/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk
3 by Björn Påhlsson
Python based server
1
#!/usr/bin/python
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2
# -*- mode: python; coding: utf-8 -*-
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3
# 
4
# Mandos server - give out binary blobs to connecting clients.
5
# 
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
336 by Teddy Hogeborn
Code cleanup.
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
12
# 
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
466 by Teddy Hogeborn
Update copyright year to "2011" wherever appropriate.
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
16
# 
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
19
# the Free Software Foundation, either version 3 of the License, or
20
# (at your option) any later version.
21
#
22
#     This program is distributed in the hope that it will be useful,
23
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
24
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25
#     GNU General Public License for more details.
26
# 
27
# You should have received a copy of the GNU General Public License
109 by Teddy Hogeborn
* .bzrignore: New.
28
# along with this program.  If not, see
29
# <http://www.gnu.org/licenses/>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
30
# 
28 by Teddy Hogeborn
* server.conf: New file.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
32
# 
3 by Björn Påhlsson
Python based server
33
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
34
from __future__ import (division, absolute_import, print_function,
35
                        unicode_literals)
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
36
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
37
import SocketServer as socketserver
3 by Björn Påhlsson
Python based server
38
import socket
237.2.1 by Teddy Hogeborn
Merge from trunk, but disable the unfinished D-Bus feature:
39
import optparse
3 by Björn Påhlsson
Python based server
40
import datetime
41
import errno
42
import gnutls.crypto
43
import gnutls.connection
44
import gnutls.errors
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
45
import gnutls.library.functions
46
import gnutls.library.constants
47
import gnutls.library.types
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
48
import ConfigParser as configparser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
49
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
50
import re
51
import os
52
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
53
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
54
import atexit
55
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
56
import logging
57
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
58
import pwd
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
59
import contextlib
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
60
import struct
61
import fcntl
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
62
import functools
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
63
import cPickle as pickle
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
64
import multiprocessing
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
65
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
66
import dbus
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
67
import dbus.service
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
68
import gobject
69
import avahi
70
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
71
import ctypes
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
72
import ctypes.util
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
73
import xml.dom.minidom
74
import inspect
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
75
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
76
try:
77
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
78
except AttributeError:
79
    try:
80
        from IN import SO_BINDTODEVICE
81
    except ImportError:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
82
        SO_BINDTODEVICE = None
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
83
84
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
85
version = "1.2.3"
13 by Björn Påhlsson
Added following support:
86
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
89
syslogger = (logging.handlers.SysLogHandler
90
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
463.1.6 by teddy at bsnet
* mandos: Bug fix: pass str("/dev/log") to logging.SysLogHandler(),
91
              address = str("/dev/log")))
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
92
syslogger.setFormatter(logging.Formatter
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
93
                       ('Mandos [%(process)d]: %(levelname)s:'
94
                        ' %(message)s'))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
95
logger.addHandler(syslogger)
13 by Björn Påhlsson
Added following support:
96
61 by Teddy Hogeborn
* mandos (console): Define handler globally.
97
console = logging.StreamHandler()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
                                       ' %(levelname)s:'
100
                                       ' %(message)s'))
61 by Teddy Hogeborn
* mandos (console): Define handler globally.
101
logger.addHandler(console)
28 by Teddy Hogeborn
* server.conf: New file.
102
103
class AvahiError(Exception):
242 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
104
    def __init__(self, value, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
105
        self.value = value
242 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
106
        super(AvahiError, self).__init__(value, *args, **kwargs)
107
    def __unicode__(self):
108
        return unicode(repr(self.value))
28 by Teddy Hogeborn
* server.conf: New file.
109
110
class AvahiServiceError(AvahiError):
111
    pass
112
113
class AvahiGroupError(AvahiError):
114
    pass
115
116
117
class AvahiService(object):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
118
    """An Avahi (Zeroconf) service.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
119
    
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
120
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
121
    interface: integer; avahi.IF_UNSPEC or an interface index.
122
               Used to optionally bind to the specified interface.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
123
    name: string; Example: 'Mandos'
124
    type: string; Example: '_mandos._tcp'.
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
125
                  See <http://www.dns-sd.org/ServiceTypes.html>
126
    port: integer; what port to announce
127
    TXT: list of strings; TXT record for the service
128
    domain: string; Domain to publish on, default to .local if empty.
129
    host: string; Host to publish records for, default is localhost
130
    max_renames: integer; maximum number of renames
131
    rename_count: integer; counter so we only rename after collisions
132
                  a sensible number of times
336 by Teddy Hogeborn
Code cleanup.
133
    group: D-Bus Entry Group
134
    server: D-Bus Server
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
135
    bus: dbus.SystemBus()
28 by Teddy Hogeborn
* server.conf: New file.
136
    """
137
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
138
                 servicetype = None, port = None, TXT = None,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
139
                 domain = "", host = "", max_renames = 32768,
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
140
                 protocol = avahi.PROTO_UNSPEC, bus = None):
28 by Teddy Hogeborn
* server.conf: New file.
141
        self.interface = interface
142
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
143
        self.type = servicetype
28 by Teddy Hogeborn
* server.conf: New file.
144
        self.port = port
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
145
        self.TXT = TXT if TXT is not None else []
28 by Teddy Hogeborn
* server.conf: New file.
146
        self.domain = domain
147
        self.host = host
148
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
149
        self.max_renames = max_renames
314 by Teddy Hogeborn
Support not using IPv6 in server:
150
        self.protocol = protocol
336 by Teddy Hogeborn
Code cleanup.
151
        self.group = None       # our entry group
152
        self.server = None
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
153
        self.bus = bus
28 by Teddy Hogeborn
* server.conf: New file.
154
    def rename(self):
155
        """Derived from the Avahi example code"""
156
        if self.rename_count >= self.max_renames:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
157
            logger.critical("No suitable Zeroconf service name found"
158
                            " after %i retries, exiting.",
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
159
                            self.rename_count)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
160
            raise AvahiServiceError("Too many renames")
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
161
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
162
        logger.info("Changing Zeroconf service name to %r ...",
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
163
                    self.name)
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
164
        syslogger.setFormatter(logging.Formatter
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
165
                               ('Mandos (%s) [%%(process)d]:'
166
                                ' %%(levelname)s: %%(message)s'
327 by Teddy Hogeborn
Merge from pipe IPC branch.
167
                                % self.name))
28 by Teddy Hogeborn
* server.conf: New file.
168
        self.remove()
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
169
        try:
170
            self.add()
171
        except dbus.exceptions.DBusException, error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
172
            logger.critical("DBusException: %s", error)
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
173
            self.cleanup()
174
            os._exit(1)
28 by Teddy Hogeborn
* server.conf: New file.
175
        self.rename_count += 1
176
    def remove(self):
177
        """Derived from the Avahi example code"""
336 by Teddy Hogeborn
Code cleanup.
178
        if self.group is not None:
179
            self.group.Reset()
28 by Teddy Hogeborn
* server.conf: New file.
180
    def add(self):
181
        """Derived from the Avahi example code"""
336 by Teddy Hogeborn
Code cleanup.
182
        if self.group is None:
183
            self.group = dbus.Interface(
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
184
                self.bus.get_object(avahi.DBUS_NAME,
185
                                    self.server.EntryGroupNew()),
336 by Teddy Hogeborn
Code cleanup.
186
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
187
            self.group.connect_to_signal('StateChanged',
379 by Teddy Hogeborn
* mandos: Fix line lengths.
188
                                         self
189
                                         .entry_group_state_changed)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
190
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
336 by Teddy Hogeborn
Code cleanup.
191
                     self.name, self.type)
192
        self.group.AddService(
193
            self.interface,
194
            self.protocol,
195
            dbus.UInt32(0),     # flags
196
            self.name, self.type,
197
            self.domain, self.host,
198
            dbus.UInt16(self.port),
199
            avahi.string_array_to_txt_array(self.TXT))
200
        self.group.Commit()
201
    def entry_group_state_changed(self, state, error):
202
        """Derived from the Avahi example code"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
203
        logger.debug("Avahi entry group state change: %i", state)
336 by Teddy Hogeborn
Code cleanup.
204
        
205
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
206
            logger.debug("Zeroconf service established.")
336 by Teddy Hogeborn
Code cleanup.
207
        elif state == avahi.ENTRY_GROUP_COLLISION:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
208
            logger.info("Zeroconf service name collision.")
336 by Teddy Hogeborn
Code cleanup.
209
            self.rename()
210
        elif state == avahi.ENTRY_GROUP_FAILURE:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
211
            logger.critical("Avahi: Error in group state changed %s",
336 by Teddy Hogeborn
Code cleanup.
212
                            unicode(error))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
213
            raise AvahiGroupError("State changed: %s"
336 by Teddy Hogeborn
Code cleanup.
214
                                  % unicode(error))
215
    def cleanup(self):
216
        """Derived from the Avahi example code"""
217
        if self.group is not None:
218
            self.group.Free()
219
            self.group = None
220
    def server_state_changed(self, state):
221
        """Derived from the Avahi example code"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
222
        logger.debug("Avahi server state change: %i", state)
336 by Teddy Hogeborn
Code cleanup.
223
        if state == avahi.SERVER_COLLISION:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
224
            logger.error("Zeroconf server name collision")
336 by Teddy Hogeborn
Code cleanup.
225
            self.remove()
226
        elif state == avahi.SERVER_RUNNING:
227
            self.add()
228
    def activate(self):
229
        """Derived from the Avahi example code"""
230
        if self.server is None:
231
            self.server = dbus.Interface(
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
232
                self.bus.get_object(avahi.DBUS_NAME,
233
                                    avahi.DBUS_PATH_SERVER),
336 by Teddy Hogeborn
Code cleanup.
234
                avahi.DBUS_INTERFACE_SERVER)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
235
        self.server.connect_to_signal("StateChanged",
336 by Teddy Hogeborn
Code cleanup.
236
                                 self.server_state_changed)
237
        self.server_state_changed(self.server.GetState())
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
238
239
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
240
class Client(object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
241
    """A representation of a client host served by this server.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
242
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
243
    Attributes:
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
244
    _approved:   bool(); 'None' if not yet approved/disapproved
245
    approval_delay: datetime.timedelta(); Time to wait for approval
246
    approval_duration: datetime.timedelta(); Duration of one approval
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
247
    checker:    subprocess.Popen(); a running checker process used
248
                                    to see if the client lives.
249
                                    'None' if no process is running.
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
250
    checker_callback_tag: a gobject event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
251
    checker_command: string; External command which is run to check
252
                     if client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
253
                     runtime with vars(self) as dict, so that for
254
                     instance %(name)s can be used in the command.
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
255
    checker_initiator_tag: a gobject event source tag, or None
256
    created:    datetime.datetime(); (UTC) object creation
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
257
    current_checker_command: string; current running checker_command
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
258
    disable_hook:  If set, called by disable() as disable_hook(self)
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
259
    disable_initiator_tag: a gobject event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
260
    enabled:    bool()
261
    fingerprint: string (40 or 32 hexadecimal digits); used to
262
                 uniquely identify the client
263
    host:       string; available for use by the checker command
264
    interval:   datetime.timedelta(); How often to start a new checker
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
265
    last_approval_request: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
266
    last_checked_ok: datetime.datetime(); (UTC) or None
267
    last_enabled: datetime.datetime(); (UTC)
268
    name:       string; from the config file, used in log messages and
269
                        D-Bus identifiers
270
    secret:     bytestring; sent verbatim (over TLS) to client
271
    timeout:    datetime.timedelta(); How long from last_checked_ok
272
                                      until this client is disabled
273
    runtime_expansions: Allowed attributes for runtime expansion.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
274
    """
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
275
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
276
    runtime_expansions = ("approval_delay", "approval_duration",
277
                          "created", "enabled", "fingerprint",
278
                          "host", "interval", "last_checked_ok",
279
                          "last_enabled", "name", "timeout")
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
280
    
