

901

1428

RequestHandlerClass)

902

1429

def server_bind(self):

903

1430

"""This overrides the normal server_bind() function

904

1431

to bind to an interface if one was specified, and also NOT to

905

1432

bind to an address or port if they were not specified."""

906

1433

if self.interface is not None:

907

try:

908

self.socket.setsockopt(socket.SOL_SOCKET,

909

SO_BINDTODEVICE,

910

str(self.interface + u'\0'))

911

except socket.error, error:

912

if error[0] == errno.EPERM:

913

logger.error(u"No permission to"

914

u" bind to interface %s",

915

self.interface)

916

else:

917

raise

1434

if SO_BINDTODEVICE is None:

1435

logger.error(u"SO_BINDTODEVICE does not exist;"

1436

u" cannot bind to interface %s",

1437

self.interface)

1438

else:

1439

try:

1440

self.socket.setsockopt(socket.SOL_SOCKET,

1441

SO_BINDTODEVICE,

1442

str(self.interface

1443

+ u'\0'))

1444

except socket.error, error:

1445

if error[0] == errno.EPERM:

1446

logger.error(u"No permission to"

1447

u" bind to interface %s",

1448

self.interface)

1449

elif error[0] == errno.ENOPROTOOPT:

1450

logger.error(u"SO_BINDTODEVICE not available;"

1451

u" cannot bind to interface %s",

1452

self.interface)

1453

else:

1454

raise

918

1455

# Only bind(2) the socket if we really need to.

919

1456

if self.server_address[0] or self.server_address[1]:

920

1457

if not self.server_address[0]:

933

1470

# 0, # flowinfo

934

1471

# if_nametoindex

935

1472

# (self.interface))

936

return SocketServer.TCPServer.server_bind(self)

1473

return socketserver.TCPServer.server_bind(self)

1474

1475

1476

class MandosServer(IPv6_TCPServer):

1477

"""Mandos server.

1478

1479

Attributes:

1480

clients: set of Client objects

1481

gnutls_priority GnuTLS priority string

1482

use_dbus: Boolean; to emit D-Bus signals or not

1483

1484

Assumes a gobject.MainLoop event loop.

1485

"""

1486

def __init__(self, server_address, RequestHandlerClass,

1487

interface=None, use_ipv6=True, clients=None,

1488

gnutls_priority=None, use_dbus=True):

1489

self.enabled = False

1490

self.clients = clients

1491

if self.clients is None:

1492

self.clients = set()

1493

self.use_dbus = use_dbus

1494

self.gnutls_priority = gnutls_priority

1495

IPv6_TCPServer.__init__(self, server_address,

1496

RequestHandlerClass,

1497

interface = interface,

1498

use_ipv6 = use_ipv6)

937

1499

def server_activate(self):

938

1500

if self.enabled:

939

return SocketServer.TCPServer.server_activate(self)

1501

return socketserver.TCPServer.server_activate(self)

940

1502

def enable(self):

941

1503

self.enabled = True

942

def handle_ipc(self, source, condition, file_objects={}):

1504

def add_pipe(self, parent_pipe):

1505

# Call "handle_ipc" for both data and EOF events

1506

gobject.io_add_watch(parent_pipe.fileno(),

1507

gobject.IO_IN | gobject.IO_HUP,

1508

functools.partial(self.handle_ipc,

1509

parent_pipe = parent_pipe))

1510

1511

def handle_ipc(self, source, condition, parent_pipe=None,

1512

client_object=None):

943

1513

condition_names = {

944

1514

gobject.IO_IN: u"IN", # There is data to read.

945

1515

gobject.IO_OUT: u"OUT", # Data can be written (without

954

1524

for cond, name in

955

1525

condition_names.iteritems()

956

1526

if cond & condition)

957

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

958

conditions_string)

959

960

# Turn the pipe file descriptor into a Python file object

961

if source not in file_objects:

962

file_objects[source] = os.fdopen(source, u"r", 1)

963

964

# Read a line from the file object

965

cmdline = file_objects[source].readline()

966

if not cmdline: # Empty line means end of file

967

# close the IPC pipe

968

file_objects[source].close()

969

del file_objects[source]

970

971

# Stop calling this function

972

return False

973

974

logger.debug(u"IPC command: %r", cmdline)

975

976

# Parse and act on command

977

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

978

979

if cmd == u"NOTFOUND":

980

logger.warning(u"Client not found for fingerprint: %s",

981

args)

982

if self.use_dbus:

983

# Emit D-Bus signal

984

mandos_dbus_service.ClientNotFound(args)

