/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2011-02-27 17:26:35 UTC
  • Revision ID: teddy@fukt.bsnet.se-20110227172635-hw1sire7k3vuo1co
Update copyright year to "2011" wherever appropriate.

Show diffs side-by-side

added added

removed removed

Lines of Context:
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# methods "add" and "remove" in the "AvahiService" class, the
10
 
# "server_state_changed" and "entry_group_state_changed" functions,
11
 
# and some lines in "main".
 
9
# methods "add", "remove", "server_state_changed",
 
10
# "entry_group_state_changed", "cleanup", and "activate" in the
 
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
 
14
# Copyright © 2008-2011 Teddy Hogeborn
 
15
# Copyright © 2008-2011 Björn Påhlsson
15
16
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
24
25
#     GNU General Public License for more details.
25
26
26
27
# You should have received a copy of the GNU General Public License
27
 
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
28
# along with this program.  If not, see
 
29
# <http://www.gnu.org/licenses/>.
28
30
29
31
# Contact the authors at <mandos@fukt.bsnet.se>.
30
32
31
33
 
32
 
from __future__ import division
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
33
36
 
34
 
import SocketServer
 
37
import SocketServer as socketserver
35
38
import socket
36
 
import select
37
 
from optparse import OptionParser
 
39
import optparse
38
40
import datetime
39
41
import errno
40
42
import gnutls.crypto
43
45
import gnutls.library.functions
44
46
import gnutls.library.constants
45
47
import gnutls.library.types
46
 
import ConfigParser
 
48
import ConfigParser as configparser
47
49
import sys
48
50
import re
49
51
import os
50
52
import signal
51
 
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
55
56
import logging
56
57
import logging.handlers
 
58
import pwd
 
59
import contextlib
 
60
import struct
 
61
import fcntl
 
62
import functools
 
63
import cPickle as pickle
 
64
import multiprocessing
57
65
 
58
66
import dbus
 
67
import dbus.service
59
68
import gobject
60
69
import avahi
61
70
from dbus.mainloop.glib import DBusGMainLoop
62
71
import ctypes
63
 
 
64
 
version = "1.0"
65
 
 
 
72
import ctypes.util
 
73
import xml.dom.minidom
 
74
import inspect
 
75
 
 
76
try:
 
77
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
 
78
except AttributeError:
 
79
    try:
 
80
        from IN import SO_BINDTODEVICE
 
81
    except ImportError:
 
82
        SO_BINDTODEVICE = None
 
83
 
 
84
 
 
85
version = "1.2.3"
 
86
 
 
87
#logger = logging.getLogger('mandos')
66
88
logger = logging.Logger('mandos')
67
 
syslogger = logging.handlers.SysLogHandler\
68
 
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
 
             address = "/dev/log")
70
 
syslogger.setFormatter(logging.Formatter\
71
 
                        ('Mandos: %(levelname)s: %(message)s'))
 
89
syslogger = (logging.handlers.SysLogHandler
 
90
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
91
              address = str("/dev/log")))
 
92
syslogger.setFormatter(logging.Formatter
 
93
                       ('Mandos [%(process)d]: %(levelname)s:'
 
94
                        ' %(message)s'))
72
95
logger.addHandler(syslogger)
73
96
 
74
97
console = logging.StreamHandler()
75
 
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
 
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
 
99
                                       ' %(levelname)s:'
76
100
                                       ' %(message)s'))
77
101
logger.addHandler(console)
78
102
 
79
103
class AvahiError(Exception):
80
 
    def __init__(self, value):
 
104
    def __init__(self, value, *args, **kwargs):
81
105
        self.value = value
82
 
    def __str__(self):
83
 
        return repr(self.value)
 
106
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
107
    def __unicode__(self):
 
108
        return unicode(repr(self.value))
84
109
 
85
110
class AvahiServiceError(AvahiError):
86
111
    pass
91
116
 
92
117
class AvahiService(object):
93
118
    """An Avahi (Zeroconf) service.
 
119
    
94
120
    Attributes:
95
121
    interface: integer; avahi.IF_UNSPEC or an interface index.
96
122
               Used to optionally bind to the specified interface.
104
130
    max_renames: integer; maximum number of renames
105
131
    rename_count: integer; counter so we only rename after collisions
106
132
                  a sensible number of times
 
133
    group: D-Bus Entry Group
 
134
    server: D-Bus Server
 
135
    bus: dbus.SystemBus()
107
136
    """
108
137
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
109
 
                 type = None, port = None, TXT = None, domain = "",
110
 
                 host = "", max_renames = 32768):
 
138
                 servicetype = None, port = None, TXT = None,
 
139
                 domain = "", host = "", max_renames = 32768,
 
140
                 protocol = avahi.PROTO_UNSPEC, bus = None):
111
141
        self.interface = interface
112
142
        self.name = name
113
 
        self.type = type
 
143
        self.type = servicetype
114
144
        self.port = port
115
 
        if TXT is None:
116
 
            self.TXT = []
117
 
        else:
118
 
            self.TXT = TXT
 
145
        self.TXT = TXT if TXT is not None else []
119
146
        self.domain = domain
120
147
        self.host = host
121
148
        self.rename_count = 0
122
149
        self.max_renames = max_renames
 
150
        self.protocol = protocol
 
151
        self.group = None       # our entry group
 
152
        self.server = None
 
153
        self.bus = bus
123
154
    def rename(self):
124
155
        """Derived from the Avahi example code"""
125
156
        if self.rename_count >= self.max_renames:
126
 
            logger.critical(u"No suitable service name found after %i"
127
 
                            u" retries, exiting.", rename_count)
 
157
            logger.critical("No suitable Zeroconf service name found"
 
158
                            " after %i retries, exiting.",
 
159
                            self.rename_count)
128
160
            raise AvahiServiceError("Too many renames")
129
 
        self.name = server.GetAlternativeServiceName(self.name)
130
 
        logger.info(u"Changing name to %r ...", str(self.name))
131
 
        syslogger.setFormatter(logging.Formatter\
132
 
                               ('Mandos (%s): %%(levelname)s:'
133
 
                               ' %%(message)s' % self.name))
 
161
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
162
        logger.info("Changing Zeroconf service name to %r ...",
 
163
                    self.name)
 
164
        syslogger.setFormatter(logging.Formatter
 
165
                               ('Mandos (%s) [%%(process)d]:'
 
166
                                ' %%(levelname)s: %%(message)s'
 
167
                                % self.name))
134
168
        self.remove()
135
 
        self.add()
 
169
        try:
 
170
            self.add()
 
171
        except dbus.exceptions.DBusException, error:
 
172
            logger.critical("DBusException: %s", error)
 
173
            self.cleanup()
 
174
            os._exit(1)
136
175
        self.rename_count += 1
137
176
    def remove(self):
138
177
        """Derived from the Avahi example code"""
139
 
        if group is not None:
140
 
            group.Reset()
 
178
        if self.group is not None:
 
179
            self.group.Reset()
141
180
    def add(self):
142
181
        """Derived from the Avahi example code"""
143
 
        global group
144
 
        if group is None:
145
 
            group = dbus.Interface\
146
 
                    (bus.get_object(avahi.DBUS_NAME,
147
 
                                    server.EntryGroupNew()),
148
 
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
149
 
            group.connect_to_signal('StateChanged',
150
 
                                    entry_group_state_changed)
151
 
        logger.debug(u"Adding service '%s' of type '%s' ...",
152
 
                     service.name, service.type)
153
 
        group.AddService(
154
 
                self.interface,         # interface
155
 
                avahi.PROTO_INET6,      # protocol
156
 
                dbus.UInt32(0),         # flags
157
 
                self.name, self.type,
158
 
                self.domain, self.host,
159
 
                dbus.UInt16(self.port),
160
 
                avahi.string_array_to_txt_array(self.TXT))
161
 
        group.Commit()
162
 
 
163
 
# From the Avahi example code:
164
 
group = None                            # our entry group
165
 
# End of Avahi example code
 
182
        if self.group is None:
 
183
            self.group = dbus.Interface(
 
184
                self.bus.get_object(avahi.DBUS_NAME,
 
185
                                    self.server.EntryGroupNew()),
 
186
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
187
            self.group.connect_to_signal('StateChanged',
 
188
                                         self
 
189
                                         .entry_group_state_changed)
 
190
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
191
                     self.name, self.type)
 
192
        self.group.AddService(
 
193
            self.interface,
 
194
            self.protocol,
 
195
            dbus.UInt32(0),     # flags
 
196
            self.name, self.type,
 
197
            self.domain, self.host,
 
198
            dbus.UInt16(self.port),
 
199
            avahi.string_array_to_txt_array(self.TXT))
 
200
        self.group.Commit()
 
201
    def entry_group_state_changed(self, state, error):
 
202
        """Derived from the Avahi example code"""
 
203
        logger.debug("Avahi entry group state change: %i", state)
 
204
        
 
205
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
206
            logger.debug("Zeroconf service established.")
 
207
        elif state == avahi.ENTRY_GROUP_COLLISION:
 
208
            logger.info("Zeroconf service name collision.")
 
209
            self.rename()
 
210
        elif state == avahi.ENTRY_GROUP_FAILURE:
 
211
            logger.critical("Avahi: Error in group state changed %s",
 
212
                            unicode(error))
 
213
            raise AvahiGroupError("State changed: %s"
 
214
                                  % unicode(error))
 
215
    def cleanup(self):
 
216
        """Derived from the Avahi example code"""
 
217
        if self.group is not None:
 
218
            self.group.Free()
 
219
            self.group = None
 
220
    def server_state_changed(self, state):
 
221
        """Derived from the Avahi example code"""
 
222
        logger.debug("Avahi server state change: %i", state)
 
223
        if state == avahi.SERVER_COLLISION:
 
224
            logger.error("Zeroconf server name collision")
 
225
            self.remove()
 
226
        elif state == avahi.SERVER_RUNNING:
 
227
            self.add()
 
228
    def activate(self):
 
229
        """Derived from the Avahi example code"""
 
230
        if self.server is None:
 
231
            self.server = dbus.Interface(
 
232
                self.bus.get_object(avahi.DBUS_NAME,
 
233
                                    avahi.DBUS_PATH_SERVER),
 
234
                avahi.DBUS_INTERFACE_SERVER)
 
235
        self.server.connect_to_signal("StateChanged",
 
236
                                 self.server_state_changed)
 
237
        self.server_state_changed(self.server.GetState())
166
238
 
167
239
 
168
240
class Client(object):
169
241
    """A representation of a client host served by this server.
 
242
    
170
243
    Attributes:
171
 
    name:      string; from the config file, used in log messages
 
244
    _approved:   bool(); 'None' if not yet approved/disapproved
 
245
    approval_delay: datetime.timedelta(); Time to wait for approval
 
246
    approval_duration: datetime.timedelta(); Duration of one approval
 
247
    checker:    subprocess.Popen(); a running checker process used
 
248
                                    to see if the client lives.
 
249
                                    'None' if no process is running.
 
250
    checker_callback_tag: a gobject event source tag, or None
 
251
    checker_command: string; External command which is run to check
 
252
                     if client lives.  %() expansions are done at
 
253
                     runtime with vars(self) as dict, so that for
 
254
                     instance %(name)s can be used in the command.
 