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
281
    @staticmethod
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
282
    def _timedelta_to_milliseconds(td):
283
        "Convert a datetime.timedelta() to milliseconds"
284
        return ((td.days * 24 * 60 * 60 * 1000)
285
                + (td.seconds * 1000)
286
                + (td.microseconds // 1000))
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
287
    
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
288
    def timeout_milliseconds(self):
289
        "Return the 'timeout' attribute in milliseconds"
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
290
        return self._timedelta_to_milliseconds(self.timeout)
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
291
    
292
    def interval_milliseconds(self):
293
        "Return the 'interval' attribute in milliseconds"
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
294
        return self._timedelta_to_milliseconds(self.interval)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
295
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
296
    def approval_delay_milliseconds(self):
297
        return self._timedelta_to_milliseconds(self.approval_delay)
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
298
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
299
    def __init__(self, name = None, disable_hook=None, config=None):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
300
        """Note: the 'checker' key in 'config' sets the
301
        'checker_command' attribute and *not* the 'checker'
302
        attribute."""
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
303
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
304
        if config is None:
305
            config = {}
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
306
        logger.debug("Creating client %r", self.name)
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
307
        # Uppercase and remove spaces from fingerprint for later
308
        # comparison purposes with return value from the fingerprint()
309
        # function
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
310
        self.fingerprint = (config["fingerprint"].upper()
311
                            .replace(" ", ""))
312
        logger.debug("  Fingerprint: %s", self.fingerprint)
313
        if "secret" in config:
314
            self.secret = config["secret"].decode("base64")
315
        elif "secfile" in config:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
316
            with open(os.path.expanduser(os.path.expandvars
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
317
                                         (config["secfile"])),
318
                      "rb") as secfile:
237 by Teddy Hogeborn
* mandos: Also import "with_statement" and "absolute_import" from
319
                self.secret = secfile.read()
3 by Björn Påhlsson
Python based server
320
        else:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
321
            raise TypeError("No secret or secfile for client %s"
28 by Teddy Hogeborn
* server.conf: New file.
322
                            % self.name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
323
        self.host = config.get("host", "")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
324
        self.created = datetime.datetime.utcnow()
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
325
        self.enabled = False
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
326
        self.last_approval_request = None
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
327
        self.last_enabled = None
28 by Teddy Hogeborn
* server.conf: New file.
328
        self.last_checked_ok = None
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
329
        self.timeout = string_to_delta(config["timeout"])
330
        self.interval = string_to_delta(config["interval"])
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
331
        self.disable_hook = disable_hook
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
332
        self.checker = None
333
        self.checker_initiator_tag = None
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
334
        self.disable_initiator_tag = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
335
        self.checker_callback_tag = None
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
336
        self.checker_command = config["checker"]
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
337
        self.current_checker_command = None
279 by Teddy Hogeborn
* mandos (Client.__init__): Disable D-Bus during init to avoid
338
        self.last_connect = None
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
339
        self._approved = None
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
340
        self.approved_by_default = config.get("approved_by_default",
24.2.1 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-urwid".
341
                                              True)
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
342
        self.approvals_pending = 0
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
343
        self.approval_delay = string_to_delta(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
344
            config["approval_delay"])
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
345
        self.approval_duration = string_to_delta(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
346
            config["approval_duration"])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
347
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
348
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
349
    def send_changedstate(self):
350
        self.changedstate.acquire()
351
        self.changedstate.notify_all()
352
        self.changedstate.release()
353
        
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
354
    def enable(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
355
        """Start this client's checker and timeout hooks"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
356
        if getattr(self, "enabled", False):
341 by Teddy Hogeborn
Code cleanup and one bug fix.
357
            # Already enabled
358
            return
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
359
        self.send_changedstate()
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
360
        self.last_enabled = datetime.datetime.utcnow()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
361
        # Schedule a new checker to be started an 'interval' from now,
362
        # and every interval from then on.
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
363
        self.checker_initiator_tag = (gobject.timeout_add
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
364
                                      (self.interval_milliseconds(),
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
365
                                       self.start_checker))
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
366
        # Schedule a disable() when 'timeout' has passed
367
        self.disable_initiator_tag = (gobject.timeout_add
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
368
                                   (self.timeout_milliseconds(),
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
369
                                    self.disable))
370
        self.enabled = True
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
371
        # Also start a new checker *right now*.
372
        self.start_checker()
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
373
    
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
374
    def disable(self, quiet=True):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
375
        """Disable this client."""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
376
        if not getattr(self, "enabled", False):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
377
            return False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
378
        if not quiet:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
379
            self.send_changedstate()
380
        if not quiet:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
381
            logger.info("Disabling client %s", self.name)
382
        if getattr(self, "disable_initiator_tag", False):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
383
            gobject.source_remove(self.disable_initiator_tag)
384
            self.disable_initiator_tag = None
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
385
        if getattr(self, "checker_initiator_tag", False):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
386
            gobject.source_remove(self.checker_initiator_tag)
387
            self.checker_initiator_tag = None
388
        self.stop_checker()
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
389
        if self.disable_hook:
390
            self.disable_hook(self)
391
        self.enabled = False
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
392
        # Do not run this again if called by a gobject.timeout_add
393
        return False
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
394
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
395
    def __del__(self):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
396
        self.disable_hook = None
397
        self.disable()
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
398
    
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
399
    def checker_callback(self, pid, condition, command):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
400
        """The checker has completed, so take appropriate actions."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
401
        self.checker_callback_tag = None
402
        self.checker = None
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
403
        if os.WIFEXITED(condition):
404
            exitstatus = os.WEXITSTATUS(condition)
405
            if exitstatus == 0:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
406
                logger.info("Checker for %(name)s succeeded",
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
407
                            vars(self))
281 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
408
                self.checked_ok()
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
409
            else:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
410
                logger.info("Checker for %(name)s failed",
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
411
                            vars(self))
412
        else:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
413
            logger.warning("Checker for %(name)s crashed?",
13 by Björn Påhlsson
Added following support:
414
                           vars(self))
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
415
    
281 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
416
    def checked_ok(self):
237 by Teddy Hogeborn
* mandos: Also import "with_statement" and "absolute_import" from
417
        """Bump up the timeout for this client.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
418
        
237 by Teddy Hogeborn
* mandos: Also import "with_statement" and "absolute_import" from
419
        This should only be called when the client has been seen,
420
        alive and well.
421
        """
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
422
        self.last_checked_ok = datetime.datetime.utcnow()
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
423
        gobject.source_remove(self.disable_initiator_tag)
424
        self.disable_initiator_tag = (gobject.timeout_add
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
425
                                      (self.timeout_milliseconds(),
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
426
                                       self.disable))
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
427
    
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
428
    def need_approval(self):
429
        self.last_approval_request = datetime.datetime.utcnow()
430
    
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
431
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
432
        """Start a new checker subprocess if one is not running.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
433
        
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
434
        If a checker already exists, leave it running and do
435
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
436
        # The reason for not killing a running checker is that if we
437
        # did that, then if a checker (for some reason) started
438
        # running slowly and taking more than 'interval' time, the
439
        # client would inevitably timeout, since no checker would get
440
        # a chance to run to completion.  If we instead leave running
441
        # checkers alone, the checker would have to take more time
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
442
        # than 'timeout' for the client to be disabled, which is as it
443
        # should be.
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
444
        
445
        # If a checker exists, make sure it is not a zombie
383 by Teddy Hogeborn
* mandos (Client.start_checker): Bug fix: Fix race condition with
446
        try:
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
447
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
383 by Teddy Hogeborn
* mandos (Client.start_checker): Bug fix: Fix race condition with
448
        except (AttributeError, OSError), error:
449
            if (isinstance(error, OSError)
450
                and error.errno != errno.ECHILD):
451
                raise error
452
        else:
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
453
            if pid:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
454
                logger.warning("Checker was a zombie")
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
455
                gobject.source_remove(self.checker_callback_tag)
456
                self.checker_callback(pid, status,
457
                                      self.current_checker_command)
458
        # Start a new checker if needed
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
459
        if self.checker is None:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
460
            try:
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
461
                # In case checker_command has exactly one % operator
462
                command = self.checker_command % self.host
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
463
            except TypeError:
28 by Teddy Hogeborn
* server.conf: New file.
464
                # Escape attributes for the shell
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
465
                escaped_attrs = dict(
466
                    (attr,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
467
                     re.escape(unicode(str(getattr(self, attr, "")),
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
468
                                       errors=
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
469
                                       'replace')))
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
470
                    for attr in
471
                    self.runtime_expansions)
472
13 by Björn Påhlsson
Added following support:
473
                try:
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
474
                    command = self.checker_command % escaped_attrs
13 by Björn Påhlsson
Added following support:
475
                except TypeError, error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
476
                    logger.error('Could not format string "%s":'
477
                                 ' %s', self.checker_command, error)
13 by Björn Påhlsson
Added following support:
478
                    return True # Try again later
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
479
            self.current_checker_command = command
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
480
            try:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
481
                logger.info("Starting checker %r for %s",
44 by Teddy Hogeborn
* ca.pem: Removed.
482
                            command, self.name)
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
483
                # We don't need to redirect stdout and stderr, since
484
                # in normal mode, that is already done by daemon(),
485
                # and in debug mode we don't want to.  (Stdin is
486
                # always replaced by /dev/null.)
28 by Teddy Hogeborn
* server.conf: New file.
487
                self.checker = subprocess.Popen(command,
488
                                                close_fds=True,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
489
                                                shell=True, cwd="/")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
490
                self.checker_callback_tag = (gobject.child_watch_add
491
                                             (self.checker.pid,
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
492
                                              self.checker_callback,
493
                                              data=command))
310 by Teddy Hogeborn
* mandos (Client.start_checker): Bug fix: Add extra check in case the
494
                # The checker may have completed before the gobject
495
                # watch was added.  Check for this.
496
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
497
                if pid:
498
                    gobject.source_remove(self.checker_callback_tag)
499
                    self.checker_callback(pid, status, command)
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
500
            except OSError, error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
501
                logger.error("Failed to start subprocess: %s",
13 by Björn Påhlsson
Added following support:
502
                             error)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
503
        # Re-run this periodically if run by gobject.timeout_add
504
        return True
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
505
    
