/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2010-10-13 06:12:52 UTC
  • Revision ID: teddy@fukt.bsnet.se-20101013061252-3a918xedja5caya8
* debian/mandos-client.lintian-overrides: Added plugins.d/plymouth.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2008-2010 Teddy Hogeborn
 
15
# Copyright © 2008-2010 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
55
55
import logging
56
56
import logging.handlers
57
57
import pwd
58
 
from contextlib import closing
 
58
import contextlib
59
59
import struct
60
60
import fcntl
61
61
import functools
 
62
import cPickle as pickle
 
63
import multiprocessing
62
64
 
63
65
import dbus
64
66
import dbus.service
67
69
from dbus.mainloop.glib import DBusGMainLoop
68
70
import ctypes
69
71
import ctypes.util
 
72
import xml.dom.minidom
 
73
import inspect
70
74
 
71
75
try:
72
76
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
77
81
        SO_BINDTODEVICE = None
78
82
 
79
83
 
80
 
version = "1.0.8"
 
84
version = "1.2.3"
81
85
 
 
86
#logger = logging.getLogger(u'mandos')
82
87
logger = logging.Logger(u'mandos')
83
88
syslogger = (logging.handlers.SysLogHandler
84
89
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
152
157
                            u" after %i retries, exiting.",
153
158
                            self.rename_count)
154
159
            raise AvahiServiceError(u"Too many renames")
155
 
        self.name = self.server.GetAlternativeServiceName(self.name)
 
160
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
156
161
        logger.info(u"Changing Zeroconf service name to %r ...",
157
 
                    unicode(self.name))
 
162
                    self.name)
158
163
        syslogger.setFormatter(logging.Formatter
159
164
                               (u'Mandos (%s) [%%(process)d]:'
160
165
                                u' %%(levelname)s: %%(message)s'
161
166
                                % self.name))
162
167
        self.remove()
163
 
        self.add()
 
168
        try:
 
169
            self.add()
 
170
        except dbus.exceptions.DBusException, error:
 
171
            logger.critical(u"DBusException: %s", error)
 
172
            self.cleanup()
 
173
            os._exit(1)
164
174
        self.rename_count += 1
165
175
    def remove(self):
166
176
        """Derived from the Avahi example code"""
174
184
                                    self.server.EntryGroupNew()),
175
185
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
186
            self.group.connect_to_signal('StateChanged',
177
 
                                         self.entry_group_state_changed)
 
187
                                         self
 
188
                                         .entry_group_state_changed)
178
189
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
179
190
                     self.name, self.type)
180
191
        self.group.AddService(
188
199
        self.group.Commit()
189
200
    def entry_group_state_changed(self, state, error):
190
201
        """Derived from the Avahi example code"""
191
 
        logger.debug(u"Avahi state change: %i", state)
 
202
        logger.debug(u"Avahi entry group state change: %i", state)
192
203
        
193
204
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
205
            logger.debug(u"Zeroconf service established.")
207
218
            self.group = None
208
219
    def server_state_changed(self, state):
209
220
        """Derived from the Avahi example code"""
 
221
        logger.debug(u"Avahi server state change: %i", state)
210
222
        if state == avahi.SERVER_COLLISION:
211
223
            logger.error(u"Zeroconf server name collision")
212
224
            self.remove()
228
240
    """A representation of a client host served by this server.
229
241
    
230
242
    Attributes:
231
 
    name:       string; from the config file, used in log messages and
232
 
                        D-Bus identifiers
233
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
234
 
                 uniquely identify the client
235
 
    secret:     bytestring; sent verbatim (over TLS) to client
236
 
    host:       string; available for use by the checker command
237
 
    created:    datetime.datetime(); (UTC) object creation
238
 
    last_enabled: datetime.datetime(); (UTC)
239
 
    enabled:    bool()
240
 
    last_checked_ok: datetime.datetime(); (UTC) or None
241
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
242
 
                                      until this client is invalid
243
 
    interval:   datetime.timedelta(); How often to start a new checker
244
 
    disable_hook:  If set, called by disable() as disable_hook(self)
 
243
    _approved:   bool(); 'None' if not yet approved/disapproved
 
244
    approval_delay: datetime.timedelta(); Time to wait for approval
 
245
    approval_duration: datetime.timedelta(); Duration of one approval
245
246
    checker:    subprocess.Popen(); a running checker process used
246
247
                                    to see if the client lives.
247
248
                                    'None' if no process is running.
248
 
    checker_initiator_tag: a gobject event source tag, or None
249
 
    disable_initiator_tag:    - '' -
250
 
    checker_callback_tag:  - '' -
251
 
    checker_command: string; External command which is run to check if
252
 
                     client lives.  %() expansions are done at
 
249
    checker_callback_tag: a gobject event source tag, or None
 
250
    checker_command: string; External command which is run to check
 
251
                     if client lives.  %() expansions are done at
253
252
                     runtime with vars(self) as dict, so that for
254
253
                     instance %(name)s can be used in the command.
 
254
    checker_initiator_tag: a gobject event source tag, or None
 
255
    created:    datetime.datetime(); (UTC) object creation
255
256
    current_checker_command: string; current running checker_command
 
257
    disable_hook:  If set, called by disable() as disable_hook(self)
 
258
    disable_initiator_tag: a gobject event source tag, or None
 
259
    enabled:    bool()
 
260
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
261
                 uniquely identify the client
 
262
    host:       string; available for use by the checker command
 
263
    interval:   datetime.timedelta(); How often to start a new checker
 
264
    last_approval_request: datetime.datetime(); (UTC) or None
 
265
    last_checked_ok: datetime.datetime(); (UTC) or None
 
266
    last_enabled: datetime.datetime(); (UTC)
 
267
    name:       string; from the config file, used in log messages and
 
268
                        D-Bus identifiers
 
269
    secret:     bytestring; sent verbatim (over TLS) to client
 
270
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
271
                                      until this client is disabled
 
272
    runtime_expansions: Allowed attributes for runtime expansion.
256
273
    """
257
274
    
 
275
    runtime_expansions = (u"approval_delay", u"approval_duration",
 
276
                          u"created", u"enabled", u"fingerprint",
 
277
                          u"host", u"interval", u"last_checked_ok",
 
278
                          u"last_enabled", u"name", u"timeout")
 
279
    
258
280
    @staticmethod
259
 
    def _datetime_to_milliseconds(dt):
260
 
        "Convert a datetime.datetime() to milliseconds"
261
 
        return ((dt.days * 24 * 60 * 60 * 1000)
262
 
                + (dt.seconds * 1000)
263
 
                + (dt.microseconds // 1000))
 
281
    def _timedelta_to_milliseconds(td):
 
282
        "Convert a datetime.timedelta() to milliseconds"
 
283
        return ((td.days * 24 * 60 * 60 * 1000)
 
284
                + (td.seconds * 1000)
 
285
                + (td.microseconds // 1000))
264
286
    
265
287
    def timeout_milliseconds(self):
266
288
        "Return the 'timeout' attribute in milliseconds"
267
 
        return self._datetime_to_milliseconds(self.timeout)
 
289
        return self._timedelta_to_milliseconds(self.timeout)
268
290
    
269
291
    def interval_milliseconds(self):
270
292
        "Return the 'interval' attribute in milliseconds"
271
 
        return self._datetime_to_milliseconds(self.interval)
 
293
        return self._timedelta_to_milliseconds(self.interval)
 
294
 
 
295
    def approval_delay_milliseconds(self):
 
296
        return self._timedelta_to_milliseconds(self.approval_delay)
272
297
    
273
298
    def __init__(self, name = None, disable_hook=None, config=None):
274
299
        """Note: the 'checker' key in 'config' sets the
287
312
        if u"secret" in config:
288
313
            self.secret = config[u"secret"].decode(u"base64")
289
314
        elif u"secfile" in config:
290
 
            with closing(open(os.path.expanduser
291
 
                              (os.path.expandvars
292
 
                               (config[u"secfile"])))) as secfile:
 
315
            with open(os.path.expanduser(os.path.expandvars
 
316
                                         (config[u"secfile"])),
 
317
                      "rb") as secfile:
293
318
                self.secret = secfile.read()
294
319
        else:
295
320
            raise TypeError(u"No secret or secfile for client %s"
297
322
        self.host = config.get(u"host", u"")
298
323
        self.created = datetime.datetime.utcnow()
299
324
        self.enabled = False
 
325
        self.last_approval_request = None
300
326
        self.last_enabled = None
301
327
        self.last_checked_ok = None
302
328
        self.timeout = string_to_delta(config[u"timeout"])
309
335
        self.checker_command = config[u"checker"]
310
336
        self.current_checker_command = None
311
337
        self.last_connect = None
 
338
        self._approved = None
 
339
        self.approved_by_default = config.get(u"approved_by_default",
 
340
                                              True)
 
341
        self.approvals_pending = 0
 
342
        self.approval_delay = string_to_delta(
 
343
            config[u"approval_delay"])
 
344
        self.approval_duration = string_to_delta(
 
345
            config[u"approval_duration"])
 
346
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
312
347
    
 
348
    def send_changedstate(self):
 
349
        self.changedstate.acquire()
 
350
        self.changedstate.notify_all()
 
351
        self.changedstate.release()
 
352
        
313
353
    def enable(self):
314
354
        """Start this client's checker and timeout hooks"""
315
355
        if getattr(self, u"enabled", False):
316
356
            # Already enabled
317
357
            return
 
358
        self.send_changedstate()
318
359
        self.last_enabled = datetime.datetime.utcnow()
319
360
        # Schedule a new checker to be started an 'interval' from now,
320
361
        # and every interval from then on.
321
362
        self.checker_initiator_tag = (gobject.timeout_add
322
363
                                      (self.interval_milliseconds(),
323
364
                                       self.start_checker))
324
 
        # Also start a new checker *right now*.
325
 
        self.start_checker()
326
365
        # Schedule a disable() when 'timeout' has passed
327
366
        self.disable_initiator_tag = (gobject.timeout_add
328
367
                                   (self.timeout_milliseconds(),
329
368
                                    self.disable))
330
369
        self.enabled = True
 
370
        # Also start a new checker *right now*.
 