255
    checker_initiator_tag: a gobject event source tag, or None
 
256
    created:    datetime.datetime(); (UTC) object creation
 
257
    current_checker_command: string; current running checker_command
 
258
    disable_hook:  If set, called by disable() as disable_hook(self)
 
259
    disable_initiator_tag: a gobject event source tag, or None
 
260
    enabled:    bool()
172
261
    fingerprint: string (40 or 32 hexadecimal digits); used to
173
262
                 uniquely identify the client
174
 
    secret:    bytestring; sent verbatim (over TLS) to client
175
 
    host:      string; available for use by the checker command
176
 
    created:   datetime.datetime(); object creation, not client host
177
 
    last_checked_ok: datetime.datetime() or None if not yet checked OK
178
 
    timeout:   datetime.timedelta(); How long from last_checked_ok
179
 
                                     until this client is invalid
180
 
    interval:  datetime.timedelta(); How often to start a new checker
181
 
    stop_hook: If set, called by stop() as stop_hook(self)
182
 
    checker:   subprocess.Popen(); a running checker process used
183
 
                                   to see if the client lives.
184
 
                                   'None' if no process is running.
185
 
    checker_initiator_tag: a gobject event source tag, or None
186
 
    stop_initiator_tag:    - '' -
187
 
    checker_callback_tag:  - '' -
188
 
    checker_command: string; External command which is run to check if
189
 
                     client lives.  %() expansions are done at
190
 
                     runtime with vars(self) as dict, so that for
191
 
                     instance %(name)s can be used in the command.
192
 
    Private attibutes:
193
 
    _timeout: Real variable for 'timeout'
194
 
    _interval: Real variable for 'interval'
195
 
    _timeout_milliseconds: Used when calling gobject.timeout_add()
196
 
    _interval_milliseconds: - '' -
 
263
    host:       string; available for use by the checker command
 
264
    interval:   datetime.timedelta(); How often to start a new checker
 
265
    last_approval_request: datetime.datetime(); (UTC) or None
 
266
    last_checked_ok: datetime.datetime(); (UTC) or None
 
267
    last_enabled: datetime.datetime(); (UTC)
 
268
    name:       string; from the config file, used in log messages and
 
269
                        D-Bus identifiers
 
270
    secret:     bytestring; sent verbatim (over TLS) to client
 
271
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
272
                                      until this client is disabled
 
273
    runtime_expansions: Allowed attributes for runtime expansion.
197
274
    """
198
 
    def _set_timeout(self, timeout):
199
 
        "Setter function for 'timeout' attribute"
200
 
        self._timeout = timeout
201
 
        self._timeout_milliseconds = ((self.timeout.days
202
 
                                       * 24 * 60 * 60 * 1000)
203
 
                                      + (self.timeout.seconds * 1000)
204
 
                                      + (self.timeout.microseconds
205
 
                                         // 1000))
206
 
    timeout = property(lambda self: self._timeout,
207
 
                       _set_timeout)
208
 
    del _set_timeout
209
 
    def _set_interval(self, interval):
210
 
        "Setter function for 'interval' attribute"
211
 
        self._interval = interval
212
 
        self._interval_milliseconds = ((self.interval.days
213
 
                                        * 24 * 60 * 60 * 1000)
214
 
                                       + (self.interval.seconds
215
 
                                          * 1000)
216
 
                                       + (self.interval.microseconds
217
 
                                          // 1000))
218
 
    interval = property(lambda self: self._interval,
219
 
                        _set_interval)
220
 
    del _set_interval
221
 
    def __init__(self, name = None, stop_hook=None, config={}):
 
275
    
 
276
    runtime_expansions = ("approval_delay", "approval_duration",
 
277
                          "created", "enabled", "fingerprint",
 
278
                          "host", "interval", "last_checked_ok",
 
279
                          "last_enabled", "name", "timeout")
 
280
    
 
281
    @staticmethod
 
282
    def _timedelta_to_milliseconds(td):
 
283
        "Convert a datetime.timedelta() to milliseconds"
 
284
        return ((td.days * 24 * 60 * 60 * 1000)
 
285
                + (td.seconds * 1000)
 
286
                + (td.microseconds // 1000))
 
287
    
 
288
    def timeout_milliseconds(self):
 
289
        "Return the 'timeout' attribute in milliseconds"
 
290
        return self._timedelta_to_milliseconds(self.timeout)
 
291
    
 
292
    def interval_milliseconds(self):
 
293
        "Return the 'interval' attribute in milliseconds"
 
294
        return self._timedelta_to_milliseconds(self.interval)
 
295
 
 
296
    def approval_delay_milliseconds(self):
 
297
        return self._timedelta_to_milliseconds(self.approval_delay)
 
298
    
 
299
    def __init__(self, name = None, disable_hook=None, config=None):
222
300
        """Note: the 'checker' key in 'config' sets the
223
301
        'checker_command' attribute and *not* the 'checker'
224
302
        attribute."""
225
303
        self.name = name
226
 
        logger.debug(u"Creating client %r", self.name)
 
304
        if config is None:
 
305
            config = {}
 
306
        logger.debug("Creating client %r", self.name)
227
307
        # Uppercase and remove spaces from fingerprint for later
228
308
        # comparison purposes with return value from the fingerprint()
229
309
        # function
230
 
        self.fingerprint = config["fingerprint"].upper()\
231
 
                           .replace(u" ", u"")
232
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
 
310
        self.fingerprint = (config["fingerprint"].upper()
 
311
                            .replace(" ", ""))
 
312
        logger.debug("  Fingerprint: %s", self.fingerprint)
233
313
        if "secret" in config:
234
 
            self.secret = config["secret"].decode(u"base64")
 
314
            self.secret = config["secret"].decode("base64")
235
315
        elif "secfile" in config:
236
 
            sf = open(config["secfile"])
237
 
            self.secret = sf.read()
238
 
            sf.close()
 
316
            with open(os.path.expanduser(os.path.expandvars
 
317
                                         (config["secfile"])),
 
318
                      "rb") as secfile:
 
319
                self.secret = secfile.read()
239
320
        else:
240
 
            raise TypeError(u"No secret or secfile for client %s"
 
321
            raise TypeError("No secret or secfile for client %s"
241
322
                            % self.name)
242
323
        self.host = config.get("host", "")
243
 
        self.created = datetime.datetime.now()
 
324
        self.created = datetime.datetime.utcnow()
 
325
        self.enabled = False
 
326
        self.last_approval_request = None
 
327
        self.last_enabled = None
244
328
        self.last_checked_ok = None
245
329
        self.timeout = string_to_delta(config["timeout"])
246
330
        self.interval = string_to_delta(config["interval"])
247
 
        self.stop_hook = stop_hook
 
331
        self.disable_hook = disable_hook
248
332
        self.checker = None
249
333
        self.checker_initiator_tag = None
250
 
        self.stop_initiator_tag = None
 
334
        self.disable_initiator_tag = None
251
335
        self.checker_callback_tag = None
252
 
        self.check_command = config["checker"]
253
 
    def start(self):
 
336
        self.checker_command = config["checker"]
 
337
        self.current_checker_command = None
 
338
        self.last_connect = None
 
339
        self._approved = None
 
340
        self.approved_by_default = config.get("approved_by_default",
 
341
                                              True)
 
342
        self.approvals_pending = 0
 
343
        self.approval_delay = string_to_delta(
 
344
            config["approval_delay"])
 
345
        self.approval_duration = string_to_delta(
 
346
            config["approval_duration"])
 
347
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
348
    
 
349
    def send_changedstate(self):
 
350
        self.changedstate.acquire()
 
351
        self.changedstate.notify_all()
 
352
        self.changedstate.release()
 
353
        
 
354
    def enable(self):
254
355
        """Start this client's checker and timeout hooks"""
 
356
        if getattr(self, "enabled", False):
 
357
            # Already enabled
 
358
            return
 
359
        self.send_changedstate()
 
360
        self.last_enabled = datetime.datetime.utcnow()
255
361
        # Schedule a new checker to be started an 'interval' from now,
256
362
        # and every interval from then on.
257
 
        self.checker_initiator_tag = gobject.timeout_add\
258
 
                                     (self._interval_milliseconds,
259
 
                                      self.start_checker)
 
363
        self.checker_initiator_tag = (gobject.timeout_add
 
364
                                      (self.interval_milliseconds(),
 
365
                                       self.start_checker))
 
366
        # Schedule a disable() when 'timeout' has passed
 
367
        self.disable_initiator_tag = (gobject.timeout_add
 
368
                                   (self.timeout_milliseconds(),
 
369
                                    self.disable))
 
370
        self.enabled = True
260
371
        # Also start a new checker *right now*.
261
372
        self.start_checker()
262
 
        # Schedule a stop() when 'timeout' has passed
263
 
        self.stop_initiator_tag = gobject.timeout_add\
264
 
                                  (self._timeout_milliseconds,
265
 
                                   self.stop)
266
 
    def stop(self):
267
 
        """Stop this client.
268
 
        The possibility that a client might be restarted is left open,
269
 
        but not currently used."""
270
 
        # If this client doesn't have a secret, it is already stopped.
271
 
        if hasattr(self, "secret") and self.secret:
272
 
            logger.info(u"Stopping client %s", self.name)
273
 
            self.secret = None
274
 
        else:
 
373
    
 
374
    def disable(self, quiet=True):
 
375
        """Disable this client."""
 
376
        if not getattr(self, "enabled", False):
275
377
            return False
276
 
        if getattr(self, "stop_initiator_tag", False):
277
 
            gobject.source_remove(self.stop_initiator_tag)
278
 
            self.stop_initiator_tag = None
 
378
        if not quiet:
 
379
            self.send_changedstate()
 
380
        if not quiet:
 
381
            logger.info("Disabling client %s", self.name)
 
382
        if getattr(self, "disable_initiator_tag", False):
 
383
            gobject.source_remove(self.disable_initiator_tag)
 
384
            self.disable_initiator_tag = None
279
385
        if getattr(self, "checker_initiator_tag", False):
280
386
            gobject.source_remove(self.checker_initiator_tag)
281
387
            self.checker_initiator_tag = None
282
388
        self.stop_checker()
283
 
        if self.stop_hook:
284
 
            self.stop_hook(self)
 
389
        if self.disable_hook:
 
390
            self.disable_hook(self)
 
391
        self.enabled = False
285
392
        # Do not run this again if called by a gobject.timeout_add
286
393
        return False
 
394
    
287
395
    def __del__(self):
288
 
        self.stop_hook = None
289
 
        self.stop()
290
 
    def checker_callback(self, pid, condition):
 
396
        self.disable_hook = None
 
397
        self.disable()
 
398
    
 
399
    def checker_callback(self, pid, condition, command):
291
400
        """The checker has completed, so take appropriate actions."""
292
 
        now = datetime.datetime.now()
293
401
        self.checker_callback_tag = None
294
402
        self.checker = None
295
 
        if os.WIFEXITED(condition) \
296
 
               and (os.WEXITSTATUS(condition) == 0):
297
 
            logger.info(u"Checker for %(name)s succeeded",
298
 
                        vars(self))
299
 
            self.last_checked_ok = now
300
 
            gobject.source_remove(self.stop_initiator_tag)
301
 
            self.stop_initiator_tag = gobject.timeout_add\
302
 
                                      (self._timeout_milliseconds,
303
 
                                       self.stop)
304
 
        elif not os.WIFEXITED(condition):
305
 
            logger.warning(u"Checker for %(name)s crashed?",
 
403
        if os.WIFEXITED(condition):
 
404
            exitstatus = os.WEXITSTATUS(condition)
 
405
            if exitstatus == 0:
 
406
                logger.info("Checker for %(name)s succeeded",
 
407
                            vars(self))
 
408
                self.checked_ok()
 
409
            else:
 
410
                logger.info("Checker for %(name)s failed",
 
411
                            vars(self))
 
412
        else:
 
413
            logger.warning("Checker for %(name)s crashed?",
306
414
                           vars(self))
307
 
        else:
308
 
            logger.info(u"Checker for %(name)s failed",
309
 
                        vars(self))
 
415
    
 
416
    def checked_ok(self):
 
417
        """Bump up the timeout for this client.
 
418
        
 
419
        This should only be called when the client has been seen,
 
420
        alive and well.
 
421
        """
 
422
        self.last_checked_ok = datetime.datetime.utcnow()
 
423
        gobject.source_remove(self.disable_initiator_tag)
 
424
        self.disable_initiator_tag = (gobject.timeout_add
 
425
                                      (self.timeout_milliseconds(),
 
426
                                       self.disable))
 
427
    
 
428
    def need_approval(self):
 
429
        self.last_approval_request = datetime.datetime.utcnow()
 
430
    
310
431
    def start_checker(self):
311
432
        """Start a new checker subprocess if one is not running.
 
433
        
312
434
        If a checker already exists, leave it running and do
313
435
        nothing."""
314
436
        # The reason for not killing a running checker is that if we
317
439
        # client would inevitably timeout, since no checker would get
318
440
        # a chance to run to completion.  If we instead leave running
319
441
        # checkers alone, the checker would have to take more time
320
 
        # than 'timeout' for the client to be declared invalid, which
321
 
        # is as it should be.
 
442
        # than 'timeout' for the client to be disabled, which is as it
 
443
        # should be.
 
444
        
 
445
        # If a checker exists, make sure it is not a zombie
 
446
        try:
 
447
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
448
        except (AttributeError, OSError), error:
 
449
            if (isinstance(error, OSError)
 
450
                and error.errno != errno.ECHILD):
 
451
                raise error
 
452
        else:
 
453
            if pid:
 
454
                logger.warning("Checker was a zombie")
 
455
                gobject.source_remove(self.checker_callback_tag)
 
456
                self.checker_callback(pid, status,
 
457
                                      self.current_checker_command)
 
458
        # Start a new checker if needed
322
459
        if self.checker is None:
323
460
            try:
324
 
                # In case check_command has exactly one % operator
325
 
                command = self.check_command % self.host
 
461
                # In case checker_command has exactly one % operator
 
462
                command = self.checker_command % self.host
326
463
            except TypeError:
327
464
                # Escape attributes for the shell
328
 
                escaped_attrs = dict((key, re.escape(str(val)))
329
 
                                     for key, val in
330
 
                                     vars(self).iteritems())
 
465
                escaped_attrs = dict(
 
466
                    (attr,
 
467
                     re.escape(unicode(str(getattr(self, attr, "")),
 
468
                                       errors=
 
469
                                       'replace')))
 
470
                    for attr in
 
471
                    self.runtime_expansions)
 
472
 
331
473
                try:
332
 
                    command = self.check_command % escaped_attrs
 
474
                    command = self.checker_command % escaped_attrs
333
475
                except TypeError, error:
334
 
                    logger.error(u'Could not format string "%s":'
335
 
                                 u' %s', self.check_command, error)
 
476
                    logger.error('Could not format string "%s":'
 
477
                                 ' %s', self.checker_command, error)
336
478
                    return True # Try again later
 
479
            self.current_checker_command = command
337
480
            try:
338
 
                logger.info(u"Starting checker %r for %s",
 
481
                logger.info("Starting checker %r for %s",
339
482
                            command, self.name)
 
483
                # We don't need to redirect stdout and stderr, since
 
484
                # in normal mode, that is already done by daemon(),
 
485
                # and in debug mode we don't want to.  (Stdin is
 
486
                # always replaced by /dev/null.)
340
487
                self.checker = subprocess.Popen(command,
341
488
                                                close_fds=True,
342
489
                                                shell=True, cwd="/")
343
 
                self.checker_callback_tag = gobject.child_watch_add\
344
 
                                            (self.checker.pid,
345
 
                                             self.checker_callback)
346
 
            except subprocess.OSError, error:
347
 
                logger.error(u"Failed to start subprocess: %s",
 
490
                self.checker_callback_tag = (gobject.child_watch_add
 
491
                                             (self.checker.pid,
 
492
                                              self.checker_callback,
 
493
                                              data=command))
 
494
                # The checker may have completed before the gobject
 
495
                # watch was added.  Check for this.
 