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
506
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
507
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
508
        if self.checker_callback_tag:
509
            gobject.source_remove(self.checker_callback_tag)
510
            self.checker_callback_tag = None
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
511
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
512
            return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
513
        logger.debug("Stopping checker for %(name)s", vars(self))
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
514
        try:
515
            os.kill(self.checker.pid, signal.SIGTERM)
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
516
            #time.sleep(0.5)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
517
            #if self.checker.poll() is None:
518
            #    os.kill(self.checker.pid, signal.SIGKILL)
519
        except OSError, error:
28 by Teddy Hogeborn
* server.conf: New file.
520
            if error.errno != errno.ESRCH: # No such process
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
521
                raise
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
522
        self.checker = None
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
523
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
524
def dbus_service_property(dbus_interface, signature="v",
525
                          access="readwrite", byte_arrays=False):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
526
    """Decorators for marking methods of a DBusObjectWithProperties to
527
    become properties on the D-Bus.
528
    
529
    The decorated method will be called with no arguments by "Get"
530
    and with one argument by "Set".
531
    
532
    The parameters, where they are supported, are the same as
533
    dbus.service.method, except there is only "signature", since the
534
    type from Get() and the type sent to Set() is the same.
535
    """
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
536
    # Encoding deeply encoded byte arrays is not supported yet by the
537
    # "Set" method, so we fail early here:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
538
    if byte_arrays and signature != "ay":
539
        raise ValueError("Byte arrays not supported for non-'ay'"
540
                         " signature %r" % signature)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
541
    def decorator(func):
542
        func._dbus_is_property = True
543
        func._dbus_interface = dbus_interface
544
        func._dbus_signature = signature
545
        func._dbus_access = access
546
        func._dbus_name = func.__name__
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
547
        if func._dbus_name.endswith("_dbus_property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
548
            func._dbus_name = func._dbus_name[:-14]
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
549
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
550
        return func
551
    return decorator
552
553
554
class DBusPropertyException(dbus.exceptions.DBusException):
555
    """A base class for D-Bus property-related exceptions
556
    """
557
    def __unicode__(self):
558
        return unicode(str(self))
559
560
561
class DBusPropertyAccessException(DBusPropertyException):
562
    """A property's access permissions disallows an operation.
563
    """
564
    pass
565
566
567
class DBusPropertyNotFound(DBusPropertyException):
568
    """An attempt was made to access a non-existing property.
569
    """
570
    pass
571
572
573
class DBusObjectWithProperties(dbus.service.Object):
574
    """A D-Bus object with properties.
575
576
    Classes inheriting from this can use the dbus_service_property
577
    decorator to expose methods as D-Bus properties.  It exposes the
578
    standard Get(), Set(), and GetAll() methods on the D-Bus.
579
    """
580
    
581
    @staticmethod
582
    def _is_dbus_property(obj):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
583
        return getattr(obj, "_dbus_is_property", False)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
584
    
585
    def _get_all_dbus_properties(self):
586
        """Returns a generator of (name, attribute) pairs
587
        """
588
        return ((prop._dbus_name, prop)
589
                for name, prop in
590
                inspect.getmembers(self, self._is_dbus_property))
591
    
592
    def _get_dbus_property(self, interface_name, property_name):
593
        """Returns a bound method if one exists which is a D-Bus
594
        property with the specified name and interface.
595
        """
596
        for name in (property_name,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
597
                     property_name + "_dbus_property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
598
            prop = getattr(self, name, None)
599
            if (prop is None
600
                or not self._is_dbus_property(prop)
601
                or prop._dbus_name != property_name
602
                or (interface_name and prop._dbus_interface
603
                    and interface_name != prop._dbus_interface)):
604
                continue
605
            return prop
606
        # No such property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
607
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
608
                                   + interface_name + "."
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
609
                                   + property_name)
610
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
611
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
612
                         out_signature="v")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
613
    def Get(self, interface_name, property_name):
614
        """Standard D-Bus property Get() method, see D-Bus standard.
615
        """
616
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
617
        if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
618
            raise DBusPropertyAccessException(property_name)
619
        value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
620
        if not hasattr(value, "variant_level"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
621
            return value
622
        return type(value)(value, variant_level=value.variant_level+1)
623
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
624
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
625
    def Set(self, interface_name, property_name, value):
626
        """Standard D-Bus property Set() method, see D-Bus standard.
627
        """
628
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
629
        if prop._dbus_access == "read":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
630
            raise DBusPropertyAccessException(property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
631
        if prop._dbus_get_args_options["byte_arrays"]:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
632
            # The byte_arrays option is not supported yet on
633
            # signatures other than "ay".
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
634
            if prop._dbus_signature != "ay":
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
635
                raise ValueError
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
636
            value = dbus.ByteArray(''.join(unichr(byte)
637
                                           for byte in value))
638
        prop(value)
639
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
640
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
641
                         out_signature="a{sv}")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
642
    def GetAll(self, interface_name):
643
        """Standard D-Bus property GetAll() method, see D-Bus
644
        standard.
645
646
        Note: Will not include properties with access="write".
647
        """
648
        all = {}
649
        for name, prop in self._get_all_dbus_properties():
650
            if (interface_name
651
                and interface_name != prop._dbus_interface):
652
                # Interface non-empty but did not match
653
                continue
654
            # Ignore write-only properties
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
655
            if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
656
                continue
657
            value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
658
            if not hasattr(value, "variant_level"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
659
                all[name] = value
660
                continue
661
            all[name] = type(value)(value, variant_level=
662
                                    value.variant_level+1)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
663
        return dbus.Dictionary(all, signature="sv")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
664
    
665
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
666
                         out_signature="s",
667
                         path_keyword='object_path',
668
                         connection_keyword='connection')
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
669
    def Introspect(self, object_path, connection):
670
        """Standard D-Bus method, overloaded to insert property tags.
671
        """
672
        xmlstring = dbus.service.Object.Introspect(self, object_path,
386 by Teddy Hogeborn
* mandos (DBusObjectWithProperties.Introspect): Add the name
673
                                                   connection)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
674
        try:
675
            document = xml.dom.minidom.parseString(xmlstring)
676
            def make_tag(document, name, prop):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
677
                e = document.createElement("property")
678
                e.setAttribute("name", name)
679
                e.setAttribute("type", prop._dbus_signature)
680
                e.setAttribute("access", prop._dbus_access)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
681
                return e
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
682
            for if_tag in document.getElementsByTagName("interface"):
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
683
                for tag in (make_tag(document, name, prop)
684
                            for name, prop
685
                            in self._get_all_dbus_properties()
686
                            if prop._dbus_interface
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
687
                            == if_tag.getAttribute("name")):
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
688
                    if_tag.appendChild(tag)
689
                # Add the names to the return values for the
690
                # "org.freedesktop.DBus.Properties" methods
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
691
                if (if_tag.getAttribute("name")
692
                    == "org.freedesktop.DBus.Properties"):
693
                    for cn in if_tag.getElementsByTagName("method"):
694
                        if cn.getAttribute("name") == "Get":
695
                            for arg in cn.getElementsByTagName("arg"):
696
                                if (arg.getAttribute("direction")
697
                                    == "out"):
698
                                    arg.setAttribute("name", "value")
699
                        elif cn.getAttribute("name") == "GetAll":
700
                            for arg in cn.getElementsByTagName("arg"):
701
                                if (arg.getAttribute("direction")
702
                                    == "out"):
703
                                    arg.setAttribute("name", "props")
704
            xmlstring = document.toxml("utf-8")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
705
            document.unlink()
706
        except (AttributeError, xml.dom.DOMException,
707
                xml.parsers.expat.ExpatError), error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
708
            logger.error("Failed to override Introspection method",
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
709
                         error)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
710
        return xmlstring
711
712
713
class ClientDBus(Client, DBusObjectWithProperties):
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
714
    """A Client class using D-Bus
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
715
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
716
    Attributes:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
717
    dbus_object_path: dbus.ObjectPath
718
    bus: dbus.SystemBus()
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
719
    """
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
720
    
721
    runtime_expansions = (Client.runtime_expansions
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
722
                          + ("dbus_object_path",))
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
723
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
724
    # dbus.service.Object doesn't use super(), so we can't either.
725
    
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
726
    def __init__(self, bus = None, *args, **kwargs):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
727
        self._approvals_pending = 0
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
728
        self.bus = bus
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
729
        Client.__init__(self, *args, **kwargs)
730
        # Only now, when this client is initialized, can it show up on
731
        # the D-Bus
441 by Teddy Hogeborn
* mandos (ClientDBus.__init__): Bug fix: Translate "-" in client names
732
        client_object_name = unicode(self.name).translate(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
733
            {ord("."): ord("_"),
734
             ord("-"): ord("_")})
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
735
        self.dbus_object_path = (dbus.ObjectPath
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
736
                                 ("/clients/" + client_object_name))
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
737
        DBusObjectWithProperties.__init__(self, self.bus,
738
                                          self.dbus_object_path)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
739
        
24.1.154 by Björn Påhlsson
merge
740
    def _get_approvals_pending(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
741
        return self._approvals_pending
24.2.5 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Bug fix: Only send D-Bus
742
    def _set_approvals_pending(self, value):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
743
        old_value = self._approvals_pending
744
        self._approvals_pending = value
745
        bval = bool(value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
746
        if (hasattr(self, "dbus_object_path")
24.1.154 by Björn Påhlsson
merge
747
            and bval is not bool(old_value)):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
748
            dbus_bool = dbus.Boolean(bval, variant_level=1)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
749
            self.PropertyChanged(dbus.String("ApprovalPending"),
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
750
                                 dbus_bool)
24.1.154 by Björn Påhlsson
merge
751
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
752
    approvals_pending = property(_get_approvals_pending,
753
                                 _set_approvals_pending)
754
    del _get_approvals_pending, _set_approvals_pending
755
    