371
        self.start_checker()
331
372
    
332
 
    def disable(self):
 
373
    def disable(self, quiet=True):
333
374
        """Disable this client."""
334
375
        if not getattr(self, "enabled", False):
335
376
            return False
336
 
        logger.info(u"Disabling client %s", self.name)
 
377
        if not quiet:
 
378
            self.send_changedstate()
 
379
        if not quiet:
 
380
            logger.info(u"Disabling client %s", self.name)
337
381
        if getattr(self, u"disable_initiator_tag", False):
338
382
            gobject.source_remove(self.disable_initiator_tag)
339
383
            self.disable_initiator_tag = None
380
424
                                      (self.timeout_milliseconds(),
381
425
                                       self.disable))
382
426
    
 
427
    def need_approval(self):
 
428
        self.last_approval_request = datetime.datetime.utcnow()
 
429
    
383
430
    def start_checker(self):
384
431
        """Start a new checker subprocess if one is not running.
385
432
        
391
438
        # client would inevitably timeout, since no checker would get
392
439
        # a chance to run to completion.  If we instead leave running
393
440
        # checkers alone, the checker would have to take more time
394
 
        # than 'timeout' for the client to be declared invalid, which
395
 
        # is as it should be.
 
441
        # than 'timeout' for the client to be disabled, which is as it
 
442
        # should be.
396
443
        
397
444
        # If a checker exists, make sure it is not a zombie
398
 
        if self.checker is not None:
 
445
        try:
399
446
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
447
        except (AttributeError, OSError), error:
 
448
            if (isinstance(error, OSError)
 
449
                and error.errno != errno.ECHILD):
 
450
                raise error
 
451
        else:
400
452
            if pid:
401
453
                logger.warning(u"Checker was a zombie")
402
454
                gobject.source_remove(self.checker_callback_tag)
409
461
                command = self.checker_command % self.host
410
462
            except TypeError:
411
463
                # Escape attributes for the shell
412
 
                escaped_attrs = dict((key,
413
 
                                      re.escape(unicode(str(val),
414
 
                                                        errors=
415
 
                                                        u'replace')))
416
 
                                     for key, val in
417
 
                                     vars(self).iteritems())
 
464
                escaped_attrs = dict(
 
465
                    (attr,
 
466
                     re.escape(unicode(str(getattr(self, attr, u"")),
 
467
                                       errors=
 
468
                                       u'replace')))
 
469
                    for attr in
 
470
                    self.runtime_expansions)
 
471
 
418
472
                try:
419
473
                    command = self.checker_command % escaped_attrs
420
474
                except TypeError, error:
458
512
        logger.debug(u"Stopping checker for %(name)s", vars(self))
459
513
        try:
460
514
            os.kill(self.checker.pid, signal.SIGTERM)
461
 
            #os.sleep(0.5)
 
515
            #time.sleep(0.5)
462
516
            #if self.checker.poll() is None:
463
517
            #    os.kill(self.checker.pid, signal.SIGKILL)
464
518
        except OSError, error:
465
519
            if error.errno != errno.ESRCH: # No such process
466
520
                raise
467
521
        self.checker = None
468
 
    
469
 
    def still_valid(self):
470
 
        """Has the timeout not yet passed for this client?"""
471
 
        if not getattr(self, u"enabled", False):
472
 
            return False
473
 
        now = datetime.datetime.utcnow()
474
 
        if self.last_checked_ok is None:
475
 
            return now < (self.created + self.timeout)
476
 
        else:
477
 
            return now < (self.last_checked_ok + self.timeout)
478
 
 
479
 
 
480
 
class ClientDBus(Client, dbus.service.Object):
 
522
 
 
523
def dbus_service_property(dbus_interface, signature=u"v",
 
524
                          access=u"readwrite", byte_arrays=False):
 
525
    """Decorators for marking methods of a DBusObjectWithProperties to
 
526
    become properties on the D-Bus.
 
527
    
 
528
    The decorated method will be called with no arguments by "Get"
 
529
    and with one argument by "Set".
 
530
    
 
531
    The parameters, where they are supported, are the same as
 
532
    dbus.service.method, except there is only "signature", since the
 
533
    type from Get() and the type sent to Set() is the same.
 
534
    """
 
535
    # Encoding deeply encoded byte arrays is not supported yet by the
 
536
    # "Set" method, so we fail early here:
 
537
    if byte_arrays and signature != u"ay":
 
538
        raise ValueError(u"Byte arrays not supported for non-'ay'"
 
539
                         u" signature %r" % signature)
 
540
    def decorator(func):
 
541
        func._dbus_is_property = True
 
542
        func._dbus_interface = dbus_interface
 
543
        func._dbus_signature = signature
 
544
        func._dbus_access = access
 
545
        func._dbus_name = func.__name__
 
546
        if func._dbus_name.endswith(u"_dbus_property"):
 
547
            func._dbus_name = func._dbus_name[:-14]
 
548
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
 
549
        return func
 
550
    return decorator
 
551
 
 
552
 
 
553
class DBusPropertyException(dbus.exceptions.DBusException):
 
554
    """A base class for D-Bus property-related exceptions
 
555
    """
 
556
    def __unicode__(self):
 
557
        return unicode(str(self))
 
558
 
 
559
 
 
560
class DBusPropertyAccessException(DBusPropertyException):
 
561
    """A property's access permissions disallows an operation.
 
562
    """
 
563
    pass
 
564
 
 
565
 
 
566
class DBusPropertyNotFound(DBusPropertyException):
 
567
    """An attempt was made to access a non-existing property.
 
568
    """
 
569
    pass
 
570
 
 
571
 
 
572
class DBusObjectWithProperties(dbus.service.Object):
 
573
    """A D-Bus object with properties.
 
574
 
 
575
    Classes inheriting from this can use the dbus_service_property
 
576
    decorator to expose methods as D-Bus properties.  It exposes the
 
577
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
578
    """
 
579
    
 
580
    @staticmethod
 
581
    def _is_dbus_property(obj):
 
582
        return getattr(obj, u"_dbus_is_property", False)
 
583
    
 
584
    def _get_all_dbus_properties(self):
 
585
        """Returns a generator of (name, attribute) pairs
 
586
        """
 
587
        return ((prop._dbus_name, prop)
 
588
                for name, prop in
 
589
                inspect.getmembers(self, self._is_dbus_property))
 
590
    
 
591
    def _get_dbus_property(self, interface_name, property_name):
 
592
        """Returns a bound method if one exists which is a D-Bus
 
593
        property with the specified name and interface.
 
594
        """
 
595
        for name in (property_name,
 
596
                     property_name + u"_dbus_property"):
 
597
            prop = getattr(self, name, None)
 
598
            if (prop is None
 
599
                or not self._is_dbus_property(prop)
 
600
                or prop._dbus_name != property_name
 
601
                or (interface_name and prop._dbus_interface
 
602
                    and interface_name != prop._dbus_interface)):
 
603
                continue
 
604
            return prop
 
605
        # No such property
 
606
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
 
607
                                   + interface_name + u"."
 
608
                                   + property_name)
 
609
    
 
610
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
 
611
                         out_signature=u"v")
 
612
    def Get(self, interface_name, property_name):
 
613
        """Standard D-Bus property Get() method, see D-Bus standard.
 
614
        """
 
615
        prop = self._get_dbus_property(interface_name, property_name)
 
616
        if prop._dbus_access == u"write":
 
617
            raise DBusPropertyAccessException(property_name)
 
618
        value = prop()
 
619
        if not hasattr(value, u"variant_level"):
 
620
            return value
 
621
        return type(value)(value, variant_level=value.variant_level+1)
 
622
    
 
623
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
 
624
    def Set(self, interface_name, property_name, value):
 
625
        """Standard D-Bus property Set() method, see D-Bus standard.
 
626
        """
 
627
        prop = self._get_dbus_property(interface_name, property_name)
 
628
        if prop._dbus_access == u"read":
 
629
            raise DBusPropertyAccessException(property_name)
 
630
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
631
            # The byte_arrays option is not supported yet on
 
632
            # signatures other than "ay".
 