496
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
497
                if pid:
 
498
                    gobject.source_remove(self.checker_callback_tag)
 
499
                    self.checker_callback(pid, status, command)
 
500
            except OSError, error:
 
501
                logger.error("Failed to start subprocess: %s",
348
502
                             error)
349
503
        # Re-run this periodically if run by gobject.timeout_add
350
504
        return True
 
505
    
351
506
    def stop_checker(self):
352
507
        """Force the checker process, if any, to stop."""
353
508
        if self.checker_callback_tag:
355
510
            self.checker_callback_tag = None
356
511
        if getattr(self, "checker", None) is None:
357
512
            return
358
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
513
        logger.debug("Stopping checker for %(name)s", vars(self))
359
514
        try:
360
515
            os.kill(self.checker.pid, signal.SIGTERM)
361
 
            #os.sleep(0.5)
 
516
            #time.sleep(0.5)
362
517
            #if self.checker.poll() is None:
363
518
            #    os.kill(self.checker.pid, signal.SIGKILL)
364
519
        except OSError, error:
365
520
            if error.errno != errno.ESRCH: # No such process
366
521
                raise
367
522
        self.checker = None
368
 
    def still_valid(self):
369
 
        """Has the timeout not yet passed for this client?"""
370
 
        now = datetime.datetime.now()
 
523
 
 
524
def dbus_service_property(dbus_interface, signature="v",
 
525
                          access="readwrite", byte_arrays=False):
 
526
    """Decorators for marking methods of a DBusObjectWithProperties to
 
527
    become properties on the D-Bus.
 
528
    
 
529
    The decorated method will be called with no arguments by "Get"
 
530
    and with one argument by "Set".
 
531
    
 
532
    The parameters, where they are supported, are the same as
 
533
    dbus.service.method, except there is only "signature", since the
 
534
    type from Get() and the type sent to Set() is the same.
 
535
    """
 
536
    # Encoding deeply encoded byte arrays is not supported yet by the
 
537
    # "Set" method, so we fail early here:
 
538
    if byte_arrays and signature != "ay":
 
539
        raise ValueError("Byte arrays not supported for non-'ay'"
 
540
                         " signature %r" % signature)
 
541
    def decorator(func):
 
542
        func._dbus_is_property = True
 
543
        func._dbus_interface = dbus_interface
 
544
        func._dbus_signature = signature
 
545
        func._dbus_access = access
 
546
        func._dbus_name = func.__name__
 
547
        if func._dbus_name.endswith("_dbus_property"):
 
548
            func._dbus_name = func._dbus_name[:-14]
 
549
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
550
        return func
 
551
    return decorator
 
552
 
 
553
 
 
554
class DBusPropertyException(dbus.exceptions.DBusException):
 
555
    """A base class for D-Bus property-related exceptions
 
556
    """
 
557
    def __unicode__(self):
 
558
        return unicode(str(self))
 
559
 
 
560
 
 
561
class DBusPropertyAccessException(DBusPropertyException):
 
562
    """A property's access permissions disallows an operation.
 
563
    """
 
564
    pass
 
565
 
 
566
 
 
567
class DBusPropertyNotFound(DBusPropertyException):
 
568
    """An attempt was made to access a non-existing property.
 
569
    """
 
570
    pass
 
571
 
 
572
 
 
573
class DBusObjectWithProperties(dbus.service.Object):
 
574
    """A D-Bus object with properties.
 
575
 
 
576
    Classes inheriting from this can use the dbus_service_property
 
577
    decorator to expose methods as D-Bus properties.  It exposes the
 
578
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
579
    """
 
580
    
 
581
    @staticmethod
 
582
    def _is_dbus_property(obj):
 
583
        return getattr(obj, "_dbus_is_property", False)
 
584
    
 
585
    def _get_all_dbus_properties(self):
 
586
        """Returns a generator of (name, attribute) pairs
 
587
        """
 
588
        return ((prop._dbus_name, prop)
 
589
                for name, prop in
 
590
                inspect.getmembers(self, self._is_dbus_property))
 
591
    
 
592
    def _get_dbus_property(self, interface_name, property_name):
 
593
        """Returns a bound method if one exists which is a D-Bus
 
594
        property with the specified name and interface.
 
595
        """
 
596
        for name in (property_name,
 
597
                     property_name + "_dbus_property"):
 
598
            prop = getattr(self, name, None)
 
599
            if (prop is None
 
600
                or not self._is_dbus_property(prop)
 
601
                or prop._dbus_name != property_name
 
602
                or (interface_name and prop._dbus_interface
 
603
                    and interface_name != prop._dbus_interface)):
 
604
                continue
 
605
            return prop
 
606
        # No such property
 
607
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
608
                                   + interface_name + "."
 
609
                                   + property_name)
 
610
    
 
611
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
612
                         out_signature="v")
 
613
    def Get(self, interface_name, property_name):
 
614
        """Standard D-Bus property Get() method, see D-Bus standard.
 
615
        """
 
616
        prop = self._get_dbus_property(interface_name, property_name)
 
617
        if prop._dbus_access == "write":
 
618
            raise DBusPropertyAccessException(property_name)
 
619
        value = prop()
 
620
        if not hasattr(value, "variant_level"):
 
621
            return value
 
622
        return type(value)(value, variant_level=value.variant_level+1)
 
623
    
 
624
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
 
625
    def Set(self, interface_name, property_name, value):
 
626
        """Standard D-Bus property Set() method, see D-Bus standard.
 
627
        """
 
628
        prop = self._get_dbus_property(interface_name, property_name)
 
629
        if prop._dbus_access == "read":
 
630
            raise DBusPropertyAccessException(property_name)
 
631
        if prop._dbus_get_args_options["byte_arrays"]:
 
632
            # The byte_arrays option is not supported yet on
 
633
            # signatures other than "ay".
 
634
            if prop._dbus_signature != "ay":
 
635
                raise ValueError
 
636
            value = dbus.ByteArray(''.join(unichr(byte)
 
637
                                           for byte in value))
 
638
        prop(value)
 
639
    
 
640
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
641
                         out_signature="a{sv}")
 
642
    def GetAll(self, interface_name):
 
643
        """Standard D-Bus property GetAll() method, see D-Bus
 
644
        standard.
 
645
 
 
646
        Note: Will not include properties with access="write".
 
647
        """
 
648
        all = {}
 
649
        for name, prop in self._get_all_dbus_properties():
 
650
            if (interface_name
 
651
                and interface_name != prop._dbus_interface):
 
652
                # Interface non-empty but did not match
 
653
                continue
 
654
            # Ignore write-only properties
 
655
            if prop._dbus_access == "write":
 
656
                continue
 
657
            value = prop()
 
658
            if not hasattr(value, "variant_level"):
 
659
                all[name] = value
 
660
                continue
 
661
            all[name] = type(value)(value, variant_level=
 
662
                                    value.variant_level+1)
 
663
        return dbus.Dictionary(all, signature="sv")
 
664
    
 
665
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
666
                         out_signature="s",
 
667
                         path_keyword='object_path',
 
668
                         connection_keyword='connection')
 
669
    def Introspect(self, object_path, connection):
 
670
        """Standard D-Bus method, overloaded to insert property tags.
 
671
        """
 
672
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
673
                                                   connection)
 
674
        try:
 
675
            document = xml.dom.minidom.parseString(xmlstring)
 
676
            def make_tag(document, name, prop):
 
677
                e = document.createElement("property")
 
678
                e.setAttribute("name", name)
 
679
                e.setAttribute("type", prop._dbus_signature)
 
680
                e.setAttribute("access", prop._dbus_access)
 
681
                return e
 
682
            for if_tag in document.getElementsByTagName("interface"):
 
683
                for tag in (make_tag(document, name, prop)
 
684
                            for name, prop
 
685
                            in self._get_all_dbus_properties()
 
686
                            if prop._dbus_interface
 
687
                            == if_tag.getAttribute("name")):
 
688
                    if_tag.appendChild(tag)
 
689
                # Add the names to the return values for the
 
690
                # "org.freedesktop.DBus.Properties" methods
 
691
                if (if_tag.getAttribute("name")
 
692
                    == "org.freedesktop.DBus.Properties"):
 
693
                    for cn in if_tag.getElementsByTagName("method"):
 
694
                        if cn.getAttribute("name") == "Get":
 
695
                            for arg in cn.getElementsByTagName("arg"):
 
696
                                if (arg.getAttribute("direction")
 
697
                                    == "out"):
 
698
                                    arg.setAttribute("name", "value")
 
699
                        elif cn.getAttribute("name") == "GetAll":
 
700
                            for arg in cn.getElementsByTagName("arg"):
 
701
                                if (arg.getAttribute("direction")
 
702
                                    == "out"):
 
703
                                    arg.setAttribute("name", "props")
 
704
            xmlstring = document.toxml("utf-8")
 
705
            document.unlink()
 
706
        except (AttributeError, xml.dom.DOMException,
 
707
                xml.parsers.expat.ExpatError), error:
 
708
            logger.error("Failed to override Introspection method",
 
709
                         error)
 
710
        return xmlstring
 
711
 
 
712
 
 
713
class ClientDBus(Client, DBusObjectWithProperties):
 
714
    """A Client class using D-Bus
 
715
    
 
716
    Attributes:
 
717
    dbus_object_path: dbus.ObjectPath
 
718
    bus: dbus.SystemBus()
 
719
    """
 
720
    
 
721
    runtime_expansions = (Client.runtime_expansions
 
722
                          + ("dbus_object_path",))
 
723
    
 
724
    # dbus.service.Object doesn't use super(), so we can't either.
 
725
    
 
726
    def __init__(self, bus = None, *args, **kwargs):
 
727
        self._approvals_pending = 0
 
728
        self.bus = bus
 
729
        Client.__init__(self, *args, **kwargs)
 
730
        # Only now, when this client is initialized, can it show up on
 
731
        # the D-Bus
 
732
        client_object_name = unicode(self.name).translate(
 
733
            {ord("."): ord("_"),
 
734
             ord("-"): ord("_")})
 
735
        self.dbus_object_path = (dbus.ObjectPath
 
736
                                 ("/clients/" + client_object_name))
 
737
        DBusObjectWithProperties.__init__(self, self.bus,
 
738
                                          self.dbus_object_path)
 
739
        
 
740
    def _get_approvals_pending(self):
 
741
        return self._approvals_pending
 
742
    def _set_approvals_pending(self, value):
 
743
        old_value = self._approvals_pending
 
744
        self._approvals_pending = value
 
745
        bval = bool(value)
 
746
        if (hasattr(self, "dbus_object_path")
 
747
            and bval is not bool(old_value)):
 
748
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
749
            self.PropertyChanged(dbus.String("ApprovalPending"),
 
750
                                 dbus_bool)
 
751
 
 
752
    approvals_pending = property(_get_approvals_pending,
 
753
                                 _set_approvals_pending)
 
754
    del _get_approvals_pending, _set_approvals_pending
 
755
    
 
756
    @staticmethod
 
757
    def _datetime_to_dbus(dt, variant_level=0):
 
758
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
759
        return dbus.String(dt.isoformat(),
 
760
                           variant_level=variant_level)
 
761
    
 
762
    def enable(self):
 
763
        oldstate = getattr(self, "enabled", False)
 
764
        r = Client.enable(self)
 
765
        if oldstate != self.enabled:
 
766
            # Emit D-Bus signals
 
767
            self.PropertyChanged(dbus.String("Enabled"),
 
768
                                 dbus.Boolean(True, variant_level=1))
 
769
            self.PropertyChanged(
 
770
                dbus.String("LastEnabled"),
 
771
                self._datetime_to_dbus(self.last_enabled,
 
772
                                       variant_level=1))
 