336 by Teddy Hogeborn
Code cleanup.
756
    @staticmethod
757
    def _datetime_to_dbus(dt, variant_level=0):
758
        """Convert a UTC datetime.datetime() to a D-Bus type."""
759
        return dbus.String(dt.isoformat(),
760
                           variant_level=variant_level)
761
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
762
    def enable(self):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
763
        oldstate = getattr(self, "enabled", False)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
764
        r = Client.enable(self)
765
        if oldstate != self.enabled:
766
            # Emit D-Bus signals
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
767
            self.PropertyChanged(dbus.String("Enabled"),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
768
                                 dbus.Boolean(True, variant_level=1))
336 by Teddy Hogeborn
Code cleanup.
769
            self.PropertyChanged(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
770
                dbus.String("LastEnabled"),
336 by Teddy Hogeborn
Code cleanup.
771
                self._datetime_to_dbus(self.last_enabled,
772
                                       variant_level=1))
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
773
        return r
774
    
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
775
    def disable(self, quiet = False):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
776
        oldstate = getattr(self, "enabled", False)
403 by Teddy Hogeborn
* mandos (ClientDBus.disable): Bug fix: complete rename of "log" and
777
        r = Client.disable(self, quiet=quiet)
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
778
        if not quiet and oldstate != self.enabled:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
779
            # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
780
            self.PropertyChanged(dbus.String("Enabled"),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
781
                                 dbus.Boolean(False, variant_level=1))
782
        return r
783
    
784
    def __del__(self, *args, **kwargs):
785
        try:
786
            self.remove_from_connection()
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
787
        except LookupError:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
788
            pass
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
789
        if hasattr(DBusObjectWithProperties, "__del__"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
790
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
791
        Client.__del__(self, *args, **kwargs)
792
    
793
    def checker_callback(self, pid, condition, command,
794
                         *args, **kwargs):
795
        self.checker_callback_tag = None
796
        self.checker = None
797
        # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
798
        self.PropertyChanged(dbus.String("CheckerRunning"),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
799
                             dbus.Boolean(False, variant_level=1))
800
        if os.WIFEXITED(condition):
801
            exitstatus = os.WEXITSTATUS(condition)
802
            # Emit D-Bus signal
803
            self.CheckerCompleted(dbus.Int16(exitstatus),
804
                                  dbus.Int64(condition),
805
                                  dbus.String(command))
806
        else:
807
            # Emit D-Bus signal
808
            self.CheckerCompleted(dbus.Int16(-1),
809
                                  dbus.Int64(condition),
810
                                  dbus.String(command))
811
        
812
        return Client.checker_callback(self, pid, condition, command,
813
                                       *args, **kwargs)
814
    
815
    def checked_ok(self, *args, **kwargs):
816
        r = Client.checked_ok(self, *args, **kwargs)
817
        # Emit D-Bus signal
818
        self.PropertyChanged(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
819
            dbus.String("LastCheckedOK"),
336 by Teddy Hogeborn
Code cleanup.
820
            (self._datetime_to_dbus(self.last_checked_ok,
821
                                    variant_level=1)))
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
822
        return r
823
    
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
824
    def need_approval(self, *args, **kwargs):
825
        r = Client.need_approval(self, *args, **kwargs)
826
        # Emit D-Bus signal
827
        self.PropertyChanged(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
828
            dbus.String("LastApprovalRequest"),
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
829
            (self._datetime_to_dbus(self.last_approval_request,
830
                                    variant_level=1)))
831
        return r
832
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
833
    def start_checker(self, *args, **kwargs):
834
        old_checker = self.checker
835
        if self.checker is not None:
836
            old_checker_pid = self.checker.pid
837
        else:
838
            old_checker_pid = None
839
        r = Client.start_checker(self, *args, **kwargs)
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
840
        # Only if new checker process was started
841
        if (self.checker is not None
842
            and old_checker_pid != self.checker.pid):
843
            # Emit D-Bus signal
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
844
            self.CheckerStarted(self.current_checker_command)
845
            self.PropertyChanged(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
846
                dbus.String("CheckerRunning"),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
847
                dbus.Boolean(True, variant_level=1))
848
        return r
849
    
850
    def stop_checker(self, *args, **kwargs):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
851
        old_checker = getattr(self, "checker", None)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
852
        r = Client.stop_checker(self, *args, **kwargs)
853
        if (old_checker is not None
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
854
            and getattr(self, "checker", None) is None):
855
            self.PropertyChanged(dbus.String("CheckerRunning"),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
856
                                 dbus.Boolean(False, variant_level=1))
857
        return r
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
858
859
    def _reset_approved(self):
860
        self._approved = None
861
        return False
862
    
863
    def approve(self, value=True):
24.1.154 by Björn Påhlsson
merge
864
        self.send_changedstate()
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
865
        self._approved = value
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
866
        gobject.timeout_add(self._timedelta_to_milliseconds
867
                            (self.approval_duration),
24.1.154 by Björn Påhlsson
merge
868
                            self._reset_approved)
24.2.1 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-urwid".
869
    
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
870
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
871
    ## D-Bus methods, signals & properties
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
872
    _interface = "se.bsnet.fukt.Mandos.Client"
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
873
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
874
    ## Signals
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
875
    
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
876
    # CheckerCompleted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
877
    @dbus.service.signal(_interface, signature="nxs")
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
878
    def CheckerCompleted(self, exitcode, waitstatus, command):
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
879
        "D-Bus signal"
880
        pass
881
    
882
    # CheckerStarted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
883
    @dbus.service.signal(_interface, signature="s")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
884
    def CheckerStarted(self, command):
885
        "D-Bus signal"
886
        pass
887
    
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
888
    # PropertyChanged - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
889
    @dbus.service.signal(_interface, signature="sv")
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
890
    def PropertyChanged(self, property, value):
891
        "D-Bus signal"
892
        pass
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
893
    
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
894
    # GotSecret - signal
327 by Teddy Hogeborn
Merge from pipe IPC branch.
895
    @dbus.service.signal(_interface)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
896
    def GotSecret(self):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
897
        """D-Bus signal
898
        Is sent after a successful transfer of secret from the Mandos
899
        server to mandos-client
900
        """
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
901
        pass
327 by Teddy Hogeborn
Merge from pipe IPC branch.
902
    
903
    # Rejected - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
904
    @dbus.service.signal(_interface, signature="s")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
905
    def Rejected(self, reason):
906
        "D-Bus signal"
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
907
        pass
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
908
    
909
    # NeedApproval - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
910
    @dbus.service.signal(_interface, signature="tb")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
911
    def NeedApproval(self, timeout, default):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
912
        "D-Bus signal"
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
913
        return self.need_approval()
327 by Teddy Hogeborn
Merge from pipe IPC branch.
914
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
915
    ## Methods
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
916
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
917
    # Approve - method
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
918
    @dbus.service.method(_interface, in_signature="b")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
919
    def Approve(self, value):
920
        self.approve(value)
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
921
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
922
    # CheckedOK - method
923
    @dbus.service.method(_interface)
924
    def CheckedOK(self):
925
        return self.checked_ok()
926
    
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
927
    # Enable - method
928
    @dbus.service.method(_interface)
929
    def Enable(self):
930
        "D-Bus method"
931
        self.enable()
932
    
933
    # StartChecker - method
934
    @dbus.service.method(_interface)
935
    def StartChecker(self):
936
        "D-Bus method"
937
        self.start_checker()
938
    
939
    # Disable - method
940
    @dbus.service.method(_interface)
941
    def Disable(self):
942
        "D-Bus method"
943
        self.disable()
944
    
945
    # StopChecker - method
946
    @dbus.service.method(_interface)
947
    def StopChecker(self):
948
        self.stop_checker()
949
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
950
    ## Properties
951
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
952
    # ApprovalPending - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
953
    @dbus_service_property(_interface, signature="b", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
954
    def ApprovalPending_dbus_property(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
955
        return dbus.Boolean(bool(self.approvals_pending))
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
956
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
957
    # ApprovedByDefault - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
958
    @dbus_service_property(_interface, signature="b",
959
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
960
    def ApprovedByDefault_dbus_property(self, value=None):
961
        if value is None:       # get
962
            return dbus.Boolean(self.approved_by_default)
963
        self.approved_by_default = bool(value)
964
        # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
965
        self.PropertyChanged(dbus.String("ApprovedByDefault"),
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
966
                             dbus.Boolean(value, variant_level=1))
967
    
968
    # ApprovalDelay - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
969
    @dbus_service_property(_interface, signature="t",
970
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
971
    def ApprovalDelay_dbus_property(self, value=None):
972
        if value is None:       # get
973
            return dbus.UInt64(self.approval_delay_milliseconds())
974
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
975
        # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
976
        self.PropertyChanged(dbus.String("ApprovalDelay"),
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
977
                             dbus.UInt64(value, variant_level=1))
978
    
979
    # ApprovalDuration - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
980
    @dbus_service_property(_interface, signature="t",
981
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
982
    def ApprovalDuration_dbus_property(self, value=None):
983
        if value is None:       # get
984
            return dbus.UInt64(self._timedelta_to_milliseconds(
985
                    self.approval_duration))
986
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
987
        # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
988
        self.PropertyChanged(dbus.String("ApprovalDuration"),
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
989
                             dbus.UInt64(value, variant_level=1))
990
    
991
    # Name - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
992
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
993
    def Name_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
994
        return dbus.String(self.name)
995
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
996
    # Fingerprint - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
997
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
998
    def Fingerprint_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
999
        return dbus.String(self.fingerprint)
1000
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1001
    # Host - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1002
    @dbus_service_property(_interface, signature="s",
1003
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1004
    def Host_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1005
        if value is None:       # get
1006
            return dbus.String(self.host)
1007
        self.host = value
1008
        # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1009
        self.PropertyChanged(dbus.String("Host"),
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1010
                             dbus.String(value, variant_level=1))
1011
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1012
    # Created - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1013
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1014
    def Created_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1015
        return dbus.String(self._datetime_to_dbus(self.created))
1016
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1017
    # LastEnabled - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1018
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1019
    def LastEnabled_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1020
        if self.last_enabled is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1021
            return dbus.String("")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1022
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
1023
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1024
    # Enabled - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1025
    @dbus_service_property(_interface, signature="b",
1026
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1027
    def Enabled_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1028
        if value is None:       # get
1029
            return dbus.Boolean(self.enabled)
1030
        if value:
1031
            self.enable()
1032
        else:
1033
            self.disable()
1034
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1035
    # LastCheckedOK - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1036
    @dbus_service_property(_interface, signature="s",
1037
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1038
    def LastCheckedOK_dbus_property(self, value=None):
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1039
        if value is not None:
1040
            self.checked_ok()
1041
            return
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1042
        if self.last_checked_ok is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1043
            return dbus.String("")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1044
        return dbus.String(self._datetime_to_dbus(self
1045
                                                  .last_checked_ok))
1046
    