633
            if prop._dbus_signature != u"ay":
 
634
                raise ValueError
 
635
            value = dbus.ByteArray(''.join(unichr(byte)
 
636
                                           for byte in value))
 
637
        prop(value)
 
638
    
 
639
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
 
640
                         out_signature=u"a{sv}")
 
641
    def GetAll(self, interface_name):
 
642
        """Standard D-Bus property GetAll() method, see D-Bus
 
643
        standard.
 
644
 
 
645
        Note: Will not include properties with access="write".
 
646
        """
 
647
        all = {}
 
648
        for name, prop in self._get_all_dbus_properties():
 
649
            if (interface_name
 
650
                and interface_name != prop._dbus_interface):
 
651
                # Interface non-empty but did not match
 
652
                continue
 
653
            # Ignore write-only properties
 
654
            if prop._dbus_access == u"write":
 
655
                continue
 
656
            value = prop()
 
657
            if not hasattr(value, u"variant_level"):
 
658
                all[name] = value
 
659
                continue
 
660
            all[name] = type(value)(value, variant_level=
 
661
                                    value.variant_level+1)
 
662
        return dbus.Dictionary(all, signature=u"sv")
 
663
    
 
664
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
665
                         out_signature=u"s",
 
666
                         path_keyword='object_path',
 
667
                         connection_keyword='connection')
 
668
    def Introspect(self, object_path, connection):
 
669
        """Standard D-Bus method, overloaded to insert property tags.
 
670
        """
 
671
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
672
                                                   connection)
 
673
        try:
 
674
            document = xml.dom.minidom.parseString(xmlstring)
 
675
            def make_tag(document, name, prop):
 
676
                e = document.createElement(u"property")
 
677
                e.setAttribute(u"name", name)
 
678
                e.setAttribute(u"type", prop._dbus_signature)
 
679
                e.setAttribute(u"access", prop._dbus_access)
 
680
                return e
 
681
            for if_tag in document.getElementsByTagName(u"interface"):
 
682
                for tag in (make_tag(document, name, prop)
 
683
                            for name, prop
 
684
                            in self._get_all_dbus_properties()
 
685
                            if prop._dbus_interface
 
686
                            == if_tag.getAttribute(u"name")):
 
687
                    if_tag.appendChild(tag)
 
688
                # Add the names to the return values for the
 
689
                # "org.freedesktop.DBus.Properties" methods
 
690
                if (if_tag.getAttribute(u"name")
 
691
                    == u"org.freedesktop.DBus.Properties"):
 
692
                    for cn in if_tag.getElementsByTagName(u"method"):
 
693
                        if cn.getAttribute(u"name") == u"Get":
 
694
                            for arg in cn.getElementsByTagName(u"arg"):
 
695
                                if (arg.getAttribute(u"direction")
 
696
                                    == u"out"):
 
697
                                    arg.setAttribute(u"name", u"value")
 
698
                        elif cn.getAttribute(u"name") == u"GetAll":
 
699
                            for arg in cn.getElementsByTagName(u"arg"):
 
700
                                if (arg.getAttribute(u"direction")
 
701
                                    == u"out"):
 
702
                                    arg.setAttribute(u"name", u"props")
 
703
            xmlstring = document.toxml(u"utf-8")
 
704
            document.unlink()
 
705
        except (AttributeError, xml.dom.DOMException,
 
706
                xml.parsers.expat.ExpatError), error:
 
707
            logger.error(u"Failed to override Introspection method",
 
708
                         error)
 
709
        return xmlstring
 
710
 
 
711
 
 
712
class ClientDBus(Client, DBusObjectWithProperties):
481
713
    """A Client class using D-Bus
482
714
    
483
715
    Attributes:
484
716
    dbus_object_path: dbus.ObjectPath
485
717
    bus: dbus.SystemBus()
486
718
    """
 
719
    
 
720
    runtime_expansions = (Client.runtime_expansions
 
721
                          + (u"dbus_object_path",))
 
722
    
487
723
    # dbus.service.Object doesn't use super(), so we can't either.
488
724
    
489
725
    def __init__(self, bus = None, *args, **kwargs):
 
726
        self._approvals_pending = 0
490
727
        self.bus = bus
491
728
        Client.__init__(self, *args, **kwargs)
492
729
        # Only now, when this client is initialized, can it show up on
493
730
        # the D-Bus
 
731
        client_object_name = unicode(self.name).translate(
 
732
            {ord(u"."): ord(u"_"),
 
733
             ord(u"-"): ord(u"_")})
494
734
        self.dbus_object_path = (dbus.ObjectPath
495
 
                                 (u"/clients/"
496
 
                                  + self.name.replace(u".", u"_")))
497
 
        dbus.service.Object.__init__(self, self.bus,
498
 
                                     self.dbus_object_path)
 
735
                                 (u"/clients/" + client_object_name))
 
736
        DBusObjectWithProperties.__init__(self, self.bus,
 
737
                                          self.dbus_object_path)
 
738
        
 
739
    def _get_approvals_pending(self):
 
740
        return self._approvals_pending
 
741
    def _set_approvals_pending(self, value):
 
742
        old_value = self._approvals_pending
 
743
        self._approvals_pending = value
 
744
        bval = bool(value)
 
745
        if (hasattr(self, "dbus_object_path")
 
746
            and bval is not bool(old_value)):
 
747
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
748
            self.PropertyChanged(dbus.String(u"ApprovalPending"),
 
749
                                 dbus_bool)
 
750
 
 
751
    approvals_pending = property(_get_approvals_pending,
 
752
                                 _set_approvals_pending)
 
753
    del _get_approvals_pending, _set_approvals_pending
499
754
    
500
755
    @staticmethod
501
756
    def _datetime_to_dbus(dt, variant_level=0):
508
763
        r = Client.enable(self)
509
764
        if oldstate != self.enabled:
510
765
            # Emit D-Bus signals
511
 
            self.PropertyChanged(dbus.String(u"enabled"),
 
766
            self.PropertyChanged(dbus.String(u"Enabled"),
512
767
                                 dbus.Boolean(True, variant_level=1))
513
768
            self.PropertyChanged(
514
 
                dbus.String(u"last_enabled"),
 
769
                dbus.String(u"LastEnabled"),
515
770
                self._datetime_to_dbus(self.last_enabled,
516
771
                                       variant_level=1))
517
772
        return r
518
773
    
519
 
    def disable(self, signal = True):
 
774
    def disable(self, quiet = False):
520
775
        oldstate = getattr(self, u"enabled", False)
521
 
        r = Client.disable(self)
522
 
        if signal and oldstate != self.enabled:
 
776
        r = Client.disable(self, quiet=quiet)
 
777
        if not quiet and oldstate != self.enabled:
523
778
            # Emit D-Bus signal
524
 
            self.PropertyChanged(dbus.String(u"enabled"),
 
779
            self.PropertyChanged(dbus.String(u"Enabled"),
525
780
                                 dbus.Boolean(False, variant_level=1))
526
781
        return r
527
782
    
530
785
            self.remove_from_connection()
531
786
        except LookupError:
532
787
            pass
533
 
        if hasattr(dbus.service.Object, u"__del__"):
534
 
            dbus.service.Object.__del__(self, *args, **kwargs)
 
788
        if hasattr(DBusObjectWithProperties, u"__del__"):
 
789
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
535
790
        Client.__del__(self, *args, **kwargs)
536
791
    
537
792
    def checker_callback(self, pid, condition, command,
539
794
        self.checker_callback_tag = None
540
795
        self.checker = None
541
796
        # Emit D-Bus signal
542
 
        self.PropertyChanged(dbus.String(u"checker_running"),
 
797
        self.PropertyChanged(dbus.String(u"CheckerRunning"),
543
798
                             dbus.Boolean(False, variant_level=1))
544
799
        if os.WIFEXITED(condition):
545
800
            exitstatus = os.WEXITSTATUS(condition)
560
815
        r = Client.checked_ok(self, *args, **kwargs)
561
816
        # Emit D-Bus signal
562
817
        self.PropertyChanged(
563
 
            dbus.String(u"last_checked_ok"),
 
818
            dbus.String(u"LastCheckedOK"),
564
819
            (self._datetime_to_dbus(self.last_checked_ok,
565
820
                                    variant_level=1)))
566
821
        return r
567
822
    
 
823
    def need_approval(self, *args, **kwargs):
 
824
        r = Client.need_approval(self, *args, **kwargs)
 
825
        # Emit D-Bus signal
 
826
        self.PropertyChanged(
 
827
            dbus.String(u"LastApprovalRequest"),
 
828
            (self._datetime_to_dbus(self.last_approval_request,
 
829
                                    variant_level=1)))
 
830
        return r
 
831
    
568
832
    def start_checker(self, *args, **kwargs):
569
833
        old_checker = self.checker
570
834
        if self.checker is not None:
578
842
            # Emit D-Bus signal
579
843
            self.CheckerStarted(self.current_checker_command)
580
844
            self.PropertyChanged(
581
 
                dbus.String(u"checker_running"),
 
845
                dbus.String(u"CheckerRunning"),
582
846
                dbus.Boolean(True, variant_level=1))
583
847
        return r
584
848
    
587
851
        r = Client.stop_checker(self, *args, **kwargs)
588
852
        if (old_checker is not None
589
853
            and getattr(self, u"checker", None) is None):
590
 
            self.PropertyChanged(dbus.String(u"checker_running"),
 
854
            self.PropertyChanged(dbus.String(u"CheckerRunning"),
591
855
                                 dbus.Boolean(False, variant_level=1))
592
856
        return r
593
 