773
        return r
 
774
    
 
775
    def disable(self, quiet = False):
 
776
        oldstate = getattr(self, "enabled", False)
 
777
        r = Client.disable(self, quiet=quiet)
 
778
        if not quiet and oldstate != self.enabled:
 
779
            # Emit D-Bus signal
 
780
            self.PropertyChanged(dbus.String("Enabled"),
 
781
                                 dbus.Boolean(False, variant_level=1))
 
782
        return r
 
783
    
 
784
    def __del__(self, *args, **kwargs):
 
785
        try:
 
786
            self.remove_from_connection()
 
787
        except LookupError:
 
788
            pass
 
789
        if hasattr(DBusObjectWithProperties, "__del__"):
 
790
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
 
791
        Client.__del__(self, *args, **kwargs)
 
792
    
 
793
    def checker_callback(self, pid, condition, command,
 
794
                         *args, **kwargs):
 
795
        self.checker_callback_tag = None
 
796
        self.checker = None
 
797
        # Emit D-Bus signal
 
798
        self.PropertyChanged(dbus.String("CheckerRunning"),
 
799
                             dbus.Boolean(False, variant_level=1))
 
800
        if os.WIFEXITED(condition):
 
801
            exitstatus = os.WEXITSTATUS(condition)
 
802
            # Emit D-Bus signal
 
803
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
804
                                  dbus.Int64(condition),
 
805
                                  dbus.String(command))
 
806
        else:
 
807
            # Emit D-Bus signal
 
808
            self.CheckerCompleted(dbus.Int16(-1),
 
809
                                  dbus.Int64(condition),
 
810
                                  dbus.String(command))
 
811
        
 
812
        return Client.checker_callback(self, pid, condition, command,
 
813
                                       *args, **kwargs)
 
814
    
 
815
    def checked_ok(self, *args, **kwargs):
 
816
        r = Client.checked_ok(self, *args, **kwargs)
 
817
        # Emit D-Bus signal
 
818
        self.PropertyChanged(
 
819
            dbus.String("LastCheckedOK"),
 
820
            (self._datetime_to_dbus(self.last_checked_ok,
 
821
                                    variant_level=1)))
 
822
        return r
 
823
    
 
824
    def need_approval(self, *args, **kwargs):
 
825
        r = Client.need_approval(self, *args, **kwargs)
 
826
        # Emit D-Bus signal
 
827
        self.PropertyChanged(
 
828
            dbus.String("LastApprovalRequest"),
 
829
            (self._datetime_to_dbus(self.last_approval_request,
 
830
                                    variant_level=1)))
 
831
        return r
 
832
    
 
833
    def start_checker(self, *args, **kwargs):
 
834
        old_checker = self.checker
 
835
        if self.checker is not None:
 
836
            old_checker_pid = self.checker.pid
 
837
        else:
 
838
            old_checker_pid = None
 
839
        r = Client.start_checker(self, *args, **kwargs)
 
840
        # Only if new checker process was started
 
841
        if (self.checker is not None
 
842
            and old_checker_pid != self.checker.pid):
 
843
            # Emit D-Bus signal
 
844
            self.CheckerStarted(self.current_checker_command)
 
845
            self.PropertyChanged(
 
846
                dbus.String("CheckerRunning"),
 
847
                dbus.Boolean(True, variant_level=1))
 
848
        return r
 
849
    
 
850
    def stop_checker(self, *args, **kwargs):
 
851
        old_checker = getattr(self, "checker", None)
 
852
        r = Client.stop_checker(self, *args, **kwargs)
 
853
        if (old_checker is not None
 
854
            and getattr(self, "checker", None) is None):
 
855
            self.PropertyChanged(dbus.String("CheckerRunning"),
 
856
                                 dbus.Boolean(False, variant_level=1))
 
857
        return r
 
858
 
 
859
    def _reset_approved(self):
 
860
        self._approved = None
 
861
        return False
 
862
    
 
863
    def approve(self, value=True):
 
864
        self.send_changedstate()
 
865
        self._approved = value
 
866
        gobject.timeout_add(self._timedelta_to_milliseconds
 
867
                            (self.approval_duration),
 
868
                            self._reset_approved)
 
869
    
 
870
    
 
871
    ## D-Bus methods, signals & properties
 
872
    _interface = "se.bsnet.fukt.Mandos.Client"
 
873
    
 
874
    ## Signals
 
875
    
 
876
    # CheckerCompleted - signal
 
877
    @dbus.service.signal(_interface, signature="nxs")
 
878
    def CheckerCompleted(self, exitcode, waitstatus, command):
 
879
        "D-Bus signal"
 
880
        pass
 
881
    
 
882
    # CheckerStarted - signal
 
883
    @dbus.service.signal(_interface, signature="s")
 
884
    def CheckerStarted(self, command):
 
885
        "D-Bus signal"
 
886
        pass
 
887
    
 
888
    # PropertyChanged - signal
 
889
    @dbus.service.signal(_interface, signature="sv")
 
890
    def PropertyChanged(self, property, value):
 
891
        "D-Bus signal"
 
892
        pass
 
893
    
 
894
    # GotSecret - signal
 
895
    @dbus.service.signal(_interface)
 
896
    def GotSecret(self):
 
897
        """D-Bus signal
 
898
        Is sent after a successful transfer of secret from the Mandos
 
899
        server to mandos-client
 
900
        """
 
901
        pass
 
902
    
 
903
    # Rejected - signal
 
904
    @dbus.service.signal(_interface, signature="s")
 
905
    def Rejected(self, reason):
 
906
        "D-Bus signal"
 
907
        pass
 
908
    
 
909
    # NeedApproval - signal
 
910
    @dbus.service.signal(_interface, signature="tb")
 
911
    def NeedApproval(self, timeout, default):
 
912
        "D-Bus signal"
 
913
        return self.need_approval()
 
914
    
 
915
    ## Methods
 
916
    
 
917
    # Approve - method
 
918
    @dbus.service.method(_interface, in_signature="b")
 
919
    def Approve(self, value):
 
920
        self.approve(value)
 
921
    
 
922
    # CheckedOK - method
 
923
    @dbus.service.method(_interface)
 
924
    def CheckedOK(self):
 
925
        return self.checked_ok()
 
926
    
 
927
    # Enable - method
 
928
    @dbus.service.method(_interface)
 
929
    def Enable(self):
 
930
        "D-Bus method"
 
931
        self.enable()
 
932
    
 
933
    # StartChecker - method
 
934
    @dbus.service.method(_interface)
 
935
    def StartChecker(self):
 
936
        "D-Bus method"
 
937
        self.start_checker()
 
938
    
 
939
    # Disable - method
 
940
    @dbus.service.method(_interface)
 
941
    def Disable(self):
 
942
        "D-Bus method"
 
943
        self.disable()
 
944
    
 
945
    # StopChecker - method
 
946
    @dbus.service.method(_interface)
 
947
    def StopChecker(self):
 
948
        self.stop_checker()
 
949
    
 
950
    ## Properties
 
951
    
 
952
    # ApprovalPending - property
 
953
    @dbus_service_property(_interface, signature="b", access="read")
 
954
    def ApprovalPending_dbus_property(self):
 
955
        return dbus.Boolean(bool(self.approvals_pending))
 
956
    
 
957
    # ApprovedByDefault - property
 
958
    @dbus_service_property(_interface, signature="b",
 
959
                           access="readwrite")
 
960
    def ApprovedByDefault_dbus_property(self, value=None):
 
961
        if value is None:       # get
 
962
            return dbus.Boolean(self.approved_by_default)
 
963
        self.approved_by_default = bool(value)
 
964
        # Emit D-Bus signal
 
965
        self.PropertyChanged(dbus.String("ApprovedByDefault"),
 
966
                             dbus.Boolean(value, variant_level=1))
 
967
    
 
968
    # ApprovalDelay - property
 
969
    @dbus_service_property(_interface, signature="t",
 
970
                           access="readwrite")
 
971
    def ApprovalDelay_dbus_property(self, value=None):
 
972
        if value is None:       # get
 
973
            return dbus.UInt64(self.approval_delay_milliseconds())
 
974
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
975
        # Emit D-Bus signal
 
976
        self.PropertyChanged(dbus.String("ApprovalDelay"),
 
977
                             dbus.UInt64(value, variant_level=1))
 
978
    
 
979
    # ApprovalDuration - property
 
980
    @dbus_service_property(_interface, signature="t",
 
981
                           access="readwrite")
 
982
    def ApprovalDuration_dbus_property(self, value=None):
 
983
        if value is None:       # get
 
984
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
985
                    self.approval_duration))
 
986
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
987
        # Emit D-Bus signal
 
988
        self.PropertyChanged(dbus.String("ApprovalDuration"),
 
989
                             dbus.UInt64(value, variant_level=1))
 
990
    
 
991
    # Name - property
 
992
    @dbus_service_property(_interface, signature="s", access="read")
 
993
    def Name_dbus_property(self):
 
994
        return dbus.String(self.name)
 
995
    
 
996
    # Fingerprint - property
 
997
    @dbus_service_property(_interface, signature="s", access="read")
 
998
    def Fingerprint_dbus_property(self):
 
999
        return dbus.String(self.fingerprint)
 
1000
    
 
1001
    # Host - property
 
1002
    @dbus_service_property(_interface, signature="s",
 
1003
                           access="readwrite")
 
1004
    def Host_dbus_property(self, value=None):
 
1005
        if value is None:       # get
 
1006
            return dbus.String(self.host)
 
1007
        self.host = value
 
1008
        # Emit D-Bus signal
 
1009
        self.PropertyChanged(dbus.String("Host"),
 
1010
                             dbus.String(value, variant_level=1))
 
1011
    
 
1012
    # Created - property
 
1013
    @dbus_service_property(_interface, signature="s", access="read")
 
1014
    def Created_dbus_property(self):
 
1015
        return dbus.String(self._datetime_to_dbus(self.created))
 
1016
    
 
1017
    # LastEnabled - property
 
1018
    @dbus_service_property(_interface, signature="s", access="read")
 
1019
    def LastEnabled_dbus_property(self):
 
1020
        if self.last_enabled is None:
 
1021
            return dbus.String("")
 
1022
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
1023
    
 
1024
    # Enabled - property
 
1025
    @dbus_service_property(_interface, signature="b",
 
1026
                           access="readwrite")
 
1027
    def Enabled_dbus_property(self, value=None):
 
1028
        if value is None:       # get
 
1029
            return dbus.Boolean(self.enabled)
 
1030
        if value:
 
1031
            self.enable()
 
1032
        else:
 
1033
            self.disable()
 
1034
    
 
1035
    # LastCheckedOK - property
 
1036
    @dbus_service_property(_interface, signature="s",
 
1037
                           access="readwrite")
 
1038
    def LastCheckedOK_dbus_property(self, value=None):
 
1039
        if value is not None:
 
1040
            self.checked_ok()
 
1041
            return
371
1042
        if self.last_checked_ok is None:
372
 
            return now < (self.created + self.timeout)
373
 
        else:
374
 
            return now < (self.last_checked_ok + self.timeout)
375
 
 
376
 
 
377
 
def peer_certificate(session):
378
 
    "Return the peer's OpenPGP certificate as a bytestring"
379
 
    # If not an OpenPGP certificate...
380
 
    if gnutls.library.functions.gnutls_certificate_type_get\
381
 
            (session._c_object) \
382
 
           != gnutls.library.constants.GNUTLS_CRT_OPENPGP:
383
 
        # ...do the normal thing
384
 
        return session.peer_certificate
385
 
    list_size = ctypes.c_uint()
386
 
    cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
387
 
        (session._c_object, ctypes.byref(list_size))
388
 
    if list_size.value == 0:
389
 
        return None
390
 
    cert = cert_list[0]
391
 
    return ctypes.string_at(cert.data, cert.size)
392
 
 
393
 
 
394
 
def fingerprint(openpgp):
395
 
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
396
 
    # New GnuTLS "datum" with the OpenPGP public key
397
 
    datum = gnutls.library.types.gnutls_datum_t\
398
 
        (ctypes.cast(ctypes.c_char_p(openpgp),
399
 
                     ctypes.POINTER(ctypes.c_ubyte)),
400
 
         ctypes.c_uint(len(openpgp)))
401
 
    # New empty GnuTLS certificate
402
 
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
403
 
    gnutls.library.functions.gnutls_openpgp_crt_init\
404
 
        (ctypes.byref(crt))
405
 
    # Import the OpenPGP public key into the certificate
406
 
    gnutls.library.functions.gnutls_openpgp_crt_import\
407
 
                    (crt, ctypes.byref(datum),
408
 
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
409
 
    # New buffer for the fingerprint
410
 
    buffer = ctypes.create_string_buffer(20)
411
 
    buffer_length = ctypes.c_size_t()
412
 
    # Get the fingerprint from the certificate into the buffer
413
 
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
414
 
        (crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
415
 
    # Deinit the certificate
416
 
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
417
 
    # Convert the buffer to a Python bytestring
418
 
    fpr = ctypes.string_at(buffer, buffer_length.value)
419
 
    # Convert the bytestring to hexadecimal notation
420
 
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
421
 
    return hex_fpr
422
 
 
423
 
 
424
 
class tcp_handler(SocketServer.BaseRequestHandler, object):
425
 
    """A TCP request handler class.
426
 
    Instantiated by IPv6_TCPServer for each request to handle it.
 