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1047
    # LastApprovalRequest - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1048
    @dbus_service_property(_interface, signature="s", access="read")
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1049
    def LastApprovalRequest_dbus_property(self):
1050
        if self.last_approval_request is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1051
            return dbus.String("")
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1052
        return dbus.String(self.
1053
                           _datetime_to_dbus(self
1054
                                             .last_approval_request))
1055
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1056
    # Timeout - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1057
    @dbus_service_property(_interface, signature="t",
1058
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1059
    def Timeout_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1060
        if value is None:       # get
1061
            return dbus.UInt64(self.timeout_milliseconds())
1062
        self.timeout = datetime.timedelta(0, 0, 0, value)
1063
        # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1064
        self.PropertyChanged(dbus.String("Timeout"),
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1065
                             dbus.UInt64(value, variant_level=1))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1066
        if getattr(self, "disable_initiator_tag", None) is None:
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1067
            return
1068
        # Reschedule timeout
1069
        gobject.source_remove(self.disable_initiator_tag)
1070
        self.disable_initiator_tag = None
1071
        time_to_die = (self.
1072
                       _timedelta_to_milliseconds((self
1073
                                                   .last_checked_ok
1074
                                                   + self.timeout)
1075
                                                  - datetime.datetime
1076
                                                  .utcnow()))
1077
        if time_to_die <= 0:
1078
            # The timeout has passed
1079
            self.disable()
1080
        else:
1081
            self.disable_initiator_tag = (gobject.timeout_add
1082
                                          (time_to_die, self.disable))
1083
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1084
    # Interval - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1085
    @dbus_service_property(_interface, signature="t",
1086
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1087
    def Interval_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1088
        if value is None:       # get
1089
            return dbus.UInt64(self.interval_milliseconds())
1090
        self.interval = datetime.timedelta(0, 0, 0, value)
1091
        # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1092
        self.PropertyChanged(dbus.String("Interval"),
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1093
                             dbus.UInt64(value, variant_level=1))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1094
        if getattr(self, "checker_initiator_tag", None) is None:
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1095
            return
1096
        # Reschedule checker run
1097
        gobject.source_remove(self.checker_initiator_tag)
1098
        self.checker_initiator_tag = (gobject.timeout_add
1099
                                      (value, self.start_checker))
1100
        self.start_checker()    # Start one now, too
1101
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1102
    # Checker - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1103
    @dbus_service_property(_interface, signature="s",
1104
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1105
    def Checker_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1106
        if value is None:       # get
1107
            return dbus.String(self.checker_command)
1108
        self.checker_command = value
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1109
        # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1110
        self.PropertyChanged(dbus.String("Checker"),
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1111
                             dbus.String(self.checker_command,
1112
                                         variant_level=1))
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1113
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1114
    # CheckerRunning - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1115
    @dbus_service_property(_interface, signature="b",
1116
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1117
    def CheckerRunning_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1118
        if value is None:       # get
1119
            return dbus.Boolean(self.checker is not None)
1120
        if value:
1121
            self.start_checker()
1122
        else:
1123
            self.stop_checker()
1124
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1125
    # ObjectPath - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1126
    @dbus_service_property(_interface, signature="o", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1127
    def ObjectPath_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1128
        return self.dbus_object_path # is already a dbus.ObjectPath
1129
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1130
    # Secret = property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1131
    @dbus_service_property(_interface, signature="ay",
1132
                           access="write", byte_arrays=True)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1133
    def Secret_dbus_property(self, value):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1134
        self.secret = str(value)
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1135
    
1136
    del _interface
3 by Björn Påhlsson
Python based server
1137
1138
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1139
class ProxyClient(object):
1140
    def __init__(self, child_pipe, fpr, address):
1141
        self._pipe = child_pipe
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1142
        self._pipe.send(('init', fpr, address))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1143
        if not self._pipe.recv():
1144
            raise KeyError()
1145
1146
    def __getattribute__(self, name):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1147
        if(name == '_pipe'):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1148
            return super(ProxyClient, self).__getattribute__(name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1149
        self._pipe.send(('getattr', name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1150
        data = self._pipe.recv()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1151
        if data[0] == 'data':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1152
            return data[1]
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1153
        if data[0] == 'function':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1154
            def func(*args, **kwargs):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1155
                self._pipe.send(('funcall', name, args, kwargs))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1156
                return self._pipe.recv()[1]
1157
            return func
1158
1159
    def __setattr__(self, name, value):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1160
        if(name == '_pipe'):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1161
            return super(ProxyClient, self).__setattr__(name, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1162
        self._pipe.send(('setattr', name, value))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1163
1164
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1165
class ClientHandler(socketserver.BaseRequestHandler, object):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1166
    """A class to handle client connections.
1167
    
1168
    Instantiated once for each connection to handle it.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1169
    Note: This will run in its own forked process."""
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1170
    
3 by Björn Påhlsson
Python based server
1171
    def handle(self):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1172
        with contextlib.closing(self.server.child_pipe) as child_pipe:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1173
            logger.info("TCP connection from: %s",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1174
                        unicode(self.client_address))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1175
            logger.debug("Pipe FD: %d",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1176
                         self.server.child_pipe.fileno())
1177
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1178
            session = (gnutls.connection
1179
                       .ClientSession(self.request,
1180
                                      gnutls.connection
1181
                                      .X509Credentials()))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1182
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1183
            # Note: gnutls.connection.X509Credentials is really a
1184
            # generic GnuTLS certificate credentials object so long as
1185
            # no X.509 keys are added to it.  Therefore, we can use it
1186
            # here despite using OpenPGP certificates.
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1187
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1188
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1189
            #                      "+AES-256-CBC", "+SHA1",
1190
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1191
            #                      "+DHE-DSS"))
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1192
            # Use a fallback default, since this MUST be set.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1193
            priority = self.server.gnutls_priority
1194
            if priority is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1195
                priority = "NORMAL"
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1196
            (gnutls.library.functions
1197
             .gnutls_priority_set_direct(session._c_object,
1198
                                         priority, None))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1199
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1200
            # Start communication using the Mandos protocol
1201
            # Get protocol number
1202
            line = self.request.makefile().readline()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1203
            logger.debug("Protocol version: %r", line)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1204
            try:
1205
                if int(line.strip().split()[0]) > 1:
1206
                    raise RuntimeError
1207
            except (ValueError, IndexError, RuntimeError), error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1208
                logger.error("Unknown protocol version: %s", error)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1209
                return
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1210
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1211
            # Start GnuTLS connection
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1212
            try:
1213
                session.handshake()
1214
            except gnutls.errors.GNUTLSError, error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1215
                logger.warning("Handshake failed: %s", error)
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1216
                # Do not run session.bye() here: the session is not
1217
                # established.  Just abandon the request.
1218
                return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1219
            logger.debug("Handshake succeeded")
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1220
1221
            approval_required = False
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1222
            try:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1223
                try:
1224
                    fpr = self.fingerprint(self.peer_certificate
1225
                                           (session))
1226
                except (TypeError, gnutls.errors.GNUTLSError), error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1227
                    logger.warning("Bad certificate: %s", error)
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1228
                    return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1229
                logger.debug("Fingerprint: %s", fpr)
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1230
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1231
                try:
1232
                    client = ProxyClient(child_pipe, fpr,
1233
                                         self.client_address)
1234
                except KeyError:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1235
                    return
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1236
                
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1237
                if client.approval_delay:
1238
                    delay = client.approval_delay
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1239
                    client.approvals_pending += 1
1240
                    approval_required = True
1241
                
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
1242
                while True:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1243
                    if not client.enabled:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1244
                        logger.warning("Client %s is disabled",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1245
                                       client.name)
1246
                        if self.server.use_dbus:
1247
                            # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1248
                            client.Rejected("Disabled")                    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1249
                        return
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1250
                    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1251
                    if client._approved or not client.approval_delay:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1252
                        #We are approved or approval is disabled
1253
                        break
1254
                    elif client._approved is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1255
                        logger.info("Client %s needs approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1256
                                    client.name)
1257
                        if self.server.use_dbus:
1258
                            # Emit D-Bus signal
1259
                            client.NeedApproval(
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1260
                                client.approval_delay_milliseconds(),
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1261
                                client.approved_by_default)
1262
                    else:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1263
                        logger.warning("Client %s was not approved",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1264
                                       client.name)
1265
                        if self.server.use_dbus:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1266
                            # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1267
                            client.Rejected("Denied")
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
1268
                        return
1269
                    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1270
                    #wait until timeout or approved
1271
                    #x = float(client._timedelta_to_milliseconds(delay))
1272
                    time = datetime.datetime.now()
1273
                    client.changedstate.acquire()
1274
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1275
                    client.changedstate.release()
1276
                    time2 = datetime.datetime.now()
1277
                    if (time2 - time) >= delay:
1278
                        if not client.approved_by_default:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1279
                            logger.warning("Client %s timed out while"
1280
                                           " waiting for approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1281
                                           client.name)
1282
                            if self.server.use_dbus:
1283
                                # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1284
                                client.Rejected("Approval timed out")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1285
                            return
1286
                        else:
1287
                            break
1288
                    else:
1289
                        delay -= time2 - time
1290
                
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1291
                sent_size = 0
1292
                while sent_size < len(client.secret):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1293
                    try:
1294
                        sent = session.send(client.secret[sent_size:])
1295
                    except (gnutls.errors.GNUTLSError), error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1296
                        logger.warning("gnutls send failed")
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1297
                        return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1298
                    logger.debug("Sent: %d, remaining: %d",
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1299
                                 sent, len(client.secret)
1300
                                 - (sent_size + sent))
1301
                    sent_size += sent
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1302
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1303
                logger.info("Sending secret to %s", client.name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1304
                # bump the timeout as if seen
1305
                client.checked_ok()
1306
                if self.server.use_dbus:
1307
                    # Emit D-Bus signal
1308
                    client.GotSecret()
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1309
            
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1310
            finally:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1311
                if approval_required:
1312
                    client.approvals_pending -= 1
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1313
                try:
1314
                    session.bye()
1315
                except (gnutls.errors.GNUTLSError), error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1316
                    logger.warning("GnuTLS bye failed")
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1317
    