    
594
 
    ## D-Bus methods & signals
 
857
 
 
858
    def _reset_approved(self):
 
859
        self._approved = None
 
860
        return False
 
861
    
 
862
    def approve(self, value=True):
 
863
        self.send_changedstate()
 
864
        self._approved = value
 
865
        gobject.timeout_add(self._timedelta_to_milliseconds
 
866
                            (self.approval_duration),
 
867
                            self._reset_approved)
 
868
    
 
869
    
 
870
    ## D-Bus methods, signals & properties
595
871
    _interface = u"se.bsnet.fukt.Mandos.Client"
596
872
    
597
 
    # CheckedOK - method
598
 
    @dbus.service.method(_interface)
599
 
    def CheckedOK(self):
600
 
        return self.checked_ok()
 
873
    ## Signals
601
874
    
602
875
    # CheckerCompleted - signal
603
876
    @dbus.service.signal(_interface, signature=u"nxs")
611
884
        "D-Bus signal"
612
885
        pass
613
886
    
614
 
    # GetAllProperties - method
615
 
    @dbus.service.method(_interface, out_signature=u"a{sv}")
616
 
    def GetAllProperties(self):
617
 
        "D-Bus method"
618
 
        return dbus.Dictionary({
619
 
                dbus.String(u"name"):
620
 
                    dbus.String(self.name, variant_level=1),
621
 
                dbus.String(u"fingerprint"):
622
 
                    dbus.String(self.fingerprint, variant_level=1),
623
 
                dbus.String(u"host"):
624
 
                    dbus.String(self.host, variant_level=1),
625
 
                dbus.String(u"created"):
626
 
                    self._datetime_to_dbus(self.created,
627
 
                                           variant_level=1),
628
 
                dbus.String(u"last_enabled"):
629
 
                    (self._datetime_to_dbus(self.last_enabled,
630
 
                                            variant_level=1)
631
 
                     if self.last_enabled is not None
632
 
                     else dbus.Boolean(False, variant_level=1)),
633
 
                dbus.String(u"enabled"):
634
 
                    dbus.Boolean(self.enabled, variant_level=1),
635
 
                dbus.String(u"last_checked_ok"):
636
 
                    (self._datetime_to_dbus(self.last_checked_ok,
637
 
                                            variant_level=1)
638
 
                     if self.last_checked_ok is not None
639
 
                     else dbus.Boolean (False, variant_level=1)),
640
 
                dbus.String(u"timeout"):
641
 
                    dbus.UInt64(self.timeout_milliseconds(),
642
 
                                variant_level=1),
643
 
                dbus.String(u"interval"):
644
 
                    dbus.UInt64(self.interval_milliseconds(),
645
 
                                variant_level=1),
646
 
                dbus.String(u"checker"):
647
 
                    dbus.String(self.checker_command,
648
 
                                variant_level=1),
649
 
                dbus.String(u"checker_running"):
650
 
                    dbus.Boolean(self.checker is not None,
651
 
                                 variant_level=1),
652
 
                dbus.String(u"object_path"):
653
 
                    dbus.ObjectPath(self.dbus_object_path,
654
 
                                    variant_level=1)
655
 
                }, signature=u"sv")
656
 
    
657
 
    # IsStillValid - method
658
 
    @dbus.service.method(_interface, out_signature=u"b")
659
 
    def IsStillValid(self):
660
 
        return self.still_valid()
661
 
    
662
887
    # PropertyChanged - signal
663
888
    @dbus.service.signal(_interface, signature=u"sv")
664
889
    def PropertyChanged(self, property, value):
665
890
        "D-Bus signal"
666
891
        pass
667
892
    
668
 
    # ReceivedSecret - signal
 
893
    # GotSecret - signal
669
894
    @dbus.service.signal(_interface)
670
 
    def ReceivedSecret(self):
671
 
        "D-Bus signal"
 
895
    def GotSecret(self):
 
896
        """D-Bus signal
 
897
        Is sent after a successful transfer of secret from the Mandos
 
898
        server to mandos-client
 
899
        """
672
900
        pass
673
901
    
674
902
    # Rejected - signal
675
 
    @dbus.service.signal(_interface)
676
 
    def Rejected(self):
 
903
    @dbus.service.signal(_interface, signature=u"s")
 
904
    def Rejected(self, reason):
677
905
        "D-Bus signal"
678
906
        pass
679
907
    
680
 
    # SetChecker - method
681
 
    @dbus.service.method(_interface, in_signature=u"s")
682
 
    def SetChecker(self, checker):
683
 
        "D-Bus setter method"
684
 
        self.checker_command = checker
685
 
        # Emit D-Bus signal
686
 
        self.PropertyChanged(dbus.String(u"checker"),
687
 
                             dbus.String(self.checker_command,
688
 
                                         variant_level=1))
689
 
    
690
 
    # SetHost - method
691
 
    @dbus.service.method(_interface, in_signature=u"s")
692
 
    def SetHost(self, host):
693
 
        "D-Bus setter method"
694
 
        self.host = host
695
 
        # Emit D-Bus signal
696
 
        self.PropertyChanged(dbus.String(u"host"),
697
 
                             dbus.String(self.host, variant_level=1))
698
 
    
699
 
    # SetInterval - method
700
 
    @dbus.service.method(_interface, in_signature=u"t")
701
 
    def SetInterval(self, milliseconds):
702
 
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
703
 
        # Emit D-Bus signal
704
 
        self.PropertyChanged(dbus.String(u"interval"),
705
 
                             (dbus.UInt64(self.interval_milliseconds(),
706
 
                                          variant_level=1)))
707
 
    
708
 
    # SetSecret - method
709
 
    @dbus.service.method(_interface, in_signature=u"ay",
710
 
                         byte_arrays=True)
711
 
    def SetSecret(self, secret):
712
 
        "D-Bus setter method"
713
 
        self.secret = str(secret)
714
 
    
715
 
    # SetTimeout - method
716
 
    @dbus.service.method(_interface, in_signature=u"t")
717
 
    def SetTimeout(self, milliseconds):
718
 
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
719
 
        # Emit D-Bus signal
720
 
        self.PropertyChanged(dbus.String(u"timeout"),
721
 
                             (dbus.UInt64(self.timeout_milliseconds(),
722
 
                                          variant_level=1)))
 
908
    # NeedApproval - signal
 
909
    @dbus.service.signal(_interface, signature=u"tb")
 
910
    def NeedApproval(self, timeout, default):
 
911
        "D-Bus signal"
 
912
        return self.need_approval()
 
913
    
 
914
    ## Methods
 
915
    
 
916
    # Approve - method
 
917
    @dbus.service.method(_interface, in_signature=u"b")
 
918
    def Approve(self, value):
 
919
        self.approve(value)
 
920
    
 
921
    # CheckedOK - method
 
922
    @dbus.service.method(_interface)
 
923
    def CheckedOK(self):
 
924
        return self.checked_ok()
723
925
    
724
926
    # Enable - method
725
927
    @dbus.service.method(_interface)
744
946
    def StopChecker(self):
745
947
        self.stop_checker()
746
948
    
 
949
    ## Properties
 
950
    
 
951
    # ApprovalPending - property
 
952
    @dbus_service_property(_interface, signature=u"b", access=u"read")
 
953
    def ApprovalPending_dbus_property(self):
 
954
        return dbus.Boolean(bool(self.approvals_pending))
 
955
    
 
956
    # ApprovedByDefault - property
 
957
    @dbus_service_property(_interface, signature=u"b",
 
958
                           access=u"readwrite")
 
959
    def ApprovedByDefault_dbus_property(self, value=None):
 
960
        if value is None:       # get
 
961
            return dbus.Boolean(self.approved_by_default)
 
962
        self.approved_by_default = bool(value)
 
963
        # Emit D-Bus signal
 
964
        self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
 
965
                             dbus.Boolean(value, variant_level=1))
 
966
    
 
967
    # ApprovalDelay - property
 
968
    @dbus_service_property(_interface, signature=u"t",
 
969
                           access=u"readwrite")
 
970
    def ApprovalDelay_dbus_property(self, value=None):
 
971
        if value is None:       # get
 
972
            return dbus.UInt64(self.approval_delay_milliseconds())
 
973
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
974
        # Emit D-Bus signal
 
975
        self.PropertyChanged(dbus.String(u"ApprovalDelay"),
 
976
                             dbus.UInt64(value, variant_level=1))
 
977
    
 
978
    # ApprovalDuration - property
 
979
    @dbus_service_property(_interface, signature=u"t",
 
980
                           access=u"readwrite")
 
981
    def ApprovalDuration_dbus_property(self, value=None):
 
982
        if value is None:       # get
 
983
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
984
                    self.approval_duration))
 
985
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
986
        # Emit D-Bus signal
 
987
        self.PropertyChanged(dbus.String(u"ApprovalDuration"),
 
988
                             dbus.UInt64(value, variant_level=1))
 
989
    
 
990
    # Name - property
 
991
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
992
    def Name_dbus_property(self):
 
993
        return dbus.String(self.name)
 