985

elif cmd == u"INVALID":

986

for client in self.clients:

987

if client.name == args:

988

logger.warning(u"Client %s is invalid", args)

989

if self.use_dbus:

990

# Emit D-Bus signal

991

client.Rejected()

992

break

993

else:

994

logger.error(u"Unknown client %s is invalid", args)

995

elif cmd == u"SENDING":

996

for client in self.clients:

997

if client.name == args:

998

logger.info(u"Sending secret to %s", client.name)

999

client.checked_ok()

1000

if self.use_dbus:

1001

# Emit D-Bus signal

1002

client.ReceivedSecret()

1003

break

1004

else:

1005

logger.error(u"Sending secret to unknown client %s",

1006

args)

1007

else:

1008

logger.error(u"Unknown IPC command: %r", cmdline)

1009

1010

# Keep calling this function

1527

# error or the other end of multiprocessing.Pipe has closed

1528

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1529

return False

1530

1531

# Read a request from the child

1532

request = parent_pipe.recv()

1533

command = request[0]

1534

1535

if command == 'init':

1536

fpr = request[1]

1537

address = request[2]

1538

1539

for c in self.clients:

1540

if c.fingerprint == fpr:

1541

client = c

1542

break

1543

else:

1544

logger.warning(u"Client not found for fingerprint: %s, ad"

1545

u"dress: %s", fpr, address)

1546

if self.use_dbus:

1547

# Emit D-Bus signal

1548

mandos_dbus_service.ClientNotFound(fpr, address[0])

1549

parent_pipe.send(False)

1550

return False

1551

1552

gobject.io_add_watch(parent_pipe.fileno(),

1553

gobject.IO_IN | gobject.IO_HUP,

1554

functools.partial(self.handle_ipc,

1555

parent_pipe = parent_pipe,

1556

client_object = client))

1557

parent_pipe.send(True)

1558

# remove the old hook in favor of the new above hook on same fileno

1559

return False

1560

if command == 'funcall':

1561

funcname = request[1]

1562

args = request[2]

1563

kwargs = request[3]

1564

1565

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1566

1567

if command == 'getattr':

1568

attrname = request[1]

1569

if callable(client_object.__getattribute__(attrname)):

1570

parent_pipe.send(('function',))

1571

else:

1572

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1573

1574

if command == 'setattr':

1575

attrname = request[1]

1576

value = request[2]

1577

setattr(client_object, attrname, value)

1578

1011

1579

return True

1012

1580

1013

1581

1043

1611

elif suffix == u"w":

1044

1612

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1045

1613

else:

1046

raise ValueError

1047

except (ValueError, IndexError):

1048

raise ValueError

1614

raise ValueError(u"Unknown suffix %r" % suffix)

1615

except (ValueError, IndexError), e:

1616

raise ValueError(e.message)

1049

1617

timevalue += delta

1050

1618

return timevalue

1051

1619

1052

1620

1053

def server_state_changed(state):

1054

"""Derived from the Avahi example code"""

1055

if state == avahi.SERVER_COLLISION:

1056

logger.error(u"Zeroconf server name collision")

1057

service.remove()

1058

elif state == avahi.SERVER_RUNNING:

1059

service.add()

1060

1061

1062

def entry_group_state_changed(state, error):

1063

"""Derived from the Avahi example code"""

1064

logger.debug(u"Avahi state change: %i", state)

1065

1066

if state == avahi.ENTRY_GROUP_ESTABLISHED:

1067

logger.debug(u"Zeroconf service established.")

1068

elif state == avahi.ENTRY_GROUP_COLLISION:

1069

logger.warning(u"Zeroconf service name collision.")

1070

service.rename()

1071

elif state == avahi.ENTRY_GROUP_FAILURE:

1072

logger.critical(u"Avahi: Error in group state changed %s",

1073

unicode(error))

1074

raise AvahiGroupError(u"State changed: %s" % unicode(error))

1075

1076

1621

def if_nametoindex(interface):

1077

1622

"""Call the C function if_nametoindex(), or equivalent

1078

1623

1087

1632

def if_nametoindex(interface):

1088

1633

"Get an interface index the hard way, i.e. using fcntl()"

1089

1634

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1090

with closing(socket.socket()) as s:

1635

with contextlib.closing(socket.socket()) as s:

1091

1636

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1092

1637

struct.pack(str(u"16s16x"),

1093

1638

interface))

1113

1658

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1114

1659

if not stat.S_ISCHR(os.fstat(null).st_mode):

1115

1660

raise OSError(errno.ENODEV,

1116

u"/dev/null not a character device")