1318
    @staticmethod
1319
    def peer_certificate(session):
1320
        "Return the peer's OpenPGP certificate as a bytestring"
1321
        # If not an OpenPGP certificate...
1322
        if (gnutls.library.functions
1323
            .gnutls_certificate_type_get(session._c_object)
1324
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1325
            # ...do the normal thing
1326
            return session.peer_certificate
1327
        list_size = ctypes.c_uint(1)
1328
        cert_list = (gnutls.library.functions
1329
                     .gnutls_certificate_get_peers
1330
                     (session._c_object, ctypes.byref(list_size)))
1331
        if not bool(cert_list) and list_size.value != 0:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1332
            raise gnutls.errors.GNUTLSError("error getting peer"
1333
                                            " certificate")
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1334
        if list_size.value == 0:
1335
            return None
1336
        cert = cert_list[0]
1337
        return ctypes.string_at(cert.data, cert.size)
1338
    
1339
    @staticmethod
1340
    def fingerprint(openpgp):
1341
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1342
        # New GnuTLS "datum" with the OpenPGP public key
1343
        datum = (gnutls.library.types
1344
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1345
                                             ctypes.POINTER
1346
                                             (ctypes.c_ubyte)),
1347
                                 ctypes.c_uint(len(openpgp))))
1348
        # New empty GnuTLS certificate
1349
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1350
        (gnutls.library.functions
1351
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1352
        # Import the OpenPGP public key into the certificate
1353
        (gnutls.library.functions
1354
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1355
                                    gnutls.library.constants
1356
                                    .GNUTLS_OPENPGP_FMT_RAW))
1357
        # Verify the self signature in the key
1358
        crtverify = ctypes.c_uint()
1359
        (gnutls.library.functions
1360
         .gnutls_openpgp_crt_verify_self(crt, 0,
1361
                                         ctypes.byref(crtverify)))
1362
        if crtverify.value != 0:
1363
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1364
            raise (gnutls.errors.CertificateSecurityError
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1365
                   ("Verify failed"))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1366
        # New buffer for the fingerprint
1367
        buf = ctypes.create_string_buffer(20)
1368
        buf_len = ctypes.c_size_t()
1369
        # Get the fingerprint from the certificate into the buffer
1370
        (gnutls.library.functions
1371
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1372
                                             ctypes.byref(buf_len)))
1373
        # Deinit the certificate
1374
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1375
        # Convert the buffer to a Python bytestring
1376
        fpr = ctypes.string_at(buf, buf_len.value)
1377
        # Convert the bytestring to hexadecimal notation
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1378
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1379
        return hex_fpr
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1380
1381
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1382
class MultiprocessingMixIn(object):
1383
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1384
    def sub_process_main(self, request, address):
1385
        try:
1386
            self.finish_request(request, address)
1387
        except:
1388
            self.handle_error(request, address)
1389
        self.close_request(request)
1390
            
1391
    def process_request(self, request, address):
1392
        """Start a new process to process the request."""
1393
        multiprocessing.Process(target = self.sub_process_main,
1394
                                args = (request, address)).start()
1395
1396
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1397
    """ adds a pipe to the MixIn """
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1398
    def process_request(self, request, client_address):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1399
        """Overrides and wraps the original process_request().
1400
        
355 by Teddy Hogeborn
* mandos: White-space fixes only.
1401
        This function creates a new pipe in self.pipe
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1402
        """
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1403
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1404
1405
        super(MultiprocessingMixInWithPipe,
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1406
              self).process_request(request, client_address)
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
1407
        self.child_pipe.close()
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1408
        self.add_pipe(parent_pipe)
24.1.154 by Björn Påhlsson
merge
1409
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1410
    def add_pipe(self, parent_pipe):
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1411
        """Dummy function; override as necessary"""
464 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
1412
        raise NotImplementedError
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1413
1414
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1415
                     socketserver.TCPServer, object):
237.2.13 by Teddy Hogeborn
Merge from trunk. Notable changes:
1416
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1417
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1418
    Attributes:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1419
        enabled:        Boolean; whether this server is activated yet
1420
        interface:      None or a network interface name (string)
1421
        use_ipv6:       Boolean; to use IPv6 or not
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1422
    """
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1423
    def __init__(self, server_address, RequestHandlerClass,
339 by Teddy Hogeborn
Code cleanup.
1424
                 interface=None, use_ipv6=True):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1425
        self.interface = interface
1426
        if use_ipv6:
1427
            self.address_family = socket.AF_INET6
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1428
        socketserver.TCPServer.__init__(self, server_address,
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1429
                                        RequestHandlerClass)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1430
    def server_bind(self):
1431
        """This overrides the normal server_bind() function
1432
        to bind to an interface if one was specified, and also NOT to
1433
        bind to an address or port if they were not specified."""
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1434
        if self.interface is not None:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1435
            if SO_BINDTODEVICE is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1436
                logger.error("SO_BINDTODEVICE does not exist;"
1437
                             " cannot bind to interface %s",
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1438
                             self.interface)
1439
            else:
1440
                try:
1441
                    self.socket.setsockopt(socket.SOL_SOCKET,
1442
                                           SO_BINDTODEVICE,
1443
                                           str(self.interface
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1444
                                               + '\0'))
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1445
                except socket.error, error:
1446
                    if error[0] == errno.EPERM:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1447
                        logger.error("No permission to"
1448
                                     " bind to interface %s",
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1449
                                     self.interface)
1450
                    elif error[0] == errno.ENOPROTOOPT:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1451
                        logger.error("SO_BINDTODEVICE not available;"
1452
                                     " cannot bind to interface %s",
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1453
                                     self.interface)
1454
                    else:
1455
                        raise
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1456
        # Only bind(2) the socket if we really need to.
1457
        if self.server_address[0] or self.server_address[1]:
1458
            if not self.server_address[0]:
314 by Teddy Hogeborn
Support not using IPv6 in server:
1459
                if self.address_family == socket.AF_INET6:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1460
                    any_address = "::" # in6addr_any
314 by Teddy Hogeborn
Support not using IPv6 in server:
1461
                else:
1462
                    any_address = socket.INADDR_ANY
1463
                self.server_address = (any_address,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1464
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
1465
            elif not self.server_address[1]:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1466
                self.server_address = (self.server_address[0],
1467
                                       0)
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1468
#                 if self.interface:
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
1469
#                     self.server_address = (self.server_address[0],
1470
#                                            0, # port
1471
#                                            0, # flowinfo
1472
#                                            if_nametoindex
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1473
#                                            (self.interface))
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1474
            return socketserver.TCPServer.server_bind(self)
339 by Teddy Hogeborn
Code cleanup.
1475
1476
1477
class MandosServer(IPv6_TCPServer):
1478
    """Mandos server.
1479
    
1480
    Attributes:
1481
        clients:        set of Client objects
1482
        gnutls_priority GnuTLS priority string
1483
        use_dbus:       Boolean; to emit D-Bus signals or not
340 by Teddy Hogeborn
Code cleanup.
1484
    
1485
    Assumes a gobject.MainLoop event loop.
339 by Teddy Hogeborn
Code cleanup.
1486
    """
1487
    def __init__(self, server_address, RequestHandlerClass,
1488
                 interface=None, use_ipv6=True, clients=None,
1489
                 gnutls_priority=None, use_dbus=True):
1490
        self.enabled = False
1491
        self.clients = clients
341 by Teddy Hogeborn
Code cleanup and one bug fix.
1492
        if self.clients is None:
1493
            self.clients = set()
339 by Teddy Hogeborn
Code cleanup.
1494
        self.use_dbus = use_dbus
1495
        self.gnutls_priority = gnutls_priority
1496
        IPv6_TCPServer.__init__(self, server_address,
1497
                                RequestHandlerClass,
1498
                                interface = interface,
1499
                                use_ipv6 = use_ipv6)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
1500
    def server_activate(self):
1501
        if self.enabled:
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1502
            return socketserver.TCPServer.server_activate(self)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
1503
    def enable(self):
1504
        self.enabled = True
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1505
    def add_pipe(self, parent_pipe):
340 by Teddy Hogeborn
Code cleanup.
1506
        # Call "handle_ipc" for both data and EOF events
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1507
        gobject.io_add_watch(parent_pipe.fileno(),
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1508
                             gobject.IO_IN | gobject.IO_HUP,
1509
                             functools.partial(self.handle_ipc,
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1510
                                               parent_pipe = parent_pipe))
1511
        
1512
    def handle_ipc(self, source, condition, parent_pipe=None,
1513
                   client_object=None):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1514
        condition_names = {
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1515
            gobject.IO_IN: "IN",   # There is data to read.
1516
            gobject.IO_OUT: "OUT", # Data can be written (without
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
1517
                                    # blocking).
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1518
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1519
            gobject.IO_ERR: "ERR", # Error condition.
1520
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
1521
                                    # broken, usually for pipes and
1522
                                    # sockets).
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1523
            }
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1524
        conditions_string = ' | '.join(name
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1525
                                       for cond, name in
1526
                                       condition_names.iteritems()
1527
                                       if cond & condition)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1528
        # error or the other end of multiprocessing.Pipe has closed
1529
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
1530
            return False
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1531
        
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1532
        # Read a request from the child
1533
        request = parent_pipe.recv()
1534
        command = request[0]
1535
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1536
        if command == 'init':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1537
            fpr = request[1]
1538
            address = request[2]
1539
            
1540
            for c in self.clients:
1541
                if c.fingerprint == fpr:
1542
                    client = c
1543
                    break
1544
            else:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1545
                logger.warning("Client not found for fingerprint: %s, ad"
1546
                               "dress: %s", fpr, address)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1547
                if self.use_dbus:
1548
                    # Emit D-Bus signal
441 by Teddy Hogeborn
* mandos (ClientDBus.__init__): Bug fix: Translate "-" in client names
1549
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1550
                parent_pipe.send(False)
1551
                return False
1552
            