994
    
 
995
    # Fingerprint - property
 
996
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
997
    def Fingerprint_dbus_property(self):
 
998
        return dbus.String(self.fingerprint)
 
999
    
 
1000
    # Host - property
 
1001
    @dbus_service_property(_interface, signature=u"s",
 
1002
                           access=u"readwrite")
 
1003
    def Host_dbus_property(self, value=None):
 
1004
        if value is None:       # get
 
1005
            return dbus.String(self.host)
 
1006
        self.host = value
 
1007
        # Emit D-Bus signal
 
1008
        self.PropertyChanged(dbus.String(u"Host"),
 
1009
                             dbus.String(value, variant_level=1))
 
1010
    
 
1011
    # Created - property
 
1012
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1013
    def Created_dbus_property(self):
 
1014
        return dbus.String(self._datetime_to_dbus(self.created))
 
1015
    
 
1016
    # LastEnabled - property
 
1017
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1018
    def LastEnabled_dbus_property(self):
 
1019
        if self.last_enabled is None:
 
1020
            return dbus.String(u"")
 
1021
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
1022
    
 
1023
    # Enabled - property
 
1024
    @dbus_service_property(_interface, signature=u"b",
 
1025
                           access=u"readwrite")
 
1026
    def Enabled_dbus_property(self, value=None):
 
1027
        if value is None:       # get
 
1028
            return dbus.Boolean(self.enabled)
 
1029
        if value:
 
1030
            self.enable()
 
1031
        else:
 
1032
            self.disable()
 
1033
    
 
1034
    # LastCheckedOK - property
 
1035
    @dbus_service_property(_interface, signature=u"s",
 
1036
                           access=u"readwrite")
 
1037
    def LastCheckedOK_dbus_property(self, value=None):
 
1038
        if value is not None:
 
1039
            self.checked_ok()
 
1040
            return
 
1041
        if self.last_checked_ok is None:
 
1042
            return dbus.String(u"")
 
1043
        return dbus.String(self._datetime_to_dbus(self
 
1044
                                                  .last_checked_ok))
 
1045
    
 
1046
    # LastApprovalRequest - property
 
1047
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1048
    def LastApprovalRequest_dbus_property(self):
 
1049
        if self.last_approval_request is None:
 
1050
            return dbus.String(u"")
 
1051
        return dbus.String(self.
 
1052
                           _datetime_to_dbus(self
 
1053
                                             .last_approval_request))
 
1054
    
 
1055
    # Timeout - property
 
1056
    @dbus_service_property(_interface, signature=u"t",
 
1057
                           access=u"readwrite")
 
1058
    def Timeout_dbus_property(self, value=None):
 
1059
        if value is None:       # get
 
1060
            return dbus.UInt64(self.timeout_milliseconds())
 
1061
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1062
        # Emit D-Bus signal
 
1063
        self.PropertyChanged(dbus.String(u"Timeout"),
 
1064
                             dbus.UInt64(value, variant_level=1))
 
1065
        if getattr(self, u"disable_initiator_tag", None) is None:
 
1066
            return
 
1067
        # Reschedule timeout
 
1068
        gobject.source_remove(self.disable_initiator_tag)
 
1069
        self.disable_initiator_tag = None
 
1070
        time_to_die = (self.
 
1071
                       _timedelta_to_milliseconds((self
 
1072
                                                   .last_checked_ok
 
1073
                                                   + self.timeout)
 
1074
                                                  - datetime.datetime
 
1075
                                                  .utcnow()))
 
1076
        if time_to_die <= 0:
 
1077
            # The timeout has passed
 
1078
            self.disable()
 
1079
        else:
 
1080
            self.disable_initiator_tag = (gobject.timeout_add
 
1081
                                          (time_to_die, self.disable))
 
1082
    
 
1083
    # Interval - property
 
1084
    @dbus_service_property(_interface, signature=u"t",
 
1085
                           access=u"readwrite")
 
1086
    def Interval_dbus_property(self, value=None):
 
1087
        if value is None:       # get
 
1088
            return dbus.UInt64(self.interval_milliseconds())
 
1089
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1090
        # Emit D-Bus signal
 
1091
        self.PropertyChanged(dbus.String(u"Interval"),
 
1092
                             dbus.UInt64(value, variant_level=1))
 
1093
        if getattr(self, u"checker_initiator_tag", None) is None:
 
1094
            return
 
1095
        # Reschedule checker run
 
1096
        gobject.source_remove(self.checker_initiator_tag)
 
1097
        self.checker_initiator_tag = (gobject.timeout_add
 
1098
                                      (value, self.start_checker))
 
1099
        self.start_checker()    # Start one now, too
 
1100
 
 
1101
    # Checker - property
 
1102
    @dbus_service_property(_interface, signature=u"s",
 
1103
                           access=u"readwrite")
 
1104
    def Checker_dbus_property(self, value=None):
 
1105
        if value is None:       # get
 
1106
            return dbus.String(self.checker_command)
 
1107
        self.checker_command = value
 
1108
        # Emit D-Bus signal
 
1109
        self.PropertyChanged(dbus.String(u"Checker"),
 
1110
                             dbus.String(self.checker_command,
 
1111
                                         variant_level=1))
 
1112
    
 
1113
    # CheckerRunning - property
 
1114
    @dbus_service_property(_interface, signature=u"b",
 
1115
                           access=u"readwrite")
 
1116
    def CheckerRunning_dbus_property(self, value=None):
 
1117
        if value is None:       # get
 
1118
            return dbus.Boolean(self.checker is not None)
 
1119
        if value:
 
1120
            self.start_checker()
 
1121
        else:
 
1122
            self.stop_checker()
 
1123
    
 
1124
    # ObjectPath - property
 
1125
    @dbus_service_property(_interface, signature=u"o", access=u"read")
 
1126
    def ObjectPath_dbus_property(self):
 
1127
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1128
    
 
1129
    # Secret = property
 
1130
    @dbus_service_property(_interface, signature=u"ay",
 
1131
                           access=u"write", byte_arrays=True)
 
1132
    def Secret_dbus_property(self, value):
 
1133
        self.secret = str(value)
 
1134
    
747
1135
    del _interface
748
1136
 
749
1137
 
 
1138
class ProxyClient(object):
 
1139
    def __init__(self, child_pipe, fpr, address):
 
1140
        self._pipe = child_pipe
 
1141
        self._pipe.send(('init', fpr, address))
 
1142
        if not self._pipe.recv():
 
1143
            raise KeyError()
 
1144
 
 
1145
    def __getattribute__(self, name):
 
1146
        if(name == '_pipe'):
 
1147
            return super(ProxyClient, self).__getattribute__(name)
 
1148
        self._pipe.send(('getattr', name))
 
1149
        data = self._pipe.recv()
 
1150
        if data[0] == 'data':
 
1151
            return data[1]
 
1152
        if data[0] == 'function':
 
1153
            def func(*args, **kwargs):
 
1154
                self._pipe.send(('funcall', name, args, kwargs))
 
1155
                return self._pipe.recv()[1]
 
1156
            return func
 
1157
 
 
1158
    def __setattr__(self, name, value):
 
1159
        if(name == '_pipe'):
 
1160
            return super(ProxyClient, self).__setattr__(name, value)
 
1161
        self._pipe.send(('setattr', name, value))
 
1162
 
 
1163
 
750
1164
class ClientHandler(socketserver.BaseRequestHandler, object):
751
1165
    """A class to handle client connections.
752
1166
    
754
1168
    Note: This will run in its own forked process."""
755
1169
    
756
1170
    def handle(self):
757
 
        logger.info(u"TCP connection from: %s",
758
 
                    unicode(self.client_address))
759
 
        logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
 
        # Open IPC pipe to parent process
761
 
        with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
 
1171
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1172
            logger.info(u"TCP connection from: %s",
 
1173
                        unicode(self.client_address))
 
1174
            logger.debug(u"Pipe FD: %d",
 
1175
                         self.server.child_pipe.fileno())
 
1176
 
762
1177
            session = (gnutls.connection
763
1178
                       .ClientSession(self.request,
764
1179
                                      gnutls.connection
765
1180
                                      .X509Credentials()))
766
 
            
767
 
            line = self.request.makefile().readline()
768
 
            logger.debug(u"Protocol version: %r", line)
769
 
            try:
770
 
                if int(line.strip().split()[0]) > 1:
771
 
                    raise RuntimeError
772
 
            except (ValueError, IndexError, RuntimeError), error:
773
 
                logger.error(u"Unknown protocol version: %s", error)
774
 
                return
775
 
            
 
1181
 
776
1182
            # Note: gnutls.connection.X509Credentials is really a
777
1183
            # generic GnuTLS certificate credentials object so long as
778
1184
            # no X.509 keys are added to it.  Therefore, we can use it
779
1185
            # here despite using OpenPGP certificates.
780
 
            
 
1186
 
781
1187
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
1188
            #                      u"+AES-256-CBC", u"+SHA1",
783
1189
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
789
1195
            (gnutls.library.functions
790
1196
             .gnutls_priority_set_direct(session._c_object,
791
1197
                                         priority, None))
792
 
            
 