1661

u"%s not a character device"

1662

% os.path.devnull)

1117

1663

os.dup2(null, sys.stdin.fileno())

1118

1664

os.dup2(null, sys.stdout.fileno())

1119

1665

os.dup2(null, sys.stderr.fileno())

1123

1669

1124

1670

def main():

1125

1671

1126

######################################################################

1672

##################################################################

1127

1673

# Parsing of options, both command line and config file

1128

1674

1129

1675

parser = optparse.OptionParser(version = "%%prog %s" % version)

1138

1684

parser.add_option("--debug", action=u"store_true",

1139

1685

help=u"Debug mode; run in foreground and log to"

1140

1686

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1688

help=u"Debug level for stdout output")

1141

1689

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1142

1690

u" priority string (see GnuTLS documentation)")

1143

1691

parser.add_option("--servicename", type=u"string",

1168

1716

u"servicename": u"Mandos",

1169

1717

u"use_dbus": u"True",

1170

1718

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

1171

1720

}

1172

1721

1173

1722

# Parse config file for server-global settings

1174

server_config = ConfigParser.SafeConfigParser(server_defaults)

1723

server_config = configparser.SafeConfigParser(server_defaults)

1175

1724

del server_defaults

1176

1725

server_config.read(os.path.join(options.configdir,

1177

1726

u"mandos.conf"))

1190

1739

# options, if set.

1191

1740

for option in (u"interface", u"address", u"port", u"debug",

1192

1741

u"priority", u"servicename", u"configdir",

1193

u"use_dbus", u"use_ipv6"):

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

1194

1743

value = getattr(options, option)

1195

1744

if value is not None:

1196

1745

server_settings[option] = value

1205

1754

1206

1755

# For convenience

1207

1756

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1208

1758

use_dbus = server_settings[u"use_dbus"]

1209

1759

use_ipv6 = server_settings[u"use_ipv6"]

1210

1211

if not debug:

1212

syslogger.setLevel(logging.WARNING)

1213

console.setLevel(logging.WARNING)

1214

1760

1215

1761

if server_settings[u"servicename"] != u"Mandos":

1216

1762

syslogger.setFormatter(logging.Formatter

1217

1763

(u'Mandos (%s) [%%(process)d]:'

1223

1769

u"interval": u"5m",

1224

1770

u"checker": u"fping -q -- %%(host)s",

1225

1771

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1226

1774

}

1227

client_config = ConfigParser.SafeConfigParser(client_defaults)

1775

client_config = configparser.SafeConfigParser(client_defaults)

1228

1776

client_config.read(os.path.join(server_settings[u"configdir"],

1229

1777

u"clients.conf"))

1230

1778

1231

1779

global mandos_dbus_service

1232

1780

mandos_dbus_service = None

1233

1781

1234

clients = Set()

1235

tcp_server = IPv6_TCPServer((server_settings[u"address"],

1236

server_settings[u"port"]),

1237

ClientHandler,

1238

interface=

1239

server_settings[u"interface"],

1240

use_ipv6=use_ipv6,

1241

clients=clients,

1242

gnutls_priority=

1243

server_settings[u"priority"],

1244

use_dbus=use_dbus)

1245

pidfilename = u"/var/run/mandos.pid"

1246

try:

1247

pidfile = open(pidfilename, u"w")

1248

except IOError:

1249

logger.error(u"Could not open file %r", pidfilename)

1782

tcp_server = MandosServer((server_settings[u"address"],

1783

server_settings[u"port"]),

1784

ClientHandler,

1785

interface=(server_settings[u"interface"]

1786

or None),

1787

use_ipv6=use_ipv6,

1788

gnutls_priority=

1789

server_settings[u"priority"],

1790

use_dbus=use_dbus)

1791

if not debug:

1792

pidfilename = u"/var/run/mandos.pid"

1793

try:

1794

pidfile = open(pidfilename, u"w")

1795

except IOError:

1796

logger.error(u"Could not open file %r", pidfilename)

1250

1797

1251

1798

try:

1252

1799

uid = pwd.getpwnam(u"_mandos").pw_uid

1269

1816

if error[0] != errno.EPERM:

1270

1817

raise error

1271

1818

1272

# Enable all possible GnuTLS debugging

1819

if not debug and not debuglevel:

1820

syslogger.setLevel(logging.WARNING)

1821

console.setLevel(logging.WARNING)

1822

if debuglevel:

1823

level = getattr(logging, debuglevel.upper())

1824

syslogger.setLevel(level)

1825

console.setLevel(level)

1826

1273

1827

if debug:

1828

# Enable all possible GnuTLS debugging

1829

1274

1830

# "Use a log level over 10 to enable all debugging options."

1275

1831

# - GnuTLS manual

1276

1832

gnutls.library.functions.gnutls_global_set_log_level(11)

1281

1837

1282

1838

(gnutls.library.functions

1283

1839

.gnutls_global_set_log_function(debug_gnutls))

1284

1285

global service

1840

1841

# Redirect stdin so all checkers get /dev/null

1842

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1843

os.dup2(null, sys.stdin.fileno())

1844

if null > 2:

1845

os.close(null)

1846

else:

1847

# No console logging

1848

logger.removeHandler(console)

1849

1850

1851

global main_loop

1852

# From the Avahi example code

1853

DBusGMainLoop(set_as_default=True )

1854

main_loop = gobject.MainLoop()

1855

bus = dbus.SystemBus()

1856

# End of Avahi example code

1857

if use_dbus:

1858

try:

1859

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1860

bus, do_not_queue=True)

1861

except dbus.exceptions.NameExistsException, e:

1862

logger.error(unicode(e) + u", disabling D-Bus")

1863

use_dbus = False

1864

server_settings[u"use_dbus"] = False

1865

tcp_server.use_dbus = False

1286

1866

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1287

1867

service = AvahiService(name = server_settings[u"servicename"],

1288

1868

servicetype = u"_mandos._tcp",

1289

protocol = protocol)

1869

protocol = protocol, bus = bus)

1290

1870

if server_settings["interface"]:

1291

1871

service.interface = (if_nametoindex

1292

1872

(str(server_settings[u"interface"])))

1293

1294

global main_loop

1295

global bus

1296

global server

1297

# From the Avahi example code

1298

DBusGMainLoop(set_as_default=True )

1299

main_loop = gobject.MainLoop()

1300

bus = dbus.SystemBus()

1301

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

1302

avahi.DBUS_PATH_SERVER),

1303

avahi.DBUS_INTERFACE_SERVER)

1304

# End of Avahi example code

1305

if use_dbus:

1306

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1873

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

1878

global multiprocessing_manager

1879

multiprocessing_manager = multiprocessing.Manager()

1307

1880

1308

1881

client_class = Client

1309

1882

if use_dbus:

1310

client_class = ClientDBus

1311

clients.update(Set(

1883

client_class = functools.partial(ClientDBus, bus = bus)

1884

def client_config_items(config, section):

1885

special_settings = {

1886

"approved_by_default":

1887

lambda: config.getboolean(section,

1888

"approved_by_default"),

1889

}

1890

for name, value in config.items(section):

1891

try:

1892

yield (name, special_settings[name]())

1893

except KeyError:

1894

yield (name, value)

1895

1896

tcp_server.clients.update(set(

1312

1897

client_class(name = section,

1313

config= dict(client_config.items(section)))

1898

config= dict(client_config_items(

1899

client_config, section)))

1314

1900

for section in client_config.sections()))

1315

if not clients:

1901

if not tcp_server.clients:

1316

1902

logger.warning(u"No clients defined")

1317

1318

if debug:

1319

# Redirect stdin so all checkers get /dev/null

1320

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1321

os.dup2(null, sys.stdin.fileno())

1322

if null > 2:

1323

os.close(null)

1324

else:

1325

# No console logging

1326

logger.removeHandler(console)

1327

# Close all input and output, do double fork, etc.

1328

daemon()

1329

1330

try:

1331

with closing(pidfile):

1332

pid = os.getpid()

1333

pidfile.write(str(pid) + "\n")

1334

del pidfile

1335

except IOError:

1336

logger.error(u"Could not write to file %r with PID %d",

1337

pidfilename, pid)

1338

except NameError:

1339

# "pidfile" was never created

1340

pass

1341

del pidfilename

1342

1343

def cleanup():

1344

"Cleanup function; run on exit"

1345

global group

1346

# From the Avahi example code

1347

if not group is None:

1348

group.Free()

1349

group = None

1350

# End of Avahi example code

1351

1903

1352

while clients:

1353

client = clients.pop()

1354

client.disable_hook = None

1355

client.disable()

1356

1357

atexit.register(cleanup)

1358

1359

1904

if not debug:

1905

try:

1906

with pidfile:

1907

pid = os.getpid()

1908

pidfile.write(str(pid) + "\n")

1909

del pidfile

1910

except IOError:

1911

logger.error(u"Could not write to file %r with PID %d",

1912

pidfilename, pid)

1913

except NameError:

1914

# "pidfile" was never created

1915

pass

1916

del pidfilename

1917

1360

1918

signal.signal(signal.SIGINT, signal.SIG_IGN)

1919

1361

1920

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1362

1921

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1363

1922

1368

1927

dbus.service.Object.__init__(self, bus, u"/")

1369

1928

_interface = u"se.bsnet.fukt.Mandos"

1370

1929

1371

@dbus.service.signal(_interface, signature=u"oa{sv}")

1372

def ClientAdded(self, objpath, properties):

1930

@dbus.service.signal(_interface, signature=u"o")

1931

def ClientAdded(self, objpath):

1373

1932

"D-Bus signal"

1374

1933

pass

1375

1934

1376

@dbus.service.signal(_interface, signature=u"s")

1377

def ClientNotFound(self, fingerprint):

1935

@dbus.service.signal(_interface, signature=u"ss")

1936

def ClientNotFound(self, fingerprint, address):

1378

1937

"D-Bus signal"

1379

1938

pass

1380

1939

1386

1945

@dbus.service.method(_interface, out_signature=u"ao")

1387

1946

def GetAllClients(self):

1388

1947

"D-Bus method"

1389

return dbus.Array(c.dbus_object_path for c in clients)

1948

return dbus.Array(c.dbus_object_path

1949

for c in tcp_server.clients)

1390

1950

1391

1951

@dbus.service.method(_interface,

1392

1952

out_signature=u"a{oa{sv}}")

1393

1953

def GetAllClientsWithProperties(self):

1394

1954

"D-Bus method"

1395

1955

return dbus.Dictionary(

1396

((c.dbus_object_path, c.GetAllProperties())

1397

for c in clients),

1956

((c.dbus_object_path, c.GetAll(u""))

1957

for c in tcp_server.clients),

1398

1958

signature=u"oa{sv}")

1399

1959

1400

1960

@dbus.service.method(_interface, in_signature=u"o")

1401

1961

def RemoveClient(self, object_path):

1402

1962

"D-Bus method"

1403

for c in clients:

1963

for c in tcp_server.clients:

1404

1964

if c.dbus_object_path == object_path:

1405

clients.remove(c)

1965

tcp_server.clients.remove(c)

1406

1966

c.remove_from_connection()

1407

1967

# Don't signal anything except ClientRemoved

1408

c.disable(signal=False)

1968

c.disable(quiet=True)

1409

1969

# Emit D-Bus signal

1410

1970

self.ClientRemoved(object_path, c.name)

1411

1971

return

1412

raise KeyError

1972

raise KeyError(object_path)

1413

1973

1414

1974

del _interface

1415

1975

1416

1976

mandos_dbus_service = MandosDBusService()

1417

1977

1418

for client in clients:

1978

def cleanup():

1979

"Cleanup function; run on exit"

1980

service.cleanup()

1981

1982

while tcp_server.clients:

1983

client = tcp_server.clients.pop()

1984

if use_dbus:

1985

client.remove_from_connection()

1986

client.disable_hook = None

1987

# Don't signal anything except ClientRemoved

1988

client.disable(quiet=True)

1989

if use_dbus:

1990

# Emit D-Bus signal

1991

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1992

client.name)

1993

1994

atexit.register(cleanup)

1995

1996

for client in tcp_server.clients:

1419

1997

if use_dbus:

1420

1998

# Emit D-Bus signal

1421

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1422

client.GetAllProperties())

1999

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1423

2000

client.enable()

1424

2001

1425

2002

tcp_server.enable()

1439

2016

1440

2017

try:

1441

2018

# From the Avahi example code

1442

server.connect_to_signal(u"StateChanged", server_state_changed)

1443

2019

try:

1444

server_state_changed(server.GetState())

2020

service.activate()

1445

2021

except dbus.exceptions.DBusException, error:

1446

2022

logger.critical(u"DBusException: %s", error)

2023

cleanup()

1447

2024

sys.exit(1)

1448

2025

# End of Avahi example code

1449

2026

1456

2033

main_loop.run()

1457

2034

except AvahiError, error:

1458

2035

logger.critical(u"AvahiError: %s", error)

2036

cleanup()

1459

2037

sys.exit(1)

1460

2038

except KeyboardInterrupt:

1461

2039

if debug:

1462

2040

print >> sys.stderr

1463

2041

logger.debug(u"Server received KeyboardInterrupt")

1464

2042

logger.debug(u"Server exiting")

2043

# Must run before the D-Bus bus name gets deregistered

2044

cleanup()

1465

2045

1466

2046

if __name__ == '__main__':

1467

2047

main()