1553
            gobject.io_add_watch(parent_pipe.fileno(),
1554
                                 gobject.IO_IN | gobject.IO_HUP,
1555
                                 functools.partial(self.handle_ipc,
1556
                                                   parent_pipe = parent_pipe,
1557
                                                   client_object = client))
1558
            parent_pipe.send(True)
1559
            # remove the old hook in favor of the new above hook on same fileno
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1560
            return False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1561
        if command == 'funcall':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1562
            funcname = request[1]
1563
            args = request[2]
1564
            kwargs = request[3]
1565
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1566
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1567
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1568
        if command == 'getattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1569
            attrname = request[1]
1570
            if callable(client_object.__getattribute__(attrname)):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1571
                parent_pipe.send(('function',))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1572
            else:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1573
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1574
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1575
        if command == 'setattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1576
            attrname = request[1]
1577
            value = request[2]
1578
            setattr(client_object, attrname, value)
24.1.154 by Björn Påhlsson
merge
1579
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1580
        return True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
1581
3 by Björn Påhlsson
Python based server
1582
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
1583
def string_to_delta(interval):
1584
    """Parse a string and return a datetime.timedelta
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
1585
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1586
    >>> string_to_delta('7d')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
1587
    datetime.timedelta(7)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1588
    >>> string_to_delta('60s')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
1589
    datetime.timedelta(0, 60)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1590
    >>> string_to_delta('60m')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
1591
    datetime.timedelta(0, 3600)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1592
    >>> string_to_delta('24h')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
1593
    datetime.timedelta(1)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1594
    >>> string_to_delta('1w')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
1595
    datetime.timedelta(7)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1596
    >>> string_to_delta('5m 30s')
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
1597
    datetime.timedelta(0, 330)
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
1598
    """
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
1599
    timevalue = datetime.timedelta(0)
1600
    for s in interval.split():
1601
        try:
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
1602
            suffix = unicode(s[-1])
1603
            value = int(s[:-1])
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1604
            if suffix == "d":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
1605
                delta = datetime.timedelta(value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1606
            elif suffix == "s":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
1607
                delta = datetime.timedelta(0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1608
            elif suffix == "m":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
1609
                delta = datetime.timedelta(0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1610
            elif suffix == "h":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
1611
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1612
            elif suffix == "w":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
1613
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1614
            else:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1615
                raise ValueError("Unknown suffix %r" % suffix)
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
1616
        except (ValueError, IndexError), e:
464 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
1617
            raise ValueError(*(e.args))
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
1618
        timevalue += delta
1619
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
1620
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
1621
24.1.13 by Björn Påhlsson
mandosclient
1622
def if_nametoindex(interface):
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
1623
    """Call the C function if_nametoindex(), or equivalent
1624
    
1625
    Note: This function cannot accept a unicode string."""
24.1.13 by Björn Påhlsson
mandosclient
1626
    global if_nametoindex
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1627
    try:
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1628
        if_nametoindex = (ctypes.cdll.LoadLibrary
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1629
                          (ctypes.util.find_library("c"))
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1630
                          .if_nametoindex)
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1631
    except (OSError, AttributeError):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1632
        logger.warning("Doing if_nametoindex the hard way")
24.1.13 by Björn Påhlsson
mandosclient
1633
        def if_nametoindex(interface):
28 by Teddy Hogeborn
* server.conf: New file.
1634
            "Get an interface index the hard way, i.e. using fcntl()"
1635
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1636
            with contextlib.closing(socket.socket()) as s:
237 by Teddy Hogeborn
* mandos: Also import "with_statement" and "absolute_import" from
1637
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1638
                                    struct.pack(str("16s16x"),
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
1639
                                                interface))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1640
            interface_index = struct.unpack(str("I"),
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
1641
                                            ifreq[16:20])[0]
28 by Teddy Hogeborn
* server.conf: New file.
1642
            return interface_index
24.1.13 by Björn Påhlsson
mandosclient
1643
    return if_nametoindex(interface)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1644
1645
47 by Teddy Hogeborn
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
1646
def daemon(nochdir = False, noclose = False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
1647
    """See daemon(3).  Standard BSD Unix function.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1648
    
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
1649
    This should really exist as os.daemon, but it doesn't (yet)."""
1650
    if os.fork():
1651
        sys.exit()
1652
    os.setsid()
1653
    if not nochdir:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1654
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
1655
    if os.fork():
1656
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
1657
    if not noclose:
1658
        # Close all standard open file descriptors
28 by Teddy Hogeborn
* server.conf: New file.
1659
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
1660
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1661
            raise OSError(errno.ENODEV,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1662
                          "%s not a character device"
388 by Teddy Hogeborn
* mandos (daemon): Use "os.path.devnull" in the error message.
1663
                          % os.path.devnull)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
1664
        os.dup2(null, sys.stdin.fileno())
1665
        os.dup2(null, sys.stdout.fileno())
1666
        os.dup2(null, sys.stderr.fileno())
1667
        if null > 2:
1668
            os.close(null)
1669
1670
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1671
def main():
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1672
    
379 by Teddy Hogeborn
* mandos: Fix line lengths.
1673
    ##################################################################
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1674
    # Parsing of options, both command line and config file
1675
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1676
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1677
    parser.add_option("-i", "--interface", type="string",
1678
                      metavar="IF", help="Bind to interface IF")
1679
    parser.add_option("-a", "--address", type="string",
1680
                      help="Address to listen for requests on")
1681
    parser.add_option("-p", "--port", type="int",
1682
                      help="Port number to receive requests on")
1683
    parser.add_option("--check", action="store_true",
1684
                      help="Run self-test")
1685
    parser.add_option("--debug", action="store_true",
1686
                      help="Debug mode; run in foreground and log to"
1687
                      " terminal")
1688
    parser.add_option("--debuglevel", type="string", metavar="LEVEL",
1689
                      help="Debug level for stdout output")
1690
    parser.add_option("--priority", type="string", help="GnuTLS"
1691
                      " priority string (see GnuTLS documentation)")
1692
    parser.add_option("--servicename", type="string",
1693
                      metavar="NAME", help="Zeroconf service name")
1694
    parser.add_option("--configdir", type="string",
1695
                      default="/etc/mandos", metavar="DIR",
1696
                      help="Directory to search for configuration"
1697
                      " files")
1698
    parser.add_option("--no-dbus", action="store_false",
1699
                      dest="use_dbus", help="Do not provide D-Bus"
1700
                      " system bus interface")
1701
    parser.add_option("--no-ipv6", action="store_false",
1702
                      dest="use_ipv6", help="Do not use IPv6")
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
1703
    options = parser.parse_args()[0]
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1704
    
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
1705
    if options.check:
1706
        import doctest
1707
        doctest.testmod()
1708
        sys.exit()
3 by Björn Påhlsson
Python based server
1709
    
28 by Teddy Hogeborn
* server.conf: New file.
1710
    # Default values for config file for server-global settings
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1711
    server_defaults = { "interface": "",
1712
                        "address": "",
1713
                        "port": "",
1714
                        "debug": "False",
1715
                        "priority":
1716
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1717
                        "servicename": "Mandos",
1718
                        "use_dbus": "True",
1719
                        "use_ipv6": "True",
1720
                        "debuglevel": "",
28 by Teddy Hogeborn
* server.conf: New file.
1721
                        }
1722
    
1723
    # Parse config file for server-global settings
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1724
    server_config = configparser.SafeConfigParser(server_defaults)
28 by Teddy Hogeborn
* server.conf: New file.
1725
    del server_defaults
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
1726
    server_config.read(os.path.join(options.configdir,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1727
                                    "mandos.conf"))
28 by Teddy Hogeborn
* server.conf: New file.
1728
    # Convert the SafeConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
1729
    server_settings = server_config.defaults()
282 by Teddy Hogeborn
* mandos (main): Bug fix: use "getint" on the "port" config file
1730
    # Use the appropriate methods on the non-string config options
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1731
    for option in ("debug", "use_dbus", "use_ipv6"):
1732
        server_settings[option] = server_config.getboolean("DEFAULT",
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
1733
                                                           option)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1734
    if server_settings["port"]:
1735
        server_settings["port"] = server_config.getint("DEFAULT",
1736
                                                       "port")
28 by Teddy Hogeborn
* server.conf: New file.
1737
    del server_config
1738
    
1739
    # Override the settings from the config file with command line
1740
    # options, if set.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1741
    for option in ("interface", "address", "port", "debug",
1742
                   "priority", "servicename", "configdir",
1743
                   "use_dbus", "use_ipv6", "debuglevel"):
28 by Teddy Hogeborn
* server.conf: New file.
1744
        value = getattr(options, option)
1745
        if value is not None:
1746
            server_settings[option] = value
1747
    del options
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
1748
    # Force all strings to be unicode
1749
    for option in server_settings.keys():
1750
        if type(server_settings[option]) is str:
1751
            server_settings[option] = unicode(server_settings[option])
28 by Teddy Hogeborn
* server.conf: New file.
1752
    # Now we have our good server settings in "server_settings"
1753
    
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1754
    ##################################################################
1755
    
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1756
    # For convenience
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1757
    debug = server_settings["debug"]
1758
    debuglevel = server_settings["debuglevel"]
1759
    use_dbus = server_settings["use_dbus"]
1760
    use_ipv6 = server_settings["use_ipv6"]
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1761
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1762
    if server_settings["servicename"] != "Mandos":
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1763
        syslogger.setFormatter(logging.Formatter
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1764
                               ('Mandos (%s) [%%(process)d]:'
1765
                                ' %%(levelname)s: %%(message)s'
1766
                                % server_settings["servicename"]))
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
1767
    
28 by Teddy Hogeborn
* server.conf: New file.
1768
    # Parse config file with clients
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1769
    client_defaults = { "timeout": "1h",
1770
                        "interval": "5m",
1771
                        "checker": "fping -q -- %%(host)s",
1772
                        "host": "",
1773
                        "approval_delay": "0s",
1774
                        "approval_duration": "1s",
28 by Teddy Hogeborn
* server.conf: New file.
1775
                        }
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1776
    client_config = configparser.SafeConfigParser(client_defaults)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1777
    client_config.read(os.path.join(server_settings["configdir"],
1778
                                    "clients.conf"))
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
1779
    
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1780
    global mandos_dbus_service
1781
    mandos_dbus_service = None
28 by Teddy Hogeborn
* server.conf: New file.
1782
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1783
    tcp_server = MandosServer((server_settings["address"],
1784
                               server_settings["port"]),
339 by Teddy Hogeborn
Code cleanup.
1785
                              ClientHandler,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1786
                              interface=(server_settings["interface"]
237.2.35 by teddy at bsnet
* mandos (main): Bug fix: Don't try to bind to an empty string
1787
                                         or None),
339 by Teddy Hogeborn
Code cleanup.
1788
                              use_ipv6=use_ipv6,
1789
                              gnutls_priority=
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1790
                              server_settings["priority"],
339 by Teddy Hogeborn
Code cleanup.
1791
                              use_dbus=use_dbus)
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
1792
    if not debug:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1793
        pidfilename = "/var/run/mandos.pid"
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
1794
        try:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1795
            pidfile = open(pidfilename, "w")
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
1796
        except IOError:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1797
            logger.error("Could not open file %r", pidfilename)
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
1798
    