1043
            return dbus.String("")
 
1044
        return dbus.String(self._datetime_to_dbus(self
 
1045
                                                  .last_checked_ok))
 
1046
    
 
1047
    # LastApprovalRequest - property
 
1048
    @dbus_service_property(_interface, signature="s", access="read")
 
1049
    def LastApprovalRequest_dbus_property(self):
 
1050
        if self.last_approval_request is None:
 
1051
            return dbus.String("")
 
1052
        return dbus.String(self.
 
1053
                           _datetime_to_dbus(self
 
1054
                                             .last_approval_request))
 
1055
    
 
1056
    # Timeout - property
 
1057
    @dbus_service_property(_interface, signature="t",
 
1058
                           access="readwrite")
 
1059
    def Timeout_dbus_property(self, value=None):
 
1060
        if value is None:       # get
 
1061
            return dbus.UInt64(self.timeout_milliseconds())
 
1062
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1063
        # Emit D-Bus signal
 
1064
        self.PropertyChanged(dbus.String("Timeout"),
 
1065
                             dbus.UInt64(value, variant_level=1))
 
1066
        if getattr(self, "disable_initiator_tag", None) is None:
 
1067
            return
 
1068
        # Reschedule timeout
 
1069
        gobject.source_remove(self.disable_initiator_tag)
 
1070
        self.disable_initiator_tag = None
 
1071
        time_to_die = (self.
 
1072
                       _timedelta_to_milliseconds((self
 
1073
                                                   .last_checked_ok
 
1074
                                                   + self.timeout)
 
1075
                                                  - datetime.datetime
 
1076
                                                  .utcnow()))
 
1077
        if time_to_die <= 0:
 
1078
            # The timeout has passed
 
1079
            self.disable()
 
1080
        else:
 
1081
            self.disable_initiator_tag = (gobject.timeout_add
 
1082
                                          (time_to_die, self.disable))
 
1083
    
 
1084
    # Interval - property
 
1085
    @dbus_service_property(_interface, signature="t",
 
1086
                           access="readwrite")
 
1087
    def Interval_dbus_property(self, value=None):
 
1088
        if value is None:       # get
 
1089
            return dbus.UInt64(self.interval_milliseconds())
 
1090
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1091
        # Emit D-Bus signal
 
1092
        self.PropertyChanged(dbus.String("Interval"),
 
1093
                             dbus.UInt64(value, variant_level=1))
 
1094
        if getattr(self, "checker_initiator_tag", None) is None:
 
1095
            return
 
1096
        # Reschedule checker run
 
1097
        gobject.source_remove(self.checker_initiator_tag)
 
1098
        self.checker_initiator_tag = (gobject.timeout_add
 
1099
                                      (value, self.start_checker))
 
1100
        self.start_checker()    # Start one now, too
 
1101
 
 
1102
    # Checker - property
 
1103
    @dbus_service_property(_interface, signature="s",
 
1104
                           access="readwrite")
 
1105
    def Checker_dbus_property(self, value=None):
 
1106
        if value is None:       # get
 
1107
            return dbus.String(self.checker_command)
 
1108
        self.checker_command = value
 
1109
        # Emit D-Bus signal
 
1110
        self.PropertyChanged(dbus.String("Checker"),
 
1111
                             dbus.String(self.checker_command,
 
1112
                                         variant_level=1))
 
1113
    
 
1114
    # CheckerRunning - property
 
1115
    @dbus_service_property(_interface, signature="b",
 
1116
                           access="readwrite")
 
1117
    def CheckerRunning_dbus_property(self, value=None):
 
1118
        if value is None:       # get
 
1119
            return dbus.Boolean(self.checker is not None)
 
1120
        if value:
 
1121
            self.start_checker()
 
1122
        else:
 
1123
            self.stop_checker()
 
1124
    
 
1125
    # ObjectPath - property
 
1126
    @dbus_service_property(_interface, signature="o", access="read")
 
1127
    def ObjectPath_dbus_property(self):
 
1128
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1129
    
 
1130
    # Secret = property
 
1131
    @dbus_service_property(_interface, signature="ay",
 
1132
                           access="write", byte_arrays=True)
 
1133
    def Secret_dbus_property(self, value):
 
1134
        self.secret = str(value)
 
1135
    
 
1136
    del _interface
 
1137
 
 
1138
 
 
1139
class ProxyClient(object):
 
1140
    def __init__(self, child_pipe, fpr, address):
 
1141
        self._pipe = child_pipe
 
1142
        self._pipe.send(('init', fpr, address))
 
1143
        if not self._pipe.recv():
 
1144
            raise KeyError()
 
1145
 
 
1146
    def __getattribute__(self, name):
 
1147
        if(name == '_pipe'):
 
1148
            return super(ProxyClient, self).__getattribute__(name)
 
1149
        self._pipe.send(('getattr', name))
 
1150
        data = self._pipe.recv()
 
1151
        if data[0] == 'data':
 
1152
            return data[1]
 
1153
        if data[0] == 'function':
 
1154
            def func(*args, **kwargs):
 
1155
                self._pipe.send(('funcall', name, args, kwargs))
 
1156
                return self._pipe.recv()[1]
 
1157
            return func
 
1158
 
 
1159
    def __setattr__(self, name, value):
 
1160
        if(name == '_pipe'):
 
1161
            return super(ProxyClient, self).__setattr__(name, value)
 
1162
        self._pipe.send(('setattr', name, value))
 
1163
 
 
1164
 
 
1165
class ClientHandler(socketserver.BaseRequestHandler, object):
 
1166
    """A class to handle client connections.
 
1167
    
 
1168
    Instantiated once for each connection to handle it.
427
1169
    Note: This will run in its own forked process."""
428
1170
    
429
1171
    def handle(self):
430
 
        logger.info(u"TCP connection from: %s",
431
 
                     unicode(self.client_address))
432
 
        session = gnutls.connection.ClientSession\
433
 
                  (self.request, gnutls.connection.X509Credentials())
434
 
        
435
 
        line = self.request.makefile().readline()
436
 
        logger.debug(u"Protocol version: %r", line)
437
 
        try:
438
 
            if int(line.strip().split()[0]) > 1:
439
 
                raise RuntimeError
440
 
        except (ValueError, IndexError, RuntimeError), error:
441
 
            logger.error(u"Unknown protocol version: %s", error)
442
 
            return
443
 
        
444
 
        # Note: gnutls.connection.X509Credentials is really a generic
445
 
        # GnuTLS certificate credentials object so long as no X.509
446
 
        # keys are added to it.  Therefore, we can use it here despite
447
 
        # using OpenPGP certificates.
448
 
        
449
 
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
450
 
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
451
 
        #                "+DHE-DSS"))
452
 
        priority = "NORMAL"             # Fallback default, since this
453
 
                                        # MUST be set.
454
 
        if self.server.settings["priority"]:
455
 
            priority = self.server.settings["priority"]
456
 
        gnutls.library.functions.gnutls_priority_set_direct\
457
 
            (session._c_object, priority, None);
458
 
        
459
 
        try:
460
 
            session.handshake()
461
 
        except gnutls.errors.GNUTLSError, error:
462
 
            logger.warning(u"Handshake failed: %s", error)
463
 
            # Do not run session.bye() here: the session is not
464
 
            # established.  Just abandon the request.
465
 
            return
466
 
        try:
467
 
            fpr = fingerprint(peer_certificate(session))
468
 
        except (TypeError, gnutls.errors.GNUTLSError), error:
469
 
            logger.warning(u"Bad certificate: %s", error)
470
 
            session.bye()
471
 
            return
472
 
        logger.debug(u"Fingerprint: %s", fpr)
473
 
        client = None
474
 
        for c in self.server.clients:
475
 
            if c.fingerprint == fpr:
476
 
                client = c
477
 
                break
478
 
        if not client:
479
 
            logger.warning(u"Client not found for fingerprint: %s",
480
 
                           fpr)
481
 
            session.bye()
482
 
            return
483
 
        # Have to check if client.still_valid(), since it is possible
484
 
        # that the client timed out while establishing the GnuTLS
485
 
        # session.
486
 
        if not client.still_valid():
487
 
            logger.warning(u"Client %(name)s is invalid",
488
 
                           vars(client))
489
 
            session.bye()
490
 
            return
491
 
        sent_size = 0
492
 
        while sent_size < len(client.secret):
493
 
            sent = session.send(client.secret[sent_size:])
494
 
            logger.debug(u"Sent: %d, remaining: %d",
495
 
                         sent, len(client.secret)
496
 
                         - (sent_size + sent))
497
 
            sent_size += sent
498
 
        session.bye()
499
 
 
500
 
 
501
 
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
502
 
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
 
1172
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1173
            logger.info("TCP connection from: %s",
 
1174
                        unicode(self.client_address))
 
1175
            logger.debug("Pipe FD: %d",
 
1176
                         self.server.child_pipe.fileno())
 
1177
 
 
1178
            session = (gnutls.connection
 
1179
                       .ClientSession(self.request,
 
1180
                                      gnutls.connection
 
1181
                                      .X509Credentials()))
 
1182
 
 
1183
            # Note: gnutls.connection.X509Credentials is really a
 
1184
            # generic GnuTLS certificate credentials object so long as
 
1185
            # no X.509 keys are added to it.  Therefore, we can use it
 
1186
            # here despite using OpenPGP certificates.
 
1187
 
 
1188
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1189
            #                      "+AES-256-CBC", "+SHA1",
 
1190
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1191
            #                      "+DHE-DSS"))
 
1192
            # Use a fallback default, since this MUST be set.
 
1193
            priority = self.server.gnutls_priority
 
1194
            if priority is None:
 
1195
                priority = "NORMAL"
 
1196
            (gnutls.library.functions
 
1197
             .gnutls_priority_set_direct(session._c_object,
 
1198
                                         priority, None))
 
1199
 
 
1200
            # Start communication using the Mandos protocol
 
1201
            # Get protocol number
 
1202
            line = self.request.makefile().readline()
 
1203
            logger.debug("Protocol version: %r", line)
 
1204
            try:
 
1205
                if int(line.strip().split()[0]) > 1:
 
1206
                    raise RuntimeError
 
1207
            except (ValueError, IndexError, RuntimeError), error:
 
1208
                logger.error("Unknown protocol version: %s", error)
 
1209
                return
 
1210
 
 
1211
            # Start GnuTLS connection
 
1212
            try:
 
1213
                session.handshake()
 
1214
            except gnutls.errors.GNUTLSError, error:
 
1215
                logger.warning("Handshake failed: %s", error)
 
1216
                # Do not run session.bye() here: the session is not
 
1217
                # established.  Just abandon the request.
 
1218
                return
 
1219
            logger.debug("Handshake succeeded")
 
1220
 
 
1221
            approval_required = False
 
1222
            try:
 
1223
                try:
 
1224
                    fpr = self.fingerprint(self.peer_certificate
 
1225
                                           (session))
 
1226
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1227
                    logger.warning("Bad certificate: %s", error)
 
1228
                    return
 
1229
                logger.debug("Fingerprint: %s", fpr)
 
1230
 
 
1231
                try:
 
1232
                    client = ProxyClient(child_pipe, fpr,
 
1233
                                         self.client_address)
 
1234
                except KeyError:
 
1235
                    return
 
1236
                
 
1237
                if client.approval_delay:
 
1238
                    delay = client.approval_delay
 
1239
                    client.approvals_pending += 1
 
1240
                    approval_required = True
 
1241
                
 
1242
                while True:
 
1243
                    if not client.enabled:
 
1244
                        logger.warning("Client %s is disabled",
 
1245
                                       client.name)
 
1246
                        if self.server.use_dbus:
 
1247
                            # Emit D-Bus signal
 
1248
                            client.Rejected("Disabled")                    
 
1249
                        return
 
1250
                    
 
1251
                    if client._approved or not client.approval_delay:
 
1252
                        #We are approved or approval is disabled
 
1253
                        break
 
1254
                    elif client._approved is None:
 
1255
                        logger.info("Client %s needs approval",
 
1256
                                    client.name)
 
1257
                        if self.server.use_dbus:
 
1258
                            # Emit D-Bus signal
 
1259
                            client.NeedApproval(
 
1260
                                client.approval_delay_milliseconds(),
 
1261
                                client.approved_by_default)
 
1262
                    else:
 
1263
                        logger.warning("Client %s was not approved",
 
1264
                                       client.name)
 
1265
                        if self.server.use_dbus:
 
1266
                            # Emit D-Bus signal
 
1267
                            client.Rejected("Denied")
 
1268
                        return
 
1269
                    
 
1270
                    #wait until timeout or approved
 
1271
                    #x = float(client._timedelta_to_milliseconds(delay))
 