1198
 
 
1199
            # Start communication using the Mandos protocol
 
1200
            # Get protocol number
 
1201
            line = self.request.makefile().readline()
 
1202
            logger.debug(u"Protocol version: %r", line)
 
1203
            try:
 
1204
                if int(line.strip().split()[0]) > 1:
 
1205
                    raise RuntimeError
 
1206
            except (ValueError, IndexError, RuntimeError), error:
 
1207
                logger.error(u"Unknown protocol version: %s", error)
 
1208
                return
 
1209
 
 
1210
            # Start GnuTLS connection
793
1211
            try:
794
1212
                session.handshake()
795
1213
            except gnutls.errors.GNUTLSError, error:
798
1216
                # established.  Just abandon the request.
799
1217
                return
800
1218
            logger.debug(u"Handshake succeeded")
 
1219
 
 
1220
            approval_required = False
801
1221
            try:
802
 
                fpr = self.fingerprint(self.peer_certificate(session))
803
 
            except (TypeError, gnutls.errors.GNUTLSError), error:
804
 
                logger.warning(u"Bad certificate: %s", error)
805
 
                session.bye()
806
 
                return
807
 
            logger.debug(u"Fingerprint: %s", fpr)
 
1222
                try:
 
1223
                    fpr = self.fingerprint(self.peer_certificate
 
1224
                                           (session))
 
1225
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1226
                    logger.warning(u"Bad certificate: %s", error)
 
1227
                    return
 
1228
                logger.debug(u"Fingerprint: %s", fpr)
 
1229
 
 
1230
                try:
 
1231
                    client = ProxyClient(child_pipe, fpr,
 
1232
                                         self.client_address)
 
1233
                except KeyError:
 
1234
                    return
 
1235
                
 
1236
                if client.approval_delay:
 
1237
                    delay = client.approval_delay
 
1238
                    client.approvals_pending += 1
 
1239
                    approval_required = True
 
1240
                
 
1241
                while True:
 
1242
                    if not client.enabled:
 
1243
                        logger.warning(u"Client %s is disabled",
 
1244
                                       client.name)
 
1245
                        if self.server.use_dbus:
 
1246
                            # Emit D-Bus signal
 
1247
                            client.Rejected("Disabled")                    
 
1248
                        return
 
1249
                    
 
1250
                    if client._approved or not client.approval_delay:
 
1251
                        #We are approved or approval is disabled
 
1252
                        break
 
1253
                    elif client._approved is None:
 
1254
                        logger.info(u"Client %s needs approval",
 
1255
                                    client.name)
 
1256
                        if self.server.use_dbus:
 
1257
                            # Emit D-Bus signal
 
1258
                            client.NeedApproval(
 
1259
                                client.approval_delay_milliseconds(),
 
1260
                                client.approved_by_default)
 
1261
                    else:
 
1262
                        logger.warning(u"Client %s was not approved",
 
1263
                                       client.name)
 
1264
                        if self.server.use_dbus:
 
1265
                            # Emit D-Bus signal
 
1266
                            client.Rejected("Denied")
 
1267
                        return
 
1268
                    
 
1269
                    #wait until timeout or approved
 
1270
                    #x = float(client._timedelta_to_milliseconds(delay))
 
1271
                    time = datetime.datetime.now()
 
1272
                    client.changedstate.acquire()
 
1273
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1274
                    client.changedstate.release()
 
1275
                    time2 = datetime.datetime.now()
 
1276
                    if (time2 - time) >= delay:
 
1277
                        if not client.approved_by_default:
 
1278
                            logger.warning("Client %s timed out while"
 
1279
                                           " waiting for approval",
 
1280
                                           client.name)
 
1281
                            if self.server.use_dbus:
 
1282
                                # Emit D-Bus signal
 
1283
                                client.Rejected("Approval timed out")
 
1284
                            return
 
1285
                        else:
 
1286
                            break
 
1287
                    else:
 
1288
                        delay -= time2 - time
 
1289
                
 
1290
                sent_size = 0
 
1291
                while sent_size < len(client.secret):
 
1292
                    try:
 
1293
                        sent = session.send(client.secret[sent_size:])
 
1294
                    except (gnutls.errors.GNUTLSError), error:
 
1295
                        logger.warning("gnutls send failed")
 
1296
                        return
 
1297
                    logger.debug(u"Sent: %d, remaining: %d",
 
1298
                                 sent, len(client.secret)
 
1299
                                 - (sent_size + sent))
 
1300
                    sent_size += sent
 
1301
 
 
1302
                logger.info(u"Sending secret to %s", client.name)
 
1303
                # bump the timeout as if seen
 
1304
                client.checked_ok()
 
1305
                if self.server.use_dbus:
 
1306
                    # Emit D-Bus signal
 
1307
                    client.GotSecret()
808
1308
            
809
 
            for c in self.server.clients:
810
 
                if c.fingerprint == fpr:
811
 
                    client = c
812
 
                    break
813
 
            else:
814
 
                ipc.write(u"NOTFOUND %s\n" % fpr)
815
 
                session.bye()
816
 
                return
817
 
            # Have to check if client.still_valid(), since it is
818
 
            # possible that the client timed out while establishing
819
 
            # the GnuTLS session.
820
 
            if not client.still_valid():
821
 
                ipc.write(u"INVALID %s\n" % client.name)
822
 
                session.bye()
823
 
                return
824
 
            ipc.write(u"SENDING %s\n" % client.name)
825
 
            sent_size = 0
826
 
            while sent_size < len(client.secret):
827
 
                sent = session.send(client.secret[sent_size:])
828
 
                logger.debug(u"Sent: %d, remaining: %d",
829
 
                             sent, len(client.secret)
830
 
                             - (sent_size + sent))
831
 
                sent_size += sent
832
 
            session.bye()
 
1309
            finally:
 
1310
                if approval_required:
 
1311
                    client.approvals_pending -= 1
 
1312
                try:
 
1313
                    session.bye()
 
1314
                except (gnutls.errors.GNUTLSError), error:
 
1315
                    logger.warning("GnuTLS bye failed")
833
1316
    
834
1317
    @staticmethod
835
1318
    def peer_certificate(session):
895
1378
        return hex_fpr
896
1379
 
897
1380
 
898
 
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
899
 
    """Like socketserver.ForkingMixIn, but also pass a pipe."""
 
1381
class MultiprocessingMixIn(object):
 
1382
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1383
    def sub_process_main(self, request, address):
 
1384
        try:
 
1385
            self.finish_request(request, address)
 
1386
        except:
 
1387
            self.handle_error(request, address)
 
1388
        self.close_request(request)
 
1389
            
 
1390
    def process_request(self, request, address):
 
1391
        """Start a new process to process the request."""
 
1392
        multiprocessing.Process(target = self.sub_process_main,
 
1393
                                args = (request, address)).start()
 
1394
 
 
1395
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1396
    """ adds a pipe to the MixIn """
900
1397
    def process_request(self, request, client_address):
901
1398
        """Overrides and wraps the original process_request().
902
1399
        
903
 
        This function creates a new pipe in self.pipe 
 
1400
        This function creates a new pipe in self.pipe
904
1401
        """
905
 
        self.pipe = os.pipe()
906
 
        super(ForkingMixInWithPipe,
 
1402
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1403
 
 
1404
        super(MultiprocessingMixInWithPipe,
907
1405
              self).process_request(request, client_address)
908
 
        os.close(self.pipe[1])  # close write end
909
 
        self.add_pipe(self.pipe[0])
910
 
    def add_pipe(self, pipe):
 
1406
        self.child_pipe.close()
 
1407
        self.add_pipe(parent_pipe)
 
1408
 
 
1409
    def add_pipe(self, parent_pipe):
911
1410
        """Dummy function; override as necessary"""
912
 
        os.close(pipe)
913
 
 
914
 
 
915
 
class IPv6_TCPServer(ForkingMixInWithPipe,
 
1411
        pass
 
1412
 
 
1413
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
916
1414
                     socketserver.TCPServer, object):
917
1415
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
918
1416
    
982
1480
        clients:        set of Client objects
983
1481
        gnutls_priority GnuTLS priority string
984
1482
        use_dbus:       Boolean; to emit D-Bus signals or not
985
 
        clients:        set of Client objects
986
 
        gnutls_priority GnuTLS priority string
987
 
        use_dbus:       Boolean; to emit D-Bus signals or not
988
1483
    
989
1484
    Assumes a gobject.MainLoop event loop.
990
1485
    """
1006
1501
            return socketserver.TCPServer.server_activate(self)
1007
1502
    def enable(self):
1008
1503
        self.enabled = True
1009
 
    def add_pipe(self, pipe):
 
1504
    def add_pipe(self, parent_pipe):
1010
1505
        # Call "handle_ipc" for both data and EOF events
1011
 
        gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1012
 
                             self.handle_ipc)
1013
 
    def handle_ipc(self, source, condition, file_objects={}):
 
1506
        gobject.io_add_watch(parent_pipe.fileno(),
 
1507
                             gobject.IO_IN | gobject.IO_HUP,
 
1508
                             functools.partial(self.handle_ipc,
 
1509
                                               parent_pipe = parent_pipe))
 