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1799
    try:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1800
        uid = pwd.getpwnam("_mandos").pw_uid
1801
        gid = pwd.getpwnam("_mandos").pw_gid
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1802
    except KeyError:
1803
        try:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1804
            uid = pwd.getpwnam("mandos").pw_uid
1805
            gid = pwd.getpwnam("mandos").pw_gid
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1806
        except KeyError:
1807
            try:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1808
                uid = pwd.getpwnam("nobody").pw_uid
1809
                gid = pwd.getpwnam("nobody").pw_gid
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1810
            except KeyError:
1811
                uid = 65534
1812
                gid = 65534
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
1813
    try:
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
1814
        os.setgid(gid)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
1815
        os.setuid(uid)
1816
    except OSError, error:
1817
        if error[0] != errno.EPERM:
1818
            raise error
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
1819
    
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1820
    if not debug and not debuglevel:
1821
        syslogger.setLevel(logging.WARNING)
1822
        console.setLevel(logging.WARNING)
1823
    if debuglevel:
1824
        level = getattr(logging, debuglevel.upper())
1825
        syslogger.setLevel(level)
1826
        console.setLevel(level)
1827
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
1828
    if debug:
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1829
        # Enable all possible GnuTLS debugging
1830
        
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
1831
        # "Use a log level over 10 to enable all debugging options."
1832
        # - GnuTLS manual
1833
        gnutls.library.functions.gnutls_global_set_log_level(11)
1834
        
1835
        @gnutls.library.types.gnutls_log_func
1836
        def debug_gnutls(level, string):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1837
            logger.debug("GnuTLS: %s", string[:-1])
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
1838
        
1839
        (gnutls.library.functions
1840
         .gnutls_global_set_log_function(debug_gnutls))
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1841
        
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1842
        # Redirect stdin so all checkers get /dev/null
1843
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1844
        os.dup2(null, sys.stdin.fileno())
1845
        if null > 2:
1846
            os.close(null)
1847
    else:
1848
        # No console logging
1849
        logger.removeHandler(console)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1850
    
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
1851
    # Need to fork before connecting to D-Bus
1852
    if not debug:
1853
        # Close all input and output, do double fork, etc.
1854
        daemon()
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
1855
    
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1856
    global main_loop
1857
    # From the Avahi example code
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1858
    DBusGMainLoop(set_as_default=True )
1859
    main_loop = gobject.MainLoop()
1860
    bus = dbus.SystemBus()
1861
    # End of Avahi example code
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1862
    if use_dbus:
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1863
        try:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1864
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1865
                                            bus, do_not_queue=True)
1866
        except dbus.exceptions.NameExistsException, e:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1867
            logger.error(unicode(e) + ", disabling D-Bus")
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1868
            use_dbus = False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1869
            server_settings["use_dbus"] = False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1870
            tcp_server.use_dbus = False
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
1871
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1872
    service = AvahiService(name = server_settings["servicename"],
1873
                           servicetype = "_mandos._tcp",
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
1874
                           protocol = protocol, bus = bus)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1875
    if server_settings["interface"]:
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
1876
        service.interface = (if_nametoindex
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1877
                             (str(server_settings["interface"])))
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
1878
    
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
1879
    global multiprocessing_manager
1880
    multiprocessing_manager = multiprocessing.Manager()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1881
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1882
    client_class = Client
1883
    if use_dbus:
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
1884
        client_class = functools.partial(ClientDBus, bus = bus)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1885
    def client_config_items(config, section):
1886
        special_settings = {
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1887
            "approved_by_default":
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1888
                lambda: config.getboolean(section,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1889
                                          "approved_by_default"),
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1890
            }
1891
        for name, value in config.items(section):
1892
            try:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1893
                yield (name, special_settings[name]())
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1894
            except KeyError:
1895
                yield (name, value)
1896
    
341 by Teddy Hogeborn
Code cleanup and one bug fix.
1897
    tcp_server.clients.update(set(
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1898
            client_class(name = section,
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1899
                         config= dict(client_config_items(
1900
                        client_config, section)))
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1901
            for section in client_config.sections()))
341 by Teddy Hogeborn
Code cleanup and one bug fix.
1902
    if not tcp_server.clients:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1903
        logger.warning("No clients defined")
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1904
        
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
1905
    if not debug:
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
1906
        try:
1907
            with pidfile:
1908
                pid = os.getpid()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1909
                pidfile.write(str(pid) + "\n".encode("utf-8"))
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
1910
            del pidfile
1911
        except IOError:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1912
            logger.error("Could not write to file %r with PID %d",
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
1913
                         pidfilename, pid)
1914
        except NameError:
1915
            # "pidfile" was never created
1916
            pass
1917
        del pidfilename
1918
        
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
1919
        signal.signal(signal.SIGINT, signal.SIG_IGN)
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
1920
28 by Teddy Hogeborn
* server.conf: New file.
1921
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1922
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
1923
    
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1924
    if use_dbus:
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1925
        class MandosDBusService(dbus.service.Object):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1926
            """A D-Bus proxy object"""
1927
            def __init__(self):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1928
                dbus.service.Object.__init__(self, bus, "/")
1929
            _interface = "se.bsnet.fukt.Mandos"
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
1930
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1931
            @dbus.service.signal(_interface, signature="o")
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1932
            def ClientAdded(self, objpath):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1933
                "D-Bus signal"
1934
                pass
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
1935
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1936
            @dbus.service.signal(_interface, signature="ss")
409 by Teddy Hogeborn
* mandos (MandosServer.handle_ipc): Better log message.
1937
            def ClientNotFound(self, fingerprint, address):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1938
                "D-Bus signal"
1939
                pass
1940
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1941
            @dbus.service.signal(_interface, signature="os")
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
1942
            def ClientRemoved(self, objpath, name):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1943
                "D-Bus signal"
1944
                pass
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
1945
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1946
            @dbus.service.method(_interface, out_signature="ao")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1947
            def GetAllClients(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
1948
                "D-Bus method"
341 by Teddy Hogeborn
Code cleanup and one bug fix.
1949
                return dbus.Array(c.dbus_object_path
1950
                                  for c in tcp_server.clients)
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
1951
            
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
1952
            @dbus.service.method(_interface,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1953
                                 out_signature="a{oa{sv}}")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1954
            def GetAllClientsWithProperties(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
1955
                "D-Bus method"
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1956
                return dbus.Dictionary(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1957
                    ((c.dbus_object_path, c.GetAll(""))
341 by Teddy Hogeborn
Code cleanup and one bug fix.
1958
                     for c in tcp_server.clients),
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1959
                    signature="oa{sv}")
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
1960
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1961
            @dbus.service.method(_interface, in_signature="o")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1962
            def RemoveClient(self, object_path):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
1963
                "D-Bus method"
341 by Teddy Hogeborn
Code cleanup and one bug fix.
1964
                for c in tcp_server.clients:
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1965
                    if c.dbus_object_path == object_path:
341 by Teddy Hogeborn
Code cleanup and one bug fix.
1966
                        tcp_server.clients.remove(c)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1967
                        c.remove_from_connection()
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1968
                        # Don't signal anything except ClientRemoved
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1969
                        c.disable(quiet=True)
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1970
                        # Emit D-Bus signal
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
1971
                        self.ClientRemoved(object_path, c.name)
1972
                        return
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
1973
                raise KeyError(object_path)
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
1974
            
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1975
            del _interface
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
1976
        
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1977
        mandos_dbus_service = MandosDBusService()
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1978
    
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
1979
    def cleanup():
1980
        "Cleanup function; run on exit"
1981
        service.cleanup()
1982
        
1983
        while tcp_server.clients:
1984
            client = tcp_server.clients.pop()
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1985
            if use_dbus:
1986
                client.remove_from_connection()
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
1987
            client.disable_hook = None
1988
            # Don't signal anything except ClientRemoved
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1989
            client.disable(quiet=True)
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
1990
            if use_dbus:
1991
                # Emit D-Bus signal
1992
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1993
                                                  client.name)
1994
    
1995
    atexit.register(cleanup)
1996
    
341 by Teddy Hogeborn
Code cleanup and one bug fix.
1997
    for client in tcp_server.clients:
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1998
        if use_dbus:
1999
            # Emit D-Bus signal
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2000
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
2001
        client.enable()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2002
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2003
    tcp_server.enable()
2004
    tcp_server.server_activate()
2005
    
28 by Teddy Hogeborn
* server.conf: New file.
2006
    # Find out what port we got
2007
    service.port = tcp_server.socket.getsockname()[1]
314 by Teddy Hogeborn
Support not using IPv6 in server:
2008
    if use_ipv6:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2009
        logger.info("Now listening on address %r, port %d,"
2010
                    " flowinfo %d, scope_id %d"
314 by Teddy Hogeborn
Support not using IPv6 in server:
2011
                    % tcp_server.socket.getsockname())
2012
    else:                       # IPv4
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2013
        logger.info("Now listening on address %r, port %d"
314 by Teddy Hogeborn
Support not using IPv6 in server:
2014
                    % tcp_server.socket.getsockname())
28 by Teddy Hogeborn
* server.conf: New file.
2015
    
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
2016
    #service.interface = tcp_server.socket.getsockname()[3]
28 by Teddy Hogeborn
* server.conf: New file.
2017
    
2018
    try:
2019
        # From the Avahi example code
2020
        try:
336 by Teddy Hogeborn
Code cleanup.
2021
            service.activate()
28 by Teddy Hogeborn
* server.conf: New file.
2022
        except dbus.exceptions.DBusException, error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2023
            logger.critical("DBusException: %s", error)
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
2024
            cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
2025
            sys.exit(1)
2026
        # End of Avahi example code
2027
        
2028
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2029
                             lambda *args, **kwargs:
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2030
                             (tcp_server.handle_request
2031
                              (*args[2:], **kwargs) or True))
28 by Teddy Hogeborn
* server.conf: New file.
2032
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2033
        logger.debug("Starting main loop")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2034
        main_loop.run()
28 by Teddy Hogeborn
* server.conf: New file.
2035
    except AvahiError, error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2036
        logger.critical("AvahiError: %s", error)
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
2037
        cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
2038
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2039
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2040
        if debug:
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
2041
            print("", file=sys.stderr)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2042
        logger.debug("Server received KeyboardInterrupt")
2043
    logger.debug("Server exiting")
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
2044
    # Must run before the D-Bus bus name gets deregistered
2045
    cleanup()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2046
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2047
if __name__ == '__main__':
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2048
    main()