1272
                    time = datetime.datetime.now()
 
1273
                    client.changedstate.acquire()
 
1274
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1275
                    client.changedstate.release()
 
1276
                    time2 = datetime.datetime.now()
 
1277
                    if (time2 - time) >= delay:
 
1278
                        if not client.approved_by_default:
 
1279
                            logger.warning("Client %s timed out while"
 
1280
                                           " waiting for approval",
 
1281
                                           client.name)
 
1282
                            if self.server.use_dbus:
 
1283
                                # Emit D-Bus signal
 
1284
                                client.Rejected("Approval timed out")
 
1285
                            return
 
1286
                        else:
 
1287
                            break
 
1288
                    else:
 
1289
                        delay -= time2 - time
 
1290
                
 
1291
                sent_size = 0
 
1292
                while sent_size < len(client.secret):
 
1293
                    try:
 
1294
                        sent = session.send(client.secret[sent_size:])
 
1295
                    except (gnutls.errors.GNUTLSError), error:
 
1296
                        logger.warning("gnutls send failed")
 
1297
                        return
 
1298
                    logger.debug("Sent: %d, remaining: %d",
 
1299
                                 sent, len(client.secret)
 
1300
                                 - (sent_size + sent))
 
1301
                    sent_size += sent
 
1302
 
 
1303
                logger.info("Sending secret to %s", client.name)
 
1304
                # bump the timeout as if seen
 
1305
                client.checked_ok()
 
1306
                if self.server.use_dbus:
 
1307
                    # Emit D-Bus signal
 
1308
                    client.GotSecret()
 
1309
            
 
1310
            finally:
 
1311
                if approval_required:
 
1312
                    client.approvals_pending -= 1
 
1313
                try:
 
1314
                    session.bye()
 
1315
                except (gnutls.errors.GNUTLSError), error:
 
1316
                    logger.warning("GnuTLS bye failed")
 
1317
    
 
1318
    @staticmethod
 
1319
    def peer_certificate(session):
 
1320
        "Return the peer's OpenPGP certificate as a bytestring"
 
1321
        # If not an OpenPGP certificate...
 
1322
        if (gnutls.library.functions
 
1323
            .gnutls_certificate_type_get(session._c_object)
 
1324
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1325
            # ...do the normal thing
 
1326
            return session.peer_certificate
 
1327
        list_size = ctypes.c_uint(1)
 
1328
        cert_list = (gnutls.library.functions
 
1329
                     .gnutls_certificate_get_peers
 
1330
                     (session._c_object, ctypes.byref(list_size)))
 
1331
        if not bool(cert_list) and list_size.value != 0:
 
1332
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1333
                                            " certificate")
 
1334
        if list_size.value == 0:
 
1335
            return None
 
1336
        cert = cert_list[0]
 
1337
        return ctypes.string_at(cert.data, cert.size)
 
1338
    
 
1339
    @staticmethod
 
1340
    def fingerprint(openpgp):
 
1341
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
 
1342
        # New GnuTLS "datum" with the OpenPGP public key
 
1343
        datum = (gnutls.library.types
 
1344
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1345
                                             ctypes.POINTER
 
1346
                                             (ctypes.c_ubyte)),
 
1347
                                 ctypes.c_uint(len(openpgp))))
 
1348
        # New empty GnuTLS certificate
 
1349
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1350
        (gnutls.library.functions
 
1351
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1352
        # Import the OpenPGP public key into the certificate
 
1353
        (gnutls.library.functions
 
1354
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1355
                                    gnutls.library.constants
 
1356
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1357
        # Verify the self signature in the key
 
1358
        crtverify = ctypes.c_uint()
 
1359
        (gnutls.library.functions
 
1360
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1361
                                         ctypes.byref(crtverify)))
 
1362
        if crtverify.value != 0:
 
1363
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1364
            raise (gnutls.errors.CertificateSecurityError
 
1365
                   ("Verify failed"))
 
1366
        # New buffer for the fingerprint
 
1367
        buf = ctypes.create_string_buffer(20)
 
1368
        buf_len = ctypes.c_size_t()
 
1369
        # Get the fingerprint from the certificate into the buffer
 
1370
        (gnutls.library.functions
 
1371
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1372
                                             ctypes.byref(buf_len)))
 
1373
        # Deinit the certificate
 
1374
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1375
        # Convert the buffer to a Python bytestring
 
1376
        fpr = ctypes.string_at(buf, buf_len.value)
 
1377
        # Convert the bytestring to hexadecimal notation
 
1378
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1379
        return hex_fpr
 
1380
 
 
1381
 
 
1382
class MultiprocessingMixIn(object):
 
1383
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1384
    def sub_process_main(self, request, address):
 
1385
        try:
 
1386
            self.finish_request(request, address)
 
1387
        except:
 
1388
            self.handle_error(request, address)
 
1389
        self.close_request(request)
 
1390
            
 
1391
    def process_request(self, request, address):
 
1392
        """Start a new process to process the request."""
 
1393
        multiprocessing.Process(target = self.sub_process_main,
 
1394
                                args = (request, address)).start()
 
1395
 
 
1396
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1397
    """ adds a pipe to the MixIn """
 
1398
    def process_request(self, request, client_address):
 
1399
        """Overrides and wraps the original process_request().
 
1400
        
 
1401
        This function creates a new pipe in self.pipe
 
1402
        """
 
1403
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1404
 
 
1405
        super(MultiprocessingMixInWithPipe,
 
1406
              self).process_request(request, client_address)
 
1407
        self.child_pipe.close()
 
1408
        self.add_pipe(parent_pipe)
 
1409
 
 
1410
    def add_pipe(self, parent_pipe):
 
1411
        """Dummy function; override as necessary"""
 
1412
        raise NotImplementedError
 
1413
 
 
1414
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
 
1415
                     socketserver.TCPServer, object):
 
1416
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
1417
    
503
1418
    Attributes:
504
 
        settings:       Server settings
505
 
        clients:        Set() of Client objects
 
1419
        enabled:        Boolean; whether this server is activated yet
 
1420
        interface:      None or a network interface name (string)
 
1421
        use_ipv6:       Boolean; to use IPv6 or not
506
1422
    """
507
 
    address_family = socket.AF_INET6
508
 
    def __init__(self, *args, **kwargs):
509
 
        if "settings" in kwargs:
510
 
            self.settings = kwargs["settings"]
511
 
            del kwargs["settings"]
512
 
        if "clients" in kwargs:
513
 
            self.clients = kwargs["clients"]
514
 
            del kwargs["clients"]
515
 
        return super(type(self), self).__init__(*args, **kwargs)
 
1423
    def __init__(self, server_address, RequestHandlerClass,
 
1424
                 interface=None, use_ipv6=True):
 
1425
        self.interface = interface
 
1426
        if use_ipv6:
 
1427
            self.address_family = socket.AF_INET6
 
1428
        socketserver.TCPServer.__init__(self, server_address,
 
1429
                                        RequestHandlerClass)
516
1430
    def server_bind(self):
517
1431
        """This overrides the normal server_bind() function
518
1432
        to bind to an interface if one was specified, and also NOT to
519
1433
        bind to an address or port if they were not specified."""
520
 
        if self.settings["interface"]:
521
 
            # 25 is from /usr/include/asm-i486/socket.h
522
 
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
523
 
            try:
524
 
                self.socket.setsockopt(socket.SOL_SOCKET,
525
 
                                       SO_BINDTODEVICE,
526
 
                                       self.settings["interface"])
527
 
            except socket.error, error:
528
 
                if error[0] == errno.EPERM:
529
 
                    logger.error(u"No permission to"
530
 
                                 u" bind to interface %s",
531
 
                                 self.settings["interface"])
532
 
                else:
533
 
                    raise error
 
1434
        if self.interface is not None:
 
1435
            if SO_BINDTODEVICE is None:
 
1436
                logger.error("SO_BINDTODEVICE does not exist;"
 
1437
                             " cannot bind to interface %s",
 
1438
                             self.interface)
 
1439
            else:
 
1440
                try:
 
1441
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1442
                                           SO_BINDTODEVICE,
 
1443
                                           str(self.interface
 
1444
                                               + '\0'))
 
1445
                except socket.error, error:
 
1446
                    if error[0] == errno.EPERM:
 
1447
                        logger.error("No permission to"
 
1448
                                     " bind to interface %s",
 
1449
                                     self.interface)
 
1450
                    elif error[0] == errno.ENOPROTOOPT:
 
1451
                        logger.error("SO_BINDTODEVICE not available;"
 
1452
                                     " cannot bind to interface %s",
 
1453
                                     self.interface)
 
1454
                    else:
 
1455
                        raise
534
1456
        # Only bind(2) the socket if we really need to.
535
1457
        if self.server_address[0] or self.server_address[1]:
536
1458
            if not self.server_address[0]:
537
 
                in6addr_any = "::"
538
 
                self.server_address = (in6addr_any,
 
1459
                if self.address_family == socket.AF_INET6:
 
1460
                    any_address = "::" # in6addr_any
 
1461
                else:
 
1462
                    any_address = socket.INADDR_ANY
 
1463
                self.server_address = (any_address,
539
1464
                                       self.server_address[1])
540
1465
            elif not self.server_address[1]:
541
1466
                self.server_address = (self.server_address[0],
542
1467
                                       0)
543
 
#                 if self.settings["interface"]:
 
1468
#                 if self.interface:
544
1469
#                     self.server_address = (self.server_address[0],
545
1470
#                                            0, # port
546
1471
#                                            0, # flowinfo
547
1472
#                                            if_nametoindex
548
 
#                                            (self.settings
549
 
#                                             ["interface"]))
550
 
            return super(type(self), self).server_bind()
 
1473
#                                            (self.interface))
 
1474
            return socketserver.TCPServer.server_bind(self)
 
1475
 
 
1476
 
 
1477
class MandosServer(IPv6_TCPServer):
 
1478
    """Mandos server.
 
1479
    
 
1480
    Attributes:
 
1481
        clients:        set of Client objects
 
1482
        gnutls_priority GnuTLS priority string
 
1483
        use_dbus:       Boolean; to emit D-Bus signals or not
 
1484
    
 
1485
    Assumes a gobject.MainLoop event loop.
 
1486
    """
 
1487
    def __init__(self, server_address, RequestHandlerClass,
 
1488
                 interface=None, use_ipv6=True, clients=None,
 
1489
                 gnutls_priority=None, use_dbus=True):
 
1490
        self.enabled = False
 
1491
        self.clients = clients
 
1492
        if self.clients is None:
 
1493
            self.clients = set()
 
1494
        self.use_dbus = use_dbus
 
1495
        self.gnutls_priority = gnutls_priority
 
1496
        IPv6_TCPServer.__init__(self, server_address,
 
1497
                                RequestHandlerClass,
 
1498
                                interface = interface,
 
1499
                                use_ipv6 = use_ipv6)
 
1500
    def server_activate(self):
 
1501
        if self.enabled:
 
1502
            return socketserver.TCPServer.server_activate(self)
 
1503
    def enable(self):
 
1504
        self.enabled = True
 
1505
    def add_pipe(self, parent_pipe):
 
1506
        # Call "handle_ipc" for both data and EOF events
 
1507
        gobject.io_add_watch(parent_pipe.fileno(),
 
1508
                             gobject.IO_IN | gobject.IO_HUP,
 
1509
                             functools.partial(self.handle_ipc,
 
1510
                                               parent_pipe = parent_pipe))
 
1511
        
 
1512
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1513
                   client_object=None):
 
1514
        condition_names = {
 
1515
            gobject.IO_IN: "IN",   # There is data to read.
 
1516
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1517
                                    # blocking).
 
1518
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1519
            gobject.IO_ERR: "ERR", # Error condition.
 
1520
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1521
                                    # broken, usually for pipes and
 
1522
                                    # sockets).
 