1510
        
 
1511
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1512
                   client_object=None):
1014
1513
        condition_names = {
1015
1514
            gobject.IO_IN: u"IN",   # There is data to read.
1016
1515
            gobject.IO_OUT: u"OUT", # Data can be written (without
1025
1524
                                       for cond, name in
1026
1525
                                       condition_names.iteritems()
1027
1526
                                       if cond & condition)
1028
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1029
 
                     conditions_string)
1030
 
        
1031
 
        # Turn the pipe file descriptor into a Python file object
1032
 
        if source not in file_objects:
1033
 
            file_objects[source] = os.fdopen(source, u"r", 1)
1034
 
        
1035
 
        # Read a line from the file object
1036
 
        cmdline = file_objects[source].readline()
1037
 
        if not cmdline:             # Empty line means end of file
1038
 
            # close the IPC pipe
1039
 
            file_objects[source].close()
1040
 
            del file_objects[source]
1041
 
            
1042
 
            # Stop calling this function
1043
 
            return False
1044
 
        
1045
 
        logger.debug(u"IPC command: %r", cmdline)
1046
 
        
1047
 
        # Parse and act on command
1048
 
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1049
 
        
1050
 
        if cmd == u"NOTFOUND":
1051
 
            logger.warning(u"Client not found for fingerprint: %s",
1052
 
                           args)
1053
 
            if self.use_dbus:
1054
 
                # Emit D-Bus signal
1055
 
                mandos_dbus_service.ClientNotFound(args)
1056
 
        elif cmd == u"INVALID":
1057
 
            for client in self.clients:
1058
 
                if client.name == args:
1059
 
                    logger.warning(u"Client %s is invalid", args)
1060
 
                    if self.use_dbus:
1061
 
                        # Emit D-Bus signal
1062
 
                        client.Rejected()
1063
 
                    break
1064
 
            else:
1065
 
                logger.error(u"Unknown client %s is invalid", args)
1066
 
        elif cmd == u"SENDING":
1067
 
            for client in self.clients:
1068
 
                if client.name == args:
1069
 
                    logger.info(u"Sending secret to %s", client.name)
1070
 
                    client.checked_ok()
1071
 
                    if self.use_dbus:
1072
 
                        # Emit D-Bus signal
1073
 
                        client.ReceivedSecret()
1074
 
                    break
1075
 
            else:
1076
 
                logger.error(u"Sending secret to unknown client %s",
1077
 
                             args)
1078
 
        else:
1079
 
            logger.error(u"Unknown IPC command: %r", cmdline)
1080
 
        
1081
 
        # Keep calling this function
 
1527
        # error or the other end of multiprocessing.Pipe has closed
 
1528
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1529
            return False
 
1530
        
 
1531
        # Read a request from the child
 
1532
        request = parent_pipe.recv()
 
1533
        command = request[0]
 
1534
        
 
1535
        if command == 'init':
 
1536
            fpr = request[1]
 
1537
            address = request[2]
 
1538
            
 
1539
            for c in self.clients:
 
1540
                if c.fingerprint == fpr:
 
1541
                    client = c
 
1542
                    break
 
1543
            else:
 
1544
                logger.warning(u"Client not found for fingerprint: %s, ad"
 
1545
                               u"dress: %s", fpr, address)
 
1546
                if self.use_dbus:
 
1547
                    # Emit D-Bus signal
 
1548
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
1549
                parent_pipe.send(False)
 
1550
                return False
 
1551
            
 
1552
            gobject.io_add_watch(parent_pipe.fileno(),
 
1553
                                 gobject.IO_IN | gobject.IO_HUP,
 
1554
                                 functools.partial(self.handle_ipc,
 
1555
                                                   parent_pipe = parent_pipe,
 
1556
                                                   client_object = client))
 
1557
            parent_pipe.send(True)
 
1558
            # remove the old hook in favor of the new above hook on same fileno
 
1559
            return False
 
1560
        if command == 'funcall':
 
1561
            funcname = request[1]
 
1562
            args = request[2]
 
1563
            kwargs = request[3]
 
1564
            
 
1565
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1566
 
 
1567
        if command == 'getattr':
 
1568
            attrname = request[1]
 
1569
            if callable(client_object.__getattribute__(attrname)):
 
1570
                parent_pipe.send(('function',))
 
1571
            else:
 
1572
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
1573
        
 
1574
        if command == 'setattr':
 
1575
            attrname = request[1]
 
1576
            value = request[2]
 
1577
            setattr(client_object, attrname, value)
 
1578
 
1082
1579
        return True
1083
1580
 
1084
1581
 
1114
1611
            elif suffix == u"w":
1115
1612
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1116
1613
            else:
1117
 
                raise ValueError
1118
 
        except (ValueError, IndexError):
1119
 
            raise ValueError
 
1614
                raise ValueError(u"Unknown suffix %r" % suffix)
 
1615
        except (ValueError, IndexError), e:
 
1616
            raise ValueError(e.message)
1120
1617
        timevalue += delta
1121
1618
    return timevalue
1122
1619
 
1135
1632
        def if_nametoindex(interface):
1136
1633
            "Get an interface index the hard way, i.e. using fcntl()"
1137
1634
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1138
 
            with closing(socket.socket()) as s:
 
1635
            with contextlib.closing(socket.socket()) as s:
1139
1636
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1140
1637
                                    struct.pack(str(u"16s16x"),
1141
1638
                                                interface))
1161
1658
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1162
1659
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1163
1660
            raise OSError(errno.ENODEV,
1164
 
                          u"/dev/null not a character device")
 
1661
                          u"%s not a character device"
 
1662
                          % os.path.devnull)
1165
1663
        os.dup2(null, sys.stdin.fileno())
1166
1664
        os.dup2(null, sys.stdout.fileno())
1167
1665
        os.dup2(null, sys.stderr.fileno())
1171
1669
 
1172
1670
def main():
1173
1671
    
1174
 
    ######################################################################
 
1672
    ##################################################################
1175
1673
    # Parsing of options, both command line and config file
1176
1674
    
1177
1675
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1186
1684
    parser.add_option("--debug", action=u"store_true",
1187
1685
                      help=u"Debug mode; run in foreground and log to"
1188
1686
                      u" terminal")
 
1687
    parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
 
1688
                      help=u"Debug level for stdout output")
1189
1689
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1190
1690
                      u" priority string (see GnuTLS documentation)")
1191
1691
    parser.add_option("--servicename", type=u"string",
1216
1716
                        u"servicename": u"Mandos",
1217
1717
                        u"use_dbus": u"True",
1218
1718
                        u"use_ipv6": u"True",
 
1719
                        u"debuglevel": u"",
1219
1720
                        }
1220
1721
    
1221
1722
    # Parse config file for server-global settings
1238
1739
    # options, if set.
1239
1740
    for option in (u"interface", u"address", u"port", u"debug",
1240
1741
                   u"priority", u"servicename", u"configdir",
1241
 
                   u"use_dbus", u"use_ipv6"):
 
1742
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
1242
1743
        value = getattr(options, option)
1243
1744
        if value is not None:
1244
1745
            server_settings[option] = value
1253
1754
    
1254
1755
    # For convenience
1255
1756
    debug = server_settings[u"debug"]
 
1757
    debuglevel = server_settings[u"debuglevel"]
1256
1758
    use_dbus = server_settings[u"use_dbus"]
1257
1759
    use_ipv6 = server_settings[u"use_ipv6"]
1258
 
    
1259
 
    if not debug:
1260
 
        syslogger.setLevel(logging.WARNING)
1261
 
        console.setLevel(logging.WARNING)
1262
 
    
 
1760
 
1263
1761
    if server_settings[u"servicename"] != u"Mandos":
1264
1762
        syslogger.setFormatter(logging.Formatter
1265
1763
                               (u'Mandos (%s) [%%(process)d]:'
1271
1769
                        u"interval": u"5m",
1272
1770
                        u"checker": u"fping -q -- %%(host)s",
1273
1771
                        u"host": u"",
 
1772
                        u"approval_delay": u"0s",
 
1773
                        u"approval_duration": u"1s",
1274
1774
                        }
1275
1775
    client_config = configparser.SafeConfigParser(client_defaults)
1276
1776
    client_config.read(os.path.join(server_settings[u"configdir"],
1282
1782
    tcp_server = MandosServer((server_settings[u"address"],
1283
1783
                               server_settings[u"port"]),
1284
1784
                              ClientHandler,
1285
 
                              interface=server_settings[u"interface"],
 
1785
                              interface=(server_settings[u"interface"]
 
1786
                                         or None),
1286
1787
                              use_ipv6=use_ipv6,
1287
1788
                              gnutls_priority=
1288
1789
                              server_settings[u"priority"],
1289
1790
                              use_dbus=use_dbus)
1290
 
    pidfilename = u"/var/run/mandos.pid"
1291
 
    try:
1292
 
        pidfile = open(pidfilename, u"w")
1293
 
    except IOError:
1294
 
        logger.error(u"Could not open file %r", pidfilename)
 
1791
    if not debug:
 
1792
        pidfilename = u"/var/run/mandos.pid"
 
1793
        try:
 
1794
            pidfile = open(pidfilename, u"w")
 
1795
        except IOError:
 