1523
            }
 
1524
        conditions_string = ' | '.join(name
 
1525
                                       for cond, name in
 
1526
                                       condition_names.iteritems()
 
1527
                                       if cond & condition)
 
1528
        # error or the other end of multiprocessing.Pipe has closed
 
1529
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1530
            return False
 
1531
        
 
1532
        # Read a request from the child
 
1533
        request = parent_pipe.recv()
 
1534
        command = request[0]
 
1535
        
 
1536
        if command == 'init':
 
1537
            fpr = request[1]
 
1538
            address = request[2]
 
1539
            
 
1540
            for c in self.clients:
 
1541
                if c.fingerprint == fpr:
 
1542
                    client = c
 
1543
                    break
 
1544
            else:
 
1545
                logger.warning("Client not found for fingerprint: %s, ad"
 
1546
                               "dress: %s", fpr, address)
 
1547
                if self.use_dbus:
 
1548
                    # Emit D-Bus signal
 
1549
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
1550
                parent_pipe.send(False)
 
1551
                return False
 
1552
            
 
1553
            gobject.io_add_watch(parent_pipe.fileno(),
 
1554
                                 gobject.IO_IN | gobject.IO_HUP,
 
1555
                                 functools.partial(self.handle_ipc,
 
1556
                                                   parent_pipe = parent_pipe,
 
1557
                                                   client_object = client))
 
1558
            parent_pipe.send(True)
 
1559
            # remove the old hook in favor of the new above hook on same fileno
 
1560
            return False
 
1561
        if command == 'funcall':
 
1562
            funcname = request[1]
 
1563
            args = request[2]
 
1564
            kwargs = request[3]
 
1565
            
 
1566
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1567
 
 
1568
        if command == 'getattr':
 
1569
            attrname = request[1]
 
1570
            if callable(client_object.__getattribute__(attrname)):
 
1571
                parent_pipe.send(('function',))
 
1572
            else:
 
1573
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
1574
        
 
1575
        if command == 'setattr':
 
1576
            attrname = request[1]
 
1577
            value = request[2]
 
1578
            setattr(client_object, attrname, value)
 
1579
 
 
1580
        return True
551
1581
 
552
1582
 
553
1583
def string_to_delta(interval):
554
1584
    """Parse a string and return a datetime.timedelta
555
 
 
 
1585
    
556
1586
    >>> string_to_delta('7d')
557
1587
    datetime.timedelta(7)
558
1588
    >>> string_to_delta('60s')
561
1591
    datetime.timedelta(0, 3600)
562
1592
    >>> string_to_delta('24h')
563
1593
    datetime.timedelta(1)
564
 
    >>> string_to_delta(u'1w')
 
1594
    >>> string_to_delta('1w')
565
1595
    datetime.timedelta(7)
 
1596
    >>> string_to_delta('5m 30s')
 
1597
    datetime.timedelta(0, 330)
566
1598
    """
567
 
    try:
568
 
        suffix=unicode(interval[-1])
569
 
        value=int(interval[:-1])
570
 
        if suffix == u"d":
571
 
            delta = datetime.timedelta(value)
572
 
        elif suffix == u"s":
573
 
            delta = datetime.timedelta(0, value)
574
 
        elif suffix == u"m":
575
 
            delta = datetime.timedelta(0, 0, 0, 0, value)
576
 
        elif suffix == u"h":
577
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
578
 
        elif suffix == u"w":
579
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
580
 
        else:
581
 
            raise ValueError
582
 
    except (ValueError, IndexError):
583
 
        raise ValueError
584
 
    return delta
585
 
 
586
 
 
587
 
def server_state_changed(state):
588
 
    """Derived from the Avahi example code"""
589
 
    if state == avahi.SERVER_COLLISION:
590
 
        logger.error(u"Server name collision")
591
 
        service.remove()
592
 
    elif state == avahi.SERVER_RUNNING:
593
 
        service.add()
594
 
 
595
 
 
596
 
def entry_group_state_changed(state, error):
597
 
    """Derived from the Avahi example code"""
598
 
    logger.debug(u"state change: %i", state)
599
 
    
600
 
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
601
 
        logger.debug(u"Service established.")
602
 
    elif state == avahi.ENTRY_GROUP_COLLISION:
603
 
        logger.warning(u"Service name collision.")
604
 
        service.rename()
605
 
    elif state == avahi.ENTRY_GROUP_FAILURE:
606
 
        logger.critical(u"Error in group state changed %s",
607
 
                        unicode(error))
608
 
        raise AvahiGroupError("State changed: %s", str(error))
 
1599
    timevalue = datetime.timedelta(0)
 
1600
    for s in interval.split():
 
1601
        try:
 
1602
            suffix = unicode(s[-1])
 
1603
            value = int(s[:-1])
 
1604
            if suffix == "d":
 
1605
                delta = datetime.timedelta(value)
 
1606
            elif suffix == "s":
 
1607
                delta = datetime.timedelta(0, value)
 
1608
            elif suffix == "m":
 
1609
                delta = datetime.timedelta(0, 0, 0, 0, value)
 
1610
            elif suffix == "h":
 
1611
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
 
1612
            elif suffix == "w":
 
1613
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
 
1614
            else:
 
1615
                raise ValueError("Unknown suffix %r" % suffix)
 
1616
        except (ValueError, IndexError), e:
 
1617
            raise ValueError(*(e.args))
 
1618
        timevalue += delta
 
1619
    return timevalue
 
1620
 
609
1621
 
610
1622
def if_nametoindex(interface):
611
 
    """Call the C function if_nametoindex(), or equivalent"""
 
1623
    """Call the C function if_nametoindex(), or equivalent
 
1624
    
 
1625
    Note: This function cannot accept a unicode string."""
612
1626
    global if_nametoindex
613
1627
    try:
614
 
        if "ctypes.util" not in sys.modules:
615
 
            import ctypes.util
616
 
        if_nametoindex = ctypes.cdll.LoadLibrary\
617
 
            (ctypes.util.find_library("c")).if_nametoindex
 
1628
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1629
                          (ctypes.util.find_library("c"))
 
1630
                          .if_nametoindex)
618
1631
    except (OSError, AttributeError):
619
 
        if "struct" not in sys.modules:
620
 
            import struct
621
 
        if "fcntl" not in sys.modules:
622
 
            import fcntl
 
1632
        logger.warning("Doing if_nametoindex the hard way")
623
1633
        def if_nametoindex(interface):
624
1634
            "Get an interface index the hard way, i.e. using fcntl()"
625
1635
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
626
 
            s = socket.socket()
627
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
628
 
                                struct.pack("16s16x", interface))
629
 
            s.close()
630
 
            interface_index = struct.unpack("I", ifreq[16:20])[0]
 
1636
            with contextlib.closing(socket.socket()) as s:
 
1637
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1638
                                    struct.pack(str("16s16x"),
 
1639
                                                interface))
 
1640
            interface_index = struct.unpack(str("I"),
 
1641
                                            ifreq[16:20])[0]
631
1642
            return interface_index
632
1643
    return if_nametoindex(interface)
633
1644
 
634
1645
 
635
1646
def daemon(nochdir = False, noclose = False):
636
1647
    """See daemon(3).  Standard BSD Unix function.
 
1648
    
637
1649
    This should really exist as os.daemon, but it doesn't (yet)."""
638
1650
    if os.fork():
639
1651
        sys.exit()
647
1659
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
648
1660
        if not stat.S_ISCHR(os.fstat(null).st_mode):
649
1661
            raise OSError(errno.ENODEV,
650
 
                          "/dev/null not a character device")
 
1662
                          "%s not a character device"
 
1663
                          % os.path.devnull)
651
1664
        os.dup2(null, sys.stdin.fileno())
652
1665
        os.dup2(null, sys.stdout.fileno())
653
1666
        os.dup2(null, sys.stderr.fileno())
656
1669
 
657
1670
 
658
1671
def main():
659
 
    global main_loop_started
660
 
    main_loop_started = False
661
 
    
662
 
    parser = OptionParser(version = "%%prog %s" % version)
 
1672
    
 
1673
    ##################################################################
 
1674
    # Parsing of options, both command line and config file
 
1675
    
 
1676
    parser = optparse.OptionParser(version = "%%prog %s" % version)
663
1677
    parser.add_option("-i", "--interface", type="string",
664
1678
                      metavar="IF", help="Bind to interface IF")
665
1679
    parser.add_option("-a", "--address", type="string",
666
1680
                      help="Address to listen for requests on")
667
1681
    parser.add_option("-p", "--port", type="int",
668
1682
                      help="Port number to receive requests on")
669
 
    parser.add_option("--check", action="store_true", default=False,
 
1683
    parser.add_option("--check", action="store_true",
670
1684
                      help="Run self-test")
671
1685
    parser.add_option("--debug", action="store_true",
672
1686
                      help="Debug mode; run in foreground and log to"
673
1687
                      " terminal")
 
1688
    parser.add_option("--debuglevel", type="string", metavar="LEVEL",
 
1689
                      help="Debug level for stdout output")
674
1690
    parser.add_option("--priority", type="string", help="GnuTLS"
675
1691
                      " priority string (see GnuTLS documentation)")
676
 
    parser.add_option("--servicename", type="string", metavar="NAME",
677
 
                      help="Zeroconf service name")
 
1692
    parser.add_option("--servicename", type="string",
 
1693
                      metavar="NAME", help="Zeroconf service name")
678
1694
    parser.add_option("--configdir", type="string",
679
1695
                      default="/etc/mandos", metavar="DIR",
680
1696
                      help="Directory to search for configuration"
681
1697
                      " files")
682
 
    (options, args) = parser.parse_args()
 
1698
    parser.add_option("--no-dbus", action="store_false",
 
1699
                      dest="use_dbus", help="Do not provide D-Bus"
 
1700
                      " system bus interface")
 
1701
    parser.add_option("--no-ipv6", action="store_false",
 
1702
                      dest="use_ipv6", help="Do not use IPv6")
 
1703
    options = parser.parse_args()[0]
683
1704
    
684
1705
    if options.check:
685
1706
        import doctest
694
1715
                        "priority":
695
1716
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
696
1717
                        "servicename": "Mandos",
 
1718
                        "use_dbus": "True",
 
1719
                        "use_ipv6": "True",
 
1720
                        "debuglevel": "",
697
1721
                        }
698
1722
    
699
1723
    # Parse config file for server-global settings
700
 
    server_config = ConfigParser.SafeConfigParser(server_defaults)
 
1724
    server_config = configparser.SafeConfigParser(server_defaults)
701
1725
    del server_defaults
702
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
703
 
    server_section = "server"
 
1726
    server_config.read(os.path.join(options.configdir,
 
1727
                                    "mandos.conf"))
704
1728
    # Convert the SafeConfigParser object to a dict
705
 
    server_settings = dict(server_config.items(server_section))
706
 
    # Use getboolean on the boolean config option
707
 
    server_settings["debug"] = server_config.getboolean\
708
 
                               (server_section, "debug")
 
1729
    server_settings = server_config.defaults()
 
1730
    # Use the appropriate methods on the non-string config options
 
1731
    for option in ("debug", "use_dbus", "use_ipv6"):
 
1732
        server_settings[option] = server_config.getboolean("DEFAULT",
 
1733
                                                           option)
 
1734
    if server_settings["port"]:
 
1735
        server_settings["port"] = server_config.getint("DEFAULT",
 
1736
                                                       "port")
709
1737
    del server_config
710
1738
    
711
1739
    # Override the settings from the config file with command line
712
1740
    # options, if set.
713
1741
    for option in ("interface", "address", "port", "debug",
714
 
                   "priority", "servicename", "configdir"):
 
1742
                   "priority", "servicename", "configdir",
 
1743
                   "use_dbus", "use_ipv6", "debuglevel"):
715
1744
        value = getattr(options, option)
716
1745
        if value is not None:
717
1746
            server_settings[option] = value
718
1747
    del options
 
1748
    # Force all strings to be unicode
 
1749
    for option in server_settings.keys():
 
1750
        if type(server_settings[option]) is str:
 
1751
            server_settings[option] = unicode(server_settings[option])
719
1752
    # Now we have our good server settings in "server_settings"
720
1753
    
 
1754
    ##################################################################
 
1755
    
 
1756
    # For convenience
721
1757
    debug = server_settings["debug"]
722
 
    
723
 
    if not debug:
724
 
        syslogger.setLevel(logging.WARNING)
725
 
        console.setLevel(logging.WARNING)
726
 
    
 
1758
    debuglevel = server_settings["debuglevel"]
 
1759
    use_dbus = server_settings["use_dbus"]
 
1760
    use_ipv6 = server_settings["use_ipv6"]
 
1761
 
727
1762
    if server_settings["servicename"] != "Mandos":
728
 
        syslogger.setFormatter(logging.Formatter\
729
 
                               ('Mandos (%s): %%(levelname)s:'
730
 
                                ' %%(message)s'
 
1763
        syslogger.setFormatter(logging.Formatter
 
1764
                               ('Mandos (%s) [%%(process)d]:'
 
1765
                                ' %%(levelname)s: %%(message)s'
731
1766
                                % server_settings["servicename"]))
732
1767
    
733
1768
    # Parse config file with clients
734
1769
    client_defaults = { "timeout": "1h",
735
1770
                        "interval": "5m",
736
1771
                        "checker": "fping -q -- %%(host)s",
 
1772
                        "host": "",
 
1773
                        "approval_delay": "0s",
 
1774
                        "approval_duration": "1s",
737
1775
                        }
738
 
    client_config = ConfigParser.SafeConfigParser(client_defaults)
 
1776
    client_config = configparser.SafeConfigParser(client_defaults)
739
1777
    client_config.read(os.path.join(server_settings["configdir"],
740
1778
                                    "clients.conf"))
741
1779
    
742
 
    global service
743
 
    service = AvahiService(name = server_settings["servicename"],
744
 
                           type = "_mandos._tcp", );
745
 
    if server_settings["interface"]:
746
 
        service.interface = if_nametoindex(server_settings["interface"])
 
1780
    global mandos_dbus_service
 
1781
    mandos_dbus_service = None
 
1782
    
 
1783
    tcp_server = MandosServer((server_settings["address"],
 
1784
                               server_settings["port"]),
 
1785
                              ClientHandler,
 
1786
                              interface=(server_settings["interface"]
 
1787
                                         or None),
 
1788
                              use_ipv6=use_ipv6,
 
1789
                              gnutls_priority=
 
1790
                              server_settings["priority"],
 
1791
                              use_dbus=use_dbus)
 
1792
    if not debug:
 
1793
        pidfilename = "/var/run/mandos.pid"
 
1794
        try:
 
1795
            pidfile = open(pidfilename, "w")
 
1796
        except IOError:
 
1797
            logger.error("Could not open file %r", pidfilename)
 
1798
    
 
1799
    try:
 
1800
        uid = pwd.getpwnam("_mandos").pw_uid
 
1801
        gid = pwd.getpwnam("_mandos").pw_gid
 
1802
    except KeyError:
 
1803
        try:
 
1804
            uid = pwd.getpwnam("mandos").pw_uid
 
1805
            gid = pwd.getpwnam("mandos").pw_gid
 
1806
        except KeyError:
 
1807
            try:
 
1808
                uid = pwd.getpwnam("nobody").pw_uid
 
1809
                gid = pwd.getpwnam("nobody").pw_gid
 
1810
            except KeyError:
 
1811
                uid = 65534
 
1812
                gid = 65534
 
1813
    try:
 
1814
        os.setgid(gid)
 
1815
        os.setuid(uid)
 
1816
    except OSError, error:
 
1817
        if error[0] != errno.EPERM:
 
1818
            raise error
 
1819
    
 
1820
    if not debug and not debuglevel:
 
1821
        syslogger.setLevel(logging.WARNING)
 
1822
        console.setLevel(logging.WARNING)
 
1823
    if debuglevel:
 
1824
        level = getattr(logging, debuglevel.upper())
 
1825
        syslogger.setLevel(level)
 
1826
        console.setLevel(level)
 
1827
 
 
1828
    if debug:
 
1829
        # Enable all possible GnuTLS debugging
 
1830
        
 
1831
        # "Use a log level over 10 to enable all debugging options."
 
1832
        # - GnuTLS manual
 
1833
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
1834
        
 
1835
        @gnutls.library.types.gnutls_log_func
 
1836
        def debug_gnutls(level, string):
 
1837
            logger.debug("GnuTLS: %s", string[:-1])
 
1838
        
 
1839
        (gnutls.library.functions
 
1840
         .gnutls_global_set_log_function(debug_gnutls))
 
1841
        
 
1842
        # Redirect stdin so all checkers get /dev/null
 
1843
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1844
        os.dup2(null, sys.stdin.fileno())
 
1845
        if null > 2:
 
1846
            os.close(null)
 
1847
    else:
 
1848
        # No console logging
 
1849
        logger.removeHandler(console)
 
1850
    
 
1851
    # Need to fork before connecting to D-Bus
 
1852
    if not debug:
 
1853
        # Close all input and output, do double fork, etc.
 
1854
        daemon()
747
1855
    
748
1856
    global main_loop
749
 
    global bus
750
 
    global server
751
1857
    # From the Avahi example code
752
1858
    DBusGMainLoop(set_as_default=True )
753
1859
    main_loop = gobject.MainLoop()
754
1860
    bus = dbus.SystemBus()
755
 
    server = dbus.Interface(
756
 
            bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
757
 
            avahi.DBUS_INTERFACE_SERVER )
758
1861
    # End of Avahi example code
759
 
    
760
 
    clients = Set()
761
 
    def remove_from_clients(client):
762
 
        clients.remove(client)
763
 
        if not clients:
764
 
            logger.critical(u"No clients left, exiting")
765
 
            sys.exit()
766
 
    
767
 
    clients.update(Set(Client(name = section,
768
 
                              stop_hook = remove_from_clients,
769
 
                              config
770
 
                              = dict(client_config.items(section)))
771
 
                       for section in client_config.sections()))
772
 
    if not clients:
773
 
        logger.critical(u"No clients defined")
774
 
        sys.exit(1)
775
 
    
 
1862
    if use_dbus:
 
1863
        try:
 
1864
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
 
1865
                                            bus, do_not_queue=True)
 
1866
        except dbus.exceptions.NameExistsException, e:
 
1867
            logger.error(unicode(e) + ", disabling D-Bus")
 
1868
            use_dbus = False
 
1869
            server_settings["use_dbus"] = False
 
1870
            tcp_server.use_dbus = False
 
1871
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
1872
    service = AvahiService(name = server_settings["servicename"],
 
1873
                           servicetype = "_mandos._tcp",
 
1874
                           protocol = protocol, bus = bus)
 
1875
    if server_settings["interface"]:
 
1876
        service.interface = (if_nametoindex
 
1877
                             (str(server_settings["interface"])))
 
1878
    
 
1879
    global multiprocessing_manager
 
1880
    multiprocessing_manager = multiprocessing.Manager()
 
1881
    
 
1882
    client_class = Client
 
1883
    if use_dbus:
 
1884
        client_class = functools.partial(ClientDBus, bus = bus)
 
1885
    def client_config_items(config, section):
 
1886
        special_settings = {
 
1887
            "approved_by_default":
 
1888
                lambda: config.getboolean(section,
 
1889
                                          "approved_by_default"),
 
1890
            }
 
1891
        for name, value in config.items(section):
 
1892
            try:
 
1893
                yield (name, special_settings[name]())
 
1894
            except KeyError:
 
1895
                yield (name, value)
 
1896
    
 
1897
    tcp_server.clients.update(set(
 
1898
            client_class(name = section,
 
1899
                         config= dict(client_config_items(
 
1900
                        client_config, section)))
 
1901
            for section in client_config.sections()))
 
1902
    if not tcp_server.clients:
 
1903
        logger.warning("No clients defined")
 
1904
        
776
1905
    if not debug:
777
 
        logger.removeHandler(console)
778
 
        daemon()
 
1906
        try:
 
1907
            with pidfile:
 
1908
                pid = os.getpid()
 
1909
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
1910
            del pidfile
 
1911
        except IOError:
 
1912
            logger.error("Could not write to file %r with PID %d",
 
1913
                         pidfilename, pid)
 
1914
        except NameError:
 
1915
            # "pidfile" was never created
 
1916
            pass
 
1917
        del pidfilename
 
1918
        
 
1919
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
1920
 
 
1921
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
 
1922
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
779
1923
    
780
 
    pidfilename = "/var/run/mandos/mandos.pid"
781
 
    pid = os.getpid()
782
 
    try:
783
 
        pidfile = open(pidfilename, "w")
784
 
        pidfile.write(str(pid) + "\n")
785
 
        pidfile.close()
786
 
        del pidfile
787
 
    except IOError, err:
788
 
        logger.error(u"Could not write %s file with PID %d",
789
 
                     pidfilename, os.getpid())
 
1924
    if use_dbus:
 
1925
        class MandosDBusService(dbus.service.Object):
 
1926
            """A D-Bus proxy object"""
 
1927
            def __init__(self):
 
1928
                dbus.service.Object.__init__(self, bus, "/")
 
1929
            _interface = "se.bsnet.fukt.Mandos"
 
1930
            
 
1931
            @dbus.service.signal(_interface, signature="o")
 
1932
            def ClientAdded(self, objpath):
 
1933
                "D-Bus signal"
 
1934
                pass
 
1935
            
 
1936
            @dbus.service.signal(_interface, signature="ss")
 
1937
            def ClientNotFound(self, fingerprint, address):
 
1938
                "D-Bus signal"
 
1939
                pass
 
1940
            
 
1941
            @dbus.service.signal(_interface, signature="os")
 
1942
            def ClientRemoved(self, objpath, name):
 
1943
                "D-Bus signal"
 
1944
                pass
 
1945
            
 
1946
            @dbus.service.method(_interface, out_signature="ao")
 
1947
            def GetAllClients(self):
 
1948
                "D-Bus method"
 
1949
                return dbus.Array(c.dbus_object_path
 
1950
                                  for c in tcp_server.clients)
 
1951
            
 
1952
            @dbus.service.method(_interface,
 
1953
                                 out_signature="a{oa{sv}}")
 
1954
            def GetAllClientsWithProperties(self):
 
1955
                "D-Bus method"
 
1956
                return dbus.Dictionary(
 
1957
                    ((c.dbus_object_path, c.GetAll(""))
 
1958
                     for c in tcp_server.clients),
 
1959
                    signature="oa{sv}")
 
1960
            
 
1961
            @dbus.service.method(_interface, in_signature="o")
 
1962
            def RemoveClient(self, object_path):
 
1963
                "D-Bus method"
 
1964
                for c in tcp_server.clients:
 
1965
                    if c.dbus_object_path == object_path:
 
1966
                        tcp_server.clients.remove(c)
 
1967
                        c.remove_from_connection()
 
1968
                        # Don't signal anything except ClientRemoved
 
1969
                        c.disable(quiet=True)
 
1970
                        # Emit D-Bus signal
 
1971
                        self.ClientRemoved(object_path, c.name)
 
1972
                        return
 
1973
                raise KeyError(object_path)
 
1974
            
 
1975
            del _interface
 
1976
        
 
1977
        mandos_dbus_service = MandosDBusService()
790
1978
    
791
1979
    def cleanup():
792
1980
        "Cleanup function; run on exit"
793
 
        global group
794
 
        # From the Avahi example code
795
 
        if not group is None:
796
 
            group.Free()
797
 
            group = None
798
 
        # End of Avahi example code
 
1981
        service.cleanup()
799
1982
        
800
 
        while clients:
801
 
            client = clients.pop()
802
 
            client.stop_hook = None
803
 
            client.stop()
 
1983
        while tcp_server.clients:
 
1984
            client = tcp_server.clients.pop()
 
1985
            if use_dbus:
 
1986
                client.remove_from_connection()
 
1987
            client.disable_hook = None
 
1988
            # Don't signal anything except ClientRemoved
 
1989
            client.disable(quiet=True)
 
1990
            if use_dbus:
 
1991
                # Emit D-Bus signal
 
1992
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
1993
                                                  client.name)
804
1994
    
805
1995
    atexit.register(cleanup)
806
1996
    
807
 
    if not debug:
808
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
809
 
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
810
 
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
811
 
    
812
 
    for client in clients:
813
 
        client.start()
814
 
    
815
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
816
 
                                 server_settings["port"]),
817
 
                                tcp_handler,
818
 
                                settings=server_settings,
819
 
                                clients=clients)
 
1997
    for client in tcp_server.clients:
 
1998
        if use_dbus:
 
1999
            # Emit D-Bus signal
 
2000
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
2001
        client.enable()
 
2002
    
 
2003
    tcp_server.enable()
 
2004
    tcp_server.server_activate()
 
2005
    
820
2006
    # Find out what port we got
821
2007
    service.port = tcp_server.socket.getsockname()[1]
822
 
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
823
 
                u" scope_id %d" % tcp_server.socket.getsockname())
 
2008
    if use_ipv6:
 
2009
        logger.info("Now listening on address %r, port %d,"
 
2010
                    " flowinfo %d, scope_id %d"
 
2011
                    % tcp_server.socket.getsockname())
 
2012
    else:                       # IPv4
 
2013
        logger.info("Now listening on address %r, port %d"
 
2014
                    % tcp_server.socket.getsockname())
824
2015
    
825
2016
    #service.interface = tcp_server.socket.getsockname()[3]
826
2017
    
827
2018
    try:
828
2019
        # From the Avahi example code
829
 
        server.connect_to_signal("StateChanged", server_state_changed)
830
2020
        try:
831
 
            server_state_changed(server.GetState())
 
2021
            service.activate()
832
2022
        except dbus.exceptions.DBusException, error:
833
 
            logger.critical(u"DBusException: %s", error)
 
2023
            logger.critical("DBusException: %s", error)
 
2024
            cleanup()
834
2025
            sys.exit(1)
835
2026
        # End of Avahi example code
836
2027
        
837
2028
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
838
2029
                             lambda *args, **kwargs:
839
 
                             tcp_server.handle_request\
840
 
                             (*args[2:], **kwargs) or True)
 
2030
                             (tcp_server.handle_request
 
2031
                              (*args[2:], **kwargs) or True))
841
2032
        
842
 
        logger.debug(u"Starting main loop")
843
 
        main_loop_started = True
 
2033
        logger.debug("Starting main loop")
844
2034
        main_loop.run()
845
2035
    except AvahiError, error:
846
 
        logger.critical(u"AvahiError: %s" + unicode(error))
 
2036
        logger.critical("AvahiError: %s", error)
 
2037
        cleanup()
847
2038
        sys.exit(1)
848
2039
    except KeyboardInterrupt:
849
2040
        if debug:
850
 
            print
 
2041
            print("", file=sys.stderr)
 
2042
        logger.debug("Server received KeyboardInterrupt")
 
2043
    logger.debug("Server exiting")
 
2044
    # Must run before the D-Bus bus name gets deregistered
 
2045
    cleanup()
851
2046
 
852
2047
if __name__ == '__main__':
853
2048
    main()