1796
            logger.error(u"Could not open file %r", pidfilename)
1295
1797
    
1296
1798
    try:
1297
1799
        uid = pwd.getpwnam(u"_mandos").pw_uid
1314
1816
        if error[0] != errno.EPERM:
1315
1817
            raise error
1316
1818
    
1317
 
    # Enable all possible GnuTLS debugging
 
1819
    if not debug and not debuglevel:
 
1820
        syslogger.setLevel(logging.WARNING)
 
1821
        console.setLevel(logging.WARNING)
 
1822
    if debuglevel:
 
1823
        level = getattr(logging, debuglevel.upper())
 
1824
        syslogger.setLevel(level)
 
1825
        console.setLevel(level)
 
1826
 
1318
1827
    if debug:
 
1828
        # Enable all possible GnuTLS debugging
 
1829
        
1319
1830
        # "Use a log level over 10 to enable all debugging options."
1320
1831
        # - GnuTLS manual
1321
1832
        gnutls.library.functions.gnutls_global_set_log_level(11)
1326
1837
        
1327
1838
        (gnutls.library.functions
1328
1839
         .gnutls_global_set_log_function(debug_gnutls))
 
1840
        
 
1841
        # Redirect stdin so all checkers get /dev/null
 
1842
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1843
        os.dup2(null, sys.stdin.fileno())
 
1844
        if null > 2:
 
1845
            os.close(null)
 
1846
    else:
 
1847
        # No console logging
 
1848
        logger.removeHandler(console)
 
1849
    
 
1850
    # Need to fork before connecting to D-Bus
 
1851
    if not debug:
 
1852
        # Close all input and output, do double fork, etc.
 
1853
        daemon()
1329
1854
    
1330
1855
    global main_loop
1331
1856
    # From the Avahi example code
1334
1859
    bus = dbus.SystemBus()
1335
1860
    # End of Avahi example code
1336
1861
    if use_dbus:
1337
 
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
 
1862
        try:
 
1863
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
1864
                                            bus, do_not_queue=True)
 
1865
        except dbus.exceptions.NameExistsException, e:
 
1866
            logger.error(unicode(e) + u", disabling D-Bus")
 
1867
            use_dbus = False
 
1868
            server_settings[u"use_dbus"] = False
 
1869
            tcp_server.use_dbus = False
1338
1870
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1339
1871
    service = AvahiService(name = server_settings[u"servicename"],
1340
1872
                           servicetype = u"_mandos._tcp",
1343
1875
        service.interface = (if_nametoindex
1344
1876
                             (str(server_settings[u"interface"])))
1345
1877
    
 
1878
    global multiprocessing_manager
 
1879
    multiprocessing_manager = multiprocessing.Manager()
 
1880
    
1346
1881
    client_class = Client
1347
1882
    if use_dbus:
1348
1883
        client_class = functools.partial(ClientDBus, bus = bus)
 
1884
    def client_config_items(config, section):
 
1885
        special_settings = {
 
1886
            "approved_by_default":
 
1887
                lambda: config.getboolean(section,
 
1888
                                          "approved_by_default"),
 
1889
            }
 
1890
        for name, value in config.items(section):
 
1891
            try:
 
1892
                yield (name, special_settings[name]())
 
1893
            except KeyError:
 
1894
                yield (name, value)
 
1895
    
1349
1896
    tcp_server.clients.update(set(
1350
1897
            client_class(name = section,
1351
 
                         config= dict(client_config.items(section)))
 
1898
                         config= dict(client_config_items(
 
1899
                        client_config, section)))
1352
1900
            for section in client_config.sections()))
1353
1901
    if not tcp_server.clients:
1354
1902
        logger.warning(u"No clients defined")
1355
 
    
1356
 
    if debug:
1357
 
        # Redirect stdin so all checkers get /dev/null
1358
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1359
 
        os.dup2(null, sys.stdin.fileno())
1360
 
        if null > 2:
1361
 
            os.close(null)
1362
 
    else:
1363
 
        # No console logging
1364
 
        logger.removeHandler(console)
1365
 
        # Close all input and output, do double fork, etc.
1366
 
        daemon()
1367
 
    
1368
 
    try:
1369
 
        with closing(pidfile):
1370
 
            pid = os.getpid()
1371
 
            pidfile.write(str(pid) + "\n")
1372
 
        del pidfile
1373
 
    except IOError:
1374
 
        logger.error(u"Could not write to file %r with PID %d",
1375
 
                     pidfilename, pid)
1376
 
    except NameError:
1377
 
        # "pidfile" was never created
1378
 
        pass
1379
 
    del pidfilename
1380
 
    
1381
 
    def cleanup():
1382
 
        "Cleanup function; run on exit"
1383
 
        service.cleanup()
1384
1903
        
1385
 
        while tcp_server.clients:
1386
 
            client = tcp_server.clients.pop()
1387
 
            client.disable_hook = None
1388
 
            client.disable()
1389
 
    
1390
 
    atexit.register(cleanup)
1391
 
    
1392
1904
    if not debug:
 
1905
        try:
 
1906
            with pidfile:
 
1907
                pid = os.getpid()
 
1908
                pidfile.write(str(pid) + "\n")
 
1909
            del pidfile
 
1910
        except IOError:
 
1911
            logger.error(u"Could not write to file %r with PID %d",
 
1912
                         pidfilename, pid)
 
1913
        except NameError:
 
1914
            # "pidfile" was never created
 
1915
            pass
 
1916
        del pidfilename
 
1917
        
1393
1918
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
1919
 
1394
1920
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1395
1921
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1396
1922
    
1401
1927
                dbus.service.Object.__init__(self, bus, u"/")
1402
1928
            _interface = u"se.bsnet.fukt.Mandos"
1403
1929
            
1404
 
            @dbus.service.signal(_interface, signature=u"oa{sv}")
1405
 
            def ClientAdded(self, objpath, properties):
 
1930
            @dbus.service.signal(_interface, signature=u"o")
 
1931
            def ClientAdded(self, objpath):
1406
1932
                "D-Bus signal"
1407
1933
                pass
1408
1934
            
1409
 
            @dbus.service.signal(_interface, signature=u"s")
1410
 
            def ClientNotFound(self, fingerprint):
 
1935
            @dbus.service.signal(_interface, signature=u"ss")
 
1936
            def ClientNotFound(self, fingerprint, address):
1411
1937
                "D-Bus signal"
1412
1938
                pass
1413
1939
            
1427
1953
            def GetAllClientsWithProperties(self):
1428
1954
                "D-Bus method"
1429
1955
                return dbus.Dictionary(
1430
 
                    ((c.dbus_object_path, c.GetAllProperties())
 
1956
                    ((c.dbus_object_path, c.GetAll(u""))
1431
1957
                     for c in tcp_server.clients),
1432
1958
                    signature=u"oa{sv}")
1433
1959
            
1439
1965
                        tcp_server.clients.remove(c)
1440
1966
                        c.remove_from_connection()
1441
1967
                        # Don't signal anything except ClientRemoved
1442
 
                        c.disable(signal=False)
 
1968
                        c.disable(quiet=True)
1443
1969
                        # Emit D-Bus signal
1444
1970
                        self.ClientRemoved(object_path, c.name)
1445
1971
                        return
1446
 
                raise KeyError
 
1972
                raise KeyError(object_path)
1447
1973
            
1448
1974
            del _interface
1449
1975
        
1450
1976
        mandos_dbus_service = MandosDBusService()
1451
1977
    
 
1978
    def cleanup():
 
1979
        "Cleanup function; run on exit"
 
1980
        service.cleanup()
 
1981
        
 
1982
        while tcp_server.clients:
 
1983
            client = tcp_server.clients.pop()
 
1984
            if use_dbus:
 
1985
                client.remove_from_connection()
 
1986
            client.disable_hook = None
 
1987
            # Don't signal anything except ClientRemoved
 
1988
            client.disable(quiet=True)
 
1989
            if use_dbus:
 
1990
                # Emit D-Bus signal
 
1991
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
1992
                                                  client.name)
 
1993
    
 
1994
    atexit.register(cleanup)
 
1995
    
1452
1996
    for client in tcp_server.clients:
1453
1997
        if use_dbus:
1454
1998
            # Emit D-Bus signal
1455
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path,
1456
 
                                            client.GetAllProperties())
 
1999
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
1457
2000
        client.enable()
1458
2001
    
1459
2002
    tcp_server.enable()
1477
2020
            service.activate()
1478
2021
        except dbus.exceptions.DBusException, error:
1479
2022
            logger.critical(u"DBusException: %s", error)
 
2023
            cleanup()
1480
2024
            sys.exit(1)
1481
2025
        # End of Avahi example code
1482
2026
        
1489
2033
        main_loop.run()
1490
2034
    except AvahiError, error:
1491
2035
        logger.critical(u"AvahiError: %s", error)
 
2036
        cleanup()
1492
2037
        sys.exit(1)
1493
2038
    except KeyboardInterrupt:
1494
2039
        if debug:
1495
2040
            print >> sys.stderr
1496
2041
        logger.debug(u"Server received KeyboardInterrupt")
1497
2042
    logger.debug(u"Server exiting")
 
2043
    # Must run before the D-Bus bus name gets deregistered
 
2044
    cleanup()
1498
2045
 
1499
2046
if __name__ == '__main__':
1500
2047
